mwr-files-cleaner[.]exe | Triage

Sharing

General

Target

mwr-files-cleaner.exe
Size

11KB
MD5

4960c9d73f903fd68f3243897ec49e2f
SHA1

401545bcd30d9d0de45cb64ebb43e045bb377779
SHA256

4900e44d9ed753f2ced7b407133a510b5e007b0ce146ad2fb9d4a3e405215ff9
SHA512

b7fe91f4b01a2fa2814c46373c84681b9da76c96da44ee2357892c300c76a698d4abc53a7b2d5fd6f1c6e7fe01afca7ed77d79b82fd7eba70e8c9b89ee5eaec4
SSDEEP

192:x3fjCjJRj7Uadl2oOqkqLLLlLYi1CinS9orelk:xvjCjJRjRl2oOqkqX5EiEqrel

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mwr-files-cleaner.exe

Files

mwr-files-cleaner.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\deskktop\0x\h1m\mwr-files-cleaner\mwr-files-cleaner\obj\Release\mwr-files-cleaner.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ