windows-memory-cleaner-1[.]1-installer[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

windows-memory-cleaner-1.1-installer.exe
Size

94KB
MD5

20733aa806b2abc81bd68df7e3a7625a
SHA1

e0f8d36c4e26ad32f81e35d3d5f469be1747cc15
SHA256

5718d9d115ae2f21b1c63eea914108411e2590fb79a86b5bd94b0095be19f25d
SHA512

e80f8ccebe18606af697f243d16c7a6700f9bf1d9dc12c2e764101680cb7635ccf7e6051104e5ca14984628a1c66576dce7cf80159611840078528867358be50
SSDEEP

1536:lGolEhuaVoD8qDlATS46i4ZeqVGLwaWts5E/wL4dRhuDaIGeRhuDaIP:lllIuaVoD7WRwbVg2Cm/cQuzGouzP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/WinMemoryCleaner.exe

Files

windows-memory-cleaner-1.1-installer.exe
.zip
WinMemoryCleaner.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\igorm\Source\Repos\WinMemoryCleaner\obj\Release\WinMemoryCleaner.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 197KB - Virtual size: 197KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ