cleaner[.]exe | Triage

Resubmissions

01/05/2024, 08:52

240501-ks4a7abd8x 10

07/06/2023, 20:13

230607-yzvvaafd99 10

Sharing

General

Target

cleaner.exe
Size

4KB
MD5

e9ded10dff258f6522fe9079ed3319ca
SHA1

b0127ea7675f6359bfa80a7bf6282bd1c989b405
SHA256

ea1d61984ede5908e0840e91a71bb127efd62d836c1f76702b426fd79b57f780
SHA512

d95482d3cf50b37e999e3f91377bd41a215f3f0c55c9f3e47fc9c563b9cd3f5c5ee945878889a8147b9f089005826ce81398172395d0107dc14eb8fefc0d36de

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cleaner.exe

Files

cleaner.exe
.exe windows:6 windows x86 arch:x86

Password: asdfff

3723fc928ce08f1496ce2bb81e2bbfdf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

wcslen
memset
free
wcsstr
calloc
_wcsicmp
_wsplitpath
memcpy

kernel32

QueryFullProcessImageNameW
CreateProcessW
MoveFileExW
CloseHandle
Process32FirstW
GetCommandLineW
GetCurrentProcess
TerminateProcess
GetModuleFileNameW
CreateFileW
DuplicateHandle
OpenProcess
CreateToolhelp32Snapshot
Process32NextW

advapi32

RegCloseKey
RegCreateKeyExW
RegSetValueExW

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ