Behavioral task
behavioral1
Sample
940-74-0x0000000000400000-0x000000000137D000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
940-74-0x0000000000400000-0x000000000137D000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
940-74-0x0000000000400000-0x000000000137D000-memory.dmp
-
Size
15.5MB
-
MD5
a5ac3b99cf4ff7a95a52bc697f13817f
-
SHA1
5a17df3fd3df12e7fc66510185625787781dd2b3
-
SHA256
13ff3706a259c24769d6942cb0eb1ac885ae16173b5cc4e38ef2387bb24da4ce
-
SHA512
459d0e169e982162cbcb22078c4c3566f4e55637e6de3af0fe5d2f84f6644ef2af2b418e8e01a7d4bb2bb9f98f9eff433da49ee357da3ac3a875e9d4bee53534
-
SSDEEP
12288:msYSsp5R3j0Tj4XaW4I7NM0B9a0CyvLOSfmiSG5:S3JNBHCSOa5
Malware Config
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Gcleaner family
Files
-
940-74-0x0000000000400000-0x000000000137D000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 177KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 76KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ