Discord%20Cleaner%20by%20Team.zip
- SHA256 579c6bc07a953f175fd59ea1feff444d0e94d963644314eb380f8446da6dec97
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Discord Cleaner by Team/DiscordCleaner.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Discord Cleaner by Team/DiscordCleaner.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target Discord%20Cleaner%20by%20Team.zip
- Size 169KB
- Sample261102-plhhcshy6t
- SHA256 579c6bc07a953f175fd59ea1feff444d0e94d963644314eb380f8446da6dec97
- MD5 f189ff2ccfe0ec68a5d472260d91a01e
- SHA1 ed9de2373eac5383517a9eb3e15ffd54f92b53a8
- SHA512 dce2cc393d91a0899bd0f9f8e7addcbc31d0424f5cb094f9c214271aac1c92045c7418105b3146145f41723e874a9e107b631ebd9d92bcfe491d908d95f49ce8
- SSDEEP 3072:lZNxVm23uvd5+RjXFS8UsGDPpm7Btwrdevg6WpyrDRXyvY9AF:Rxovf+pXFS8h7Hwrdeo6iyHRivYaF
- TLSH T12E0423B8E5C16D15D2238EB2D0D5474070D0B5E613A03EA6D7C4BDAA4BC6A9D07CEFB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Discord Cleaner by Team/DiscordCleaner.exe
File Explorer
-
Discord%20Cleaner%20by%20Team.zip.zip 169KB
-
Discord Cleaner by Team/DiscordCleaner.exe.exe 320KB
-
Discord Cleaner by Team/settings.ini442B
Discord Cleaner by Team/DiscordCleaner.exe
- IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
- SHA256 ecb23f27f1543cf7545bbacb076e7c7eea089de7965137af3840fcb8b3f7dceb
- MD5 1a0010f8b192f8ec62e8169db025d6e8
- SHA1 e5a277ff9c7dce471070ce42e2d9d5fd2e3e7eb7
- SHA512 1f6899bdcb583c8d5a416d4eb84931c025217a3aa1f283d91330210e1cfe77718a5a6b6ffe646e2880043c8c0dbffa48c5ac39a95ceb829d9363df1a359a65c0
- SSDEEP 3072:9qeXA/4yIg9vkNPNu6H6xCYOixUE265eJpCiWhW/lrNS3TeQV6C+CiWhW/KrNS3A:9vgvkNFNaxmVE+JpCNhLeQVOCNhoJQqG
- TLSH T11E647D07B79882A9D172A634D89249C8EB327C158FB297DB53507E761F7BB809D39303
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_errno
_initialize_onexit_table
abort
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___wargv
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_set_fmode
fputwc
__p__commode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
wcsncmp
toupper
strcmp
strlen
_wcsdup
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64_s
_time64
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
setlocale
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
81KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35223,
count=1, id=258, version=35223,
Discord Cleaner by Team/settings.ini
- SHA256 7f7b688448216ab95333fc7f996942dcb48d32d0478ef584df589190439604be
- MD5 ca9968257f8aed338255875dd280ad3f
- SHA1 016223fb5d8222b199073ad3e2e437eb9d9d8cc0
- SHA512 be0baa746409c307ff858a57d2d969e49db09dc5e6f4126c241209b0f8f8d41a9c1a453facf51aae1f3c5038910aa745db5df92a095bb8201fe3d1a9ee50d38a
- TLSH T124F0A3C00F9FBB5A80B4D591CF9652430F99894BC12A4AA2D0D8CEAD756D6CCC13F7A7
- MD5 SHA1 SHA512 TLSH