Behavioral task
behavioral1
Sample
584-83-0x0000000000400000-0x00000000013B4000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
584-83-0x0000000000400000-0x00000000013B4000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
584-83-0x0000000000400000-0x00000000013B4000-memory.dmp
-
Size
15.7MB
-
MD5
ce58cea0242abf4cc9f1f612b1e0b00b
-
SHA1
fe78773d304ab09be82b4372986e7944d523de6b
-
SHA256
6ca5fb07451e52ce800edeca390f2e9836570af792ef8d51fba4e4bfd800499f
-
SHA512
b074726ec82a850e27c76b2b8a71355f80ac609d89289eab0fbe8ee25cb51a028920e76cb7e390af2cc316ee337b4c9c9b8791ac7f76bfd4501e0e5f4821d8a5
-
SSDEEP
6144:DxTYo+YqCuqTsi5R0CLFGYjYPfl2SV0hAOc7qtN:dTYo+YqCuqT/5R0CxldO0N
Malware Config
Extracted
gcleaner
45.12.253.51
45.12.253.92
45.12.253.89
45.12.253.55
Signatures
-
Gcleaner family
Files
-
584-83-0x0000000000400000-0x00000000013B4000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 171KB - Virtual size: 170KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ