HeuZ OS Debloater & Optimizer[.]exe

Target
HeuZ OS Debloater & Optimizer.exe
Size 66.4MB
Sample260728-e9fnkabj5t
SHA256 5c2e9604ddf63e732a674d9672a4ba20f44891a83e10f44f1d4d764f8c59ea63
MD5 dc0a967a764de0158fa92cf07f34a26b
SHA1 236e1f4540dd8ce928ac2776fa2b012c18825dc9
SHA512 1bbc752805fc2983038b96ba0bffa193bd04d351213f3dfca26c5a37e09514d606e28b829aef46d62c5cf49576d8e79fb40a29d8ebe729e17234e3d63d70f1b4
SSDEEP 393216:J9ttttttttco9ttttttttttttBttttNlc9tb6SaM39k7wwEyaAvJDCm0Wm/ndOLQ:8Ks6WYEyaOsm0Wm/dwXRa
TLSH
T1A7E7BE70F7D3C716CB07417C947EBC7B5B25AED912C1890B01AB2C2A2861F79969B23D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

costura packer

Malware Config

Signatures

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
sample	ConfuserEx

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
sample	costura

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
HeuZ OS Debloater & Optimizer.exe

File Explorer

HeuZ OS Debloater & Optimizer.exe

.exe 66.4MB

HeuZ OS Debloater & Optimizer.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 5c2e9604ddf63e732a674d9672a4ba20f44891a83e10f44f1d4d764f8c59ea63
MD5 dc0a967a764de0158fa92cf07f34a26b
SHA1 236e1f4540dd8ce928ac2776fa2b012c18825dc9
SHA512 1bbc752805fc2983038b96ba0bffa193bd04d351213f3dfca26c5a37e09514d606e28b829aef46d62c5cf49576d8e79fb40a29d8ebe729e17234e3d63d70f1b4
SSDEEP 393216:J9ttttttttco9ttttttttttttBttttNlc9tb6SaM39k7wwEyaAvJDCm0Wm/ndOLQ:8Ks6WYEyaOsm0Wm/dwXRa
TLSH
T1A7E7BE70F7D3C716CB07417C947EBC7B5B25AED912C1890B01AB2C2A2861F79969B23D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ConfuserEx .NET packer

Detects ConfuserEx .NET packer.
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69425502

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Admin\Documents\Visual Studio 2010\Projects\HeuZ_TweakerTool\HeuZ_TweakerTool\obj\x86\Release\HeuZ OS Debloater & Optimizer.pdb

HeuZ OS Debloater & Optimizer.exe

mscoree

dotnet