b3f763502582232189f1fbb306b3b0dbe91352f55b3a7bc07e5c6eb51b459a2e
- SHA256 b3f763502582232189f1fbb306b3b0dbe91352f55b3a7bc07e5c6eb51b459a2e
Behavioral task
behavioral1
Sample
电脑清理工具.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
电脑清理工具.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target b3f763502582232189f1fbb306b3b0dbe91352f55b3a7bc07e5c6eb51b459a2e
- Size 10.0MB
- Sample261113-n8e53sbs8m
- SHA256 b3f763502582232189f1fbb306b3b0dbe91352f55b3a7bc07e5c6eb51b459a2e
- MD5 8b311779affb6d99da241dab66e5a513
- SHA1 bf5b38bb932e020c76c6e8ddb09b934592398551
- SHA512 c5adc42ba00a46104aa523dfa0e9d913be69462df68d48002d7a39a5ec277c0f08c9cd752df287d01e54fef31566e99d970083e86f755c7e39df56559bc0d933
- SSDEEP 196608:BNOpkGYd7oEpcksIFdGJYMZXPiMFtctPiac6ZQygaFTTUOCa6OoL0wvMHQvT:BNOpkddmksIzGJYU/iMFtLAZ3gATTUOg
- TLSH T16CB633E8D8D329CFA4455F849CFEA5B59998FF390F414829A943A1023E371B77A2DC90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/电脑清理工具.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/电脑清理工具.exe
File Explorer
-
b3f763502582232189f1fbb306b3b0dbe91352f55b3a7bc07e5c6eb51b459a2e.zip 10.0MB
-
icon.ico24KB
-
pc_cleaner.py.sh .vbs 80KB
-
电脑清理工具.exe.exe 10.2MB
-
pc_cleaner.pyc123KB
-
电脑清理工具_使用说明报告.md6KB
icon.ico
- SHA256 8944265dac31ddbb3feac7b6b3c4a132ddae50d5e5eb48d2c63eb4bba01f3b88
- MD5 8ec0f370b94b072ee5f5e186ec492358
- SHA1 fe1df120a846c358378dab1260b6758eb06fa2d2
- SHA512 1b357677f7a6cdda8cc036b9bc9d7d1e80943b792c64f6844e6c9e6346c2411035c0eb50f50813548aa3a4f9977ce8a5d6f88ae229c08064fe6a6b8cf05064c3
- SSDEEP 384:NdmZpYr0Q6SkyaboMdjhVVXu6RIfGketyDHwXN9Qqc1BGhRpWs/Bs:NdmZRPya0MZc6RIfRq6HwXUNaRHs
- TLSH T159B2D185CB797579C5CC6A2F648EE760C97F81EB58488103D6F6D060F9DB32784F8091
- MD5 SHA1 SHA512 SSDEEP TLSH
pc_cleaner.py
- SHA256 bf9ca6a21b55a25152b603fb32381183a49443fd3f831ce6778391680bc3f3a2
- MD5 e685a4d28f02e2c6bfe8be82201172cb
- SHA1 9cc96237ab769c40700eaa52d9969d4dfc25bd4e
- SHA512 62fc7678a0cddb3dfa6fbb170ea18b192d137007de1487805221af521ba7108f24f8db4f0ef02b1f5eb809a0728e42bcb95ef40ff4ed96e3b7c7d27878f5d1c9
- SSDEEP 768:/1R9l6tzYLk4TPpmxz3QZ51W3TAItt8h73l1C:/1R9azCTPpmBQpzIttg3l1C
- TLSH T133839366AD105862D303D96B5497A553EB1E7E43450E2838F9FC62A41F8C43AC2FCEED
- MD5 SHA1 SHA512 SSDEEP TLSH
电脑清理工具.exe
- IMPHASH e3e80a143805ea18936c8f612e25d363
- SHA256 204f58b08782dad5f2527f1a959cca39727c49eb6c311c1eebf987d6ca155626
- MD5 b84481affd00e6441dd48ffd409b5213
- SHA1 0196ff19f376bf82275c56811485c8ef7731b41f
- SHA512 835cb56fe943fd2e57d051cb9aa90f29cd5cdb8ab91f9c67a30ebc52d30092eb2c41e48d4e0375187c96e0b112e7261f5d24b2d8d6717268241cc9c7c0e03ebc
- SSDEEP 196608:BaCBUGiY0W8UAl0nGCxdGjP5bsi2bjKVPy2wE4/Fe8x+EQOwuFQFvCpAX:BaCBU7PW82nGCnGjOi2bjRo4Ne8x+Eba
- TLSH T1DAB63388FBC204D8F94A5239DCE25567E7E5B92107A485DF4BF248421E331EAFE39760
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
59248
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
MonitorFromPoint
GetCursorPos
GetSystemMetrics
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
GetCurrentDirectoryW
HeapAlloc
GetFileSizeEx
GetConsoleOutputCP
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
CloseHandle
GetCurrentProcess
GetModuleFileNameW
SetDllDirectoryW
GetEnvironmentStringsW
SetErrorMode
GetCurrentProcessId
OpenProcess
QueryFullProcessImageNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateSymbolicLinkW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
GetConsoleMode
ReadConsoleW
advapi32
GetTokenInformation
OpenProcessToken
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
200KB
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
82KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=189, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=11, id=257, version=33145,
count=163, id=1, productName=Unmarked objects,
count=30, id=260, version=36246,
count=1, id=258, version=36246,
pc_cleaner.pyc
- SHA256 922e54f865badc9f6673d8f0f3d5690d7b5fe20626859869b8e1814acb7d3e33
- MD5 ba431f86ac70f448aa60f3198ddb331a
- SHA1 7673aa9652df60a2d0fffcbb53a4a759aac834dd
- SHA512 90118740d199df3e3d4394783f758d8ab9d06765bff4d2c25404fbb72acd3bee2c11f96c5607aa12d1d9a85cf8d55ea6a723400084dda088d1434068aa76713d
- SSDEEP 1536:ls2Fw1MAo9owM9GrolMkAskQYpB+tKbcwMuZnfCdDmJTazdYnhd:ls2CdwM9lTAt9D+tseDiTazdYhd
- TLSH T150C3D54AB9309A53EF1471B584EA0404F36EBE92F760CB63312F52363DD6A79CE65708
- MD5 SHA1 SHA512 SSDEEP TLSH
电脑清理工具_使用说明报告.md
- SHA256 0ca79665c4d2eb191aa1f872ef5d1a107907e7c0c78da650d54715056db92582
- MD5 8b4264ccbdc69711e9a6ead6d115af21
- SHA1 ba29e06a39500227f0fdca164e6d3353292dcc6d
- SHA512 cc747a837a48b4f2276b9973ad5c189c0ffabaa2927eb5c508d3a563cf0d100af3abbe912f75b9c8d0ea173a589001be1a38c5c92d27eae45bafed9b9f822765
- SSDEEP 192:qNbDboDoGJs22NtdwzF47gq71wZAU1NQxxryQbtGbro:qNnboEp3Vg8eCJ2QL
- TLSH T1CBD1E7B9833AB3AC951181D3048D24FAA90F654598B96ECCF2FA104B63C4F2D43BDB61
- MD5 SHA1 SHA512 SSDEEP TLSH