FivemCleaner[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
FivemCleaner.exe
Size 69KB
Sample260624-tmp12sdt7v
SHA256 1c7ba74e844c567f3d88a66b3595264c8dfbba63ec6e4127ef32796dc69a787d
MD5 a077e9445432c2f7a51e5074bc953da3
SHA1 7c721b34b6bf1dcdcec5cef3092e035090312beb
SHA512 41f40b68c456d8e48a5e75780d22c3c9a13a10cb4d52e250f33b66535e65c9f92300b243132c4d6a3ff3a84c3c1236802a363541061f4229a3b2a6ed8aafff47
SSDEEP 1536:dW/qbto8JaTCqnQG/LwBw5ztcQnm1TW7WRi3ZqJl9:wCtHJaTFnQGDmWtu1PRiJqJ
TLSH
T1F2632A4B66A90CE8D2AAA27D8693CD41D373B8C50731C7CF438D922A1F6F2D19D3A751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FivemCleaner.exe

File Explorer

FivemCleaner.exe

.exe 69KB

FivemCleaner.exe

IMPHASH 0a9186f3bb99bae6bb2019fb2a964811
SHA256 1c7ba74e844c567f3d88a66b3595264c8dfbba63ec6e4127ef32796dc69a787d
MD5 a077e9445432c2f7a51e5074bc953da3
SHA1 7c721b34b6bf1dcdcec5cef3092e035090312beb
SHA512 41f40b68c456d8e48a5e75780d22c3c9a13a10cb4d52e250f33b66535e65c9f92300b243132c4d6a3ff3a84c3c1236802a363541061f4229a3b2a6ed8aafff47
SSDEEP 1536:dW/qbto8JaTCqnQG/LwBw5ztcQnm1TW7WRi3ZqJl9:wCtHJaTFnQGDmWtu1PRiJqJ
TLSH
T1F2632A4B66A90CE8D2AAA27D8693CD41D373B8C50731C7CF438D922A1F6F2D19D3A751
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37876

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\545743\source\repos\ConsoleApplication2\x64\Release\1111111111111.pdb

kernel32

CloseHandle SetConsoleCursorPosition SetConsoleWindowInfo GetFileAttributesExW GetModuleFileNameW GetStdHandle SetConsoleScreenBufferSize GetCurrentProcess SetConsoleTextAttribute FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateFileW GetLocaleInfoEx FormatMessageA LocalFree SetFileInformationByHandle AreFileApisANSI GetLastError GetModuleHandleW GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte Sleep GetCurrentThreadId QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent TerminateProcess

user32

MessageBoxW

advapi32

RegDeleteTreeW OpenProcessToken RegOpenKeyExW GetTokenInformation RegCloseKey

shell32

ShellExecuteExW

msvcp140

?is@?$ctype@_W@std@@QEBA_NF_W@Z ??Bid@locale@std@@QEAA_KXZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?good@ios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ _Thrd_join _Query_perf_counter _Thrd_id _Cnd_do_broadcast_at_thread_exit ?_Syserror_map@std@@YAPEBDH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?wcin@std@@3V?$basic_istream@_WU?$char_traits@_W@std@@@1@A

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception __C_specific_handler __current_exception_context __std_exception_copy __std_exception_destroy memcpy memset memcmp _CxxThrowException __std_terminate memmove

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _register_onexit_function _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _crt_atexit _set_app_type _seh_filter_exe _invalid_parameter_noinfo_noreturn abort _initialize_onexit_table _cexit terminate _beginthreadex _exit exit

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc _callnewh

api-ms-win-crt-environment-l1-1-0

_wdupenv_s

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode