j3GW%s�<��cj�D�Jz��4�!���5�&��jeR����(�7�G��\���V{�1Q1�ݝ����E�i&��SV������� H��L��Xn������j�#����7�`.����y�P����yL̮*�JJ#�i�������N�+��]����b����F��]"��5��0���12na�ό�K�늴}�a���lcqW���{�aE@��;dY��ߐ����/�l)�I�Qn�!I����U��+NR ���L.u�36$<�~G9�i~�^�km�������5LjL6��B2Eα Sۓ|�(ݖm�8 �P�q�����c�����N�%|<���Fd8������}���]��yx=`�:����|c-��*� �^�J���db��f���</��u�����젇�K�G�=���x�S�OIJ��U�{�K�Y����_3%�0�Sގ6.s*+���{�`;T�Wo8��:�uS?_��� ��<t���`t �k��ȸ�"��o)��%L������%#K��X�.R�� ���4_ c[OZԑ������p��L���x5�������'x| "����~����ȗ���je����r��I#�S���('Y�PK���'��b��&9[�J��n��e�-���;P�`��0,�ԑ���/o�G�M��YI ��V�jL *0���*�$a�J����|c���+"��s��I��l06n�L��7.�.5<q��{�-V���?�����3GIx ��oVLQ8��ڊ`Šk�Ã>n-�(���n�b@lD`����B)M�c8��ߎ*�����Ȧ2�b���x����c��\��7������&��g�4 �tj��� Y��WF�s���YfE����H� ����5���>����3I�leN�];w+֜2��33R��?y�����1�G5�l.�����iD5�d�J� ;������Hi�f.͉���AĝR����,~f�2�8ƌ���h �3V�6%-Āq�xCf�祎�Νj�1F���E�;=������Ab��4�����}��M������-��n ���՝1ts% u7�1� �F�����BE��.�{@ҰFAj�����;�����ԯ�����\_qd�R$@�0� +Cr��ӜR�t��������V.��Is�Če�һ<Z�������dX?)�f�e�P�n 3�X�na�}\��4������ 0}��g��0c)��Yr����|��@4��,o�5)=��f9�O�h6� ��A�u�}���~8��Yr7㔢���ő�cܲGS��(I,��bQ��Y֊N�h�1N��RLgj��U +���^���]v����PiJt�u��n M�l�l��S��b�y�C����������EPI��\��u܈s��}����Ҳ�/?�������_pۿ�7���g����u��?��Ѧ��S�����r�AL9Q�KQ�T����)��`�N�����cu>s�a�`�L@��lS�t�S�[f��iQ����f�Y��J+A"):��>��g�M��rV���6�Țz��%��g�~�.��.��a1�*V���k�+���y����W�m?A��#v�ی ����ɚ������|����M;,$����ii�s����{��.�����z���\�����5gZNy�ZI�� �� �� �IW5,����]d �+�EJ~�tSCR5 Z�XNaPv�}e�!��v���]���W)�`$O�>�3^�b�o�wD�K��sU��i�Z�j��;s'h9c%Q���H���/�XS[��A������l�BEyȢB��ޜ���us�9�wjT˔��_��6����:��u�����A4�?����a �T�T�|4�[�El.�' ʧ��Ha�3�bΝwP���O��ߪ�4w���j볂�BD�&��M��o��f��u��u��݃��$v��>���vȤ���G9҈<������\���`����c$���:ޱJ����5K,0��]���YՊ���Q���X"~�⇻Q9�H���?�]tFz#������GĴ��`wH<8Y�]������'�W�A�ܩR�)K�L���P�2�$5s���˞B�U�ٳS�������*J�3���+��[5�Y�.Г����c�?�y���5�r8(�f���Ƣ{��,��w�����~ߪH��n<W!�Y����:� O���G�1�k���� ���v/��'ɮ(���ד�8��x�(�����.�V�F��1�AP/���Ͷ���8� ʺa��Zc�_"��W@�iE3�dyg��� J봰������`9�3ZϢ�W�sޱݞ�v���5n$���Д�����@#����n�K�� \�pzPh/�Rؔ�������jSS7�<�)�p9���PQ�<Y��ɂ��n��i����4���r̯��yr�A'�r_�lf���fZ���z����16��@KRk������j���nv�E��c|��JLun��N��6�y��g�H�N�j�L�Wg�x��^���o�=H1�_��(��+�b���ML�VMu'�߅�Q�)r\��4A�����)���\?�(�-J��ŏ�2, ��y ��Oj���ucٛ"���z��D�I�ЄΩ���6=��LH�2" `�D|�j�"��ꚮ���C�����q�)�yh g�W/5��7���`�YBϕ� �ƂS��ρD*��*{7q�Dwڱ�M��\2A���m�x�ik�OR����x�����-�y�3 g~&�;x�L�!o��l��ᛙ Jh;b�>*251t>\�����7�+�jFpԥ�3C��C��cG�)y[�0��-�*/�; ������Z��(��$Xb�'w1"���еg���TѤ�l���N��?����"o%�c���([��a]e��D ���lXRT)> �%$� ���\Ӓ_*�(����w�\uN|RK�<h�n�O�@ʽ!���&��T�Tј����� ^9�ri�4���ǜ�W�����x^3�T|mZ\���bfi�v ���(d�B��"�� \���"Y'g-���%),���I�٫�Wy�~ŝ_#�do+���
Static task
static1
Behavioral task
behavioral1
Sample
Cleaner (1).exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Cleaner (1).exe
Resource
win10v2004-20241007-en
General
-
Target
Cleaner (1).exe
-
Size
6.0MB
-
MD5
0ccec651d8bba5994aa039f5a9af46b6
-
SHA1
002427c48cbc4e64ff5a901f9b89abf7cef7e942
-
SHA256
c5cfe062d0895b2bd6621e06da7ee7e030de2e85f1fc2be62d734ce694bb29bf
-
SHA512
925b5a7f321e7dc37ad6275e38ddf54d4dee3c78c6735c40ede18ee0f831b6831edea5e898f174993e14f167ef54e22796eaac7b8444eb502679a788ec22ad83
-
SSDEEP
98304:qjQzPx3jrd/pJt5hkgpvmzJikw7Q+p0bkKefSfF2UgqzVEo8snr4unLnM/lVJh8n:qs3jrFpJt5hku+zJiJM+iwKefM3RvZse
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource Cleaner (1).exe
Files
-
Cleaner (1).exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 6KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 12KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 297KB - Virtual size: 25.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE