File 78c0cb19131d853244d8a4283892c25ecaf5714aa290cccf0bedc975d55d0391 Summary
Like

Analyse score

0 / 14

No antivirus venders flagged
this file as malicious

Signature

File is not signed

Last scanned

First submission

File type

sys

sys

Basic properties

CRC32

0xebdeb015

MD5

1f39d885f4d7c2e338e66c063c3128bc

Magic

PE32+ executable (DLL) (GUI) x86-64, for MS Windows

SHA1

b0da34aebaeb213ce3a39773c0a5a96dae572c10

SHA256

78c0cb19131d853244d8a4283892c25ecaf5714aa290cccf0bedc975d55d0391

SHA512

14a92b501a86023b1a184fa267d16d418050be889f265ac9e75665b16287e93fc10811ccca3991ab9c0c23575ed24d48960b4e119e1779438d3ab1ab9031da47

SSDeep

1536:np4jztzPDJybhXvGbHcDggBgPvEG0xKfStKI39+ZYZG1N2a35QEz+:np6t7qzLBgPvJ0xKfStKIt+Cw1AamEz+

Size

96.00KB

Packer
  • PE+(64): compiler: Microsoft Visual C/C++(-)[-]
  • PE+(64): linker: Microsoft Linker(14.30**)[DLL64]
TrID
  • 63.5% (.EXE) Win64 Executable (generic) (10523/12/4)
  • 12.2% (.EXE) OS/2 Executable (generic) (2029/13)
  • 12.0% (.EXE) Generic Win/DOS Executable (2002/3)
  • 12.0% (.EXE) DOS Executable Generic (2000/1)
Tags

ExifTool File Metadata

CharacterSet

Unicode

CodeSize

48.00KB

CompanyName

Microsoft Corporation

EntryPoint

0x1700

ExifToolVersionNumber

12.62

FileDescription

Disk Space Cleaner for Windows

FileFlags

(none)

FileFlagsMask

0x003f

FileOs

Windows NT 32-bit

FileSize

98 kB

FileSubtype

0

FileType

Win64 DLL

FileTypeExtension

dll

FileVersion

10.0.22621.900 (WinBuild.160101.0800)

FileVersionNumber

10.0.22621.900

ImageFileCharacteristics

Executable, Large address aware, DLL

ImageVersion

10.0

InitializedDataSize

44.00KB

InternalName

DATACLEN

LanguageCode

English (U.S.)

LegalCopyright

© Microsoft Corporation. All rights reserved.

LinkerVersion

14.30

MachineType

AMD AMD64

MimeType

application/octet-stream

ObjectFileType

Executable application

OriginalFileName

DATACLEN.DLL

OsVersion

10.0

PeType

PE32+

ProductName

Microsoft® Windows® Operating System

ProductVersion

10.0.22621.900

ProductVersionNumber

10.0.22621.900

Subsystem

Windows GUI

SubsystemVersion

10.0

UninitializedDataSize

0

Warning

Possibly corrupt Version resource

Show all

Submissions

Published Name Source Country
dataclen.dll web US

Indicators

Description Severity Category Module
Malware detection of a yara signature: Win32/WannaCry
malicious
Sandbox Detection Behavior
Communicates over HTTP with a low reputation domain
informational
C2 Behavior
Deletes itself after process termination
suspicious
Stealth Behavior
Write a file to the startup folder
suspicious
Persistence Behavior
Check for the existence of Virtual Machines
suspicious
Signature Yara

🚀 Coming soon!

Virtual Screens

🚀 Coming soon!