Behavioral task
behavioral1
Sample
1416-74-0x0000000000400000-0x00000000013AA000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1416-74-0x0000000000400000-0x00000000013AA000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1416-74-0x0000000000400000-0x00000000013AA000-memory.dmp
-
Size
15.7MB
-
MD5
d64a358c3c73e372a600a08fe5d1dcba
-
SHA1
ca1d903d41b2a074bd9e69108fb62c41ac5914b6
-
SHA256
d95eed1cac157da78d131e594d61b7ea57e87bc8a5512ab41997eb57ccfc3646
-
SHA512
b705d6b6ae82699882d0eecd64ad6e6cec5eb3e4b75f948151eaec40a30923b96d92b5e08aaa38a1add7e5ee27dc24018f39df124b287d796cdf9888110c31fc
-
SSDEEP
12288:msYSsp5R3j0Tj4XaW4I7NM0B9a0zyZLOSfmiEG:S3JNB4gSOs
Malware Config
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Gcleaner family
Files
-
1416-74-0x0000000000400000-0x00000000013AA000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 177KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 76KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ