KeepClean[.]exe | Triage™

General

Target
KeepClean.exe
Size 405KB
Sample261107-nvzmkaxt8j
SHA256 f783f39824bcdd902660358f4a3d496305092309f13e2c1a15b057175bf78c67
MD5 33b955e25db460dc94fe7e8939750a81
SHA1 34462316ec9879abb2f48b180c2ec5ba7c87a5a1
SHA512 c4233cd6429ba23778fba7c1a654b8ce48f3a93dafc81f0a0455d05caecc41332f7053c78b1cea6188b25b10afeb6f950973ca5f765495892e22d2efd0f0f04c
SSDEEP 6144:CcQH5c5i2Yq6X2KQLJH/0R3HVUm3whrra:Cn5Ci2F6GKEB/0RFUmg4
TLSH
T1D494D60AEA7519F5D0BAE03C8582652AF87136A64370FFCB67944A571F327F4A93DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KeepClean.exe

File Explorer

KeepClean.exe

.exe 405KB

KeepClean.exe

IMPHASH cebe646399e1c31a8ef48aea2d671dc9
SHA256 f783f39824bcdd902660358f4a3d496305092309f13e2c1a15b057175bf78c67
MD5 33b955e25db460dc94fe7e8939750a81
SHA1 34462316ec9879abb2f48b180c2ec5ba7c87a5a1
SHA512 c4233cd6429ba23778fba7c1a654b8ce48f3a93dafc81f0a0455d05caecc41332f7053c78b1cea6188b25b10afeb6f950973ca5f765495892e22d2efd0f0f04c
SSDEEP 6144:CcQH5c5i2Yq6X2KQLJH/0R3HVUm3whrra:Cn5Ci2F6GKEB/0RFUmg4
TLSH
T1D494D60AEA7519F5D0BAE03C8582652AF87136A64370FFCB67944A571F327F4A93DB00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

176104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegSetValueExA GetUserNameW

bcrypt

BCryptGenRandom

wininet

InternetOpenUrlW InternetCloseHandle InternetOpenW InternetReadFile

kernel32

SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW CreateFileW DeleteFileW WriteFile CloseHandle Sleep CreateProcessW LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW QueryPerformanceCounter GetSystemTimeAsFileTime GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess GetCurrentProcessId InitializeSListHead FreeEnvironmentStringsW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW RtlUnwind

Name

.text

Size

290KB

Virtual Size

290KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

KeepClean.exe

advapi32

bcrypt

wininet

kernel32

generic