Static task
static1
Behavioral task
behavioral1
Sample
cleaner.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cleaner.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
cleaner.exe
Resource
win11-20240419-en
General
-
Target
ea1d61984ede5908e0840e91a71bb127efd62d836c1f76702b426fd79b57f780.zip
-
Size
1KB
-
MD5
d409c401d3fe3657bc050c3d492d88ee
-
SHA1
888d74ea4f1d2ffc78b2d71bc409a58c914403b6
-
SHA256
678ac76ce207ffc24f7591fd17c3e09a7c458fe9901969272c012e1c1f5585a7
-
SHA512
2d09d41264fef059ef7ee6026b18b1aa3f37eec64ad398e63fe13a5d2d9e230a7baf82cf4e5d2cc22a8c5bfd10bdec68d6e77fadbacfab077cd8cd9cabcf57aa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/cleaner.bin
Files
-
ea1d61984ede5908e0840e91a71bb127efd62d836c1f76702b426fd79b57f780.zip.zip
Password: infected
-
cleaner.bin.exe windows:6 windows x86 arch:x86
Password: infected
3723fc928ce08f1496ce2bb81e2bbfdf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
wcslen
memset
free
wcsstr
calloc
_wcsicmp
_wsplitpath
memcpy
kernel32
QueryFullProcessImageNameW
CreateProcessW
MoveFileExW
CloseHandle
Process32FirstW
GetCommandLineW
GetCurrentProcess
TerminateProcess
GetModuleFileNameW
CreateFileW
DuplicateHandle
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
advapi32
RegCloseKey
RegCreateKeyExW
RegSetValueExW
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ