Behavioral task
behavioral1
Sample
1348-55-0x0000000000400000-0x00000000004C5000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1348-55-0x0000000000400000-0x00000000004C5000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1348-55-0x0000000000400000-0x00000000004C5000-memory.dmp
-
Size
788KB
-
MD5
7edd2645e0a8159ca36c3b397b4b7221
-
SHA1
47ccc7e1cd443b3b05578214ec5300f09ad818a6
-
SHA256
866c66b917f0d0eb2266f1b54b6a972e21a6376912266d09612d76ad811c2b44
-
SHA512
bde125c80fd05e2312a6e0e0e066a115605429ac558424258f267fb42deb4e1ce7bf625c3063c87fc84435f8346b0c689a28113ee892cccf85e282bca0ef8de4
-
SSDEEP
6144:yrRA8uQPFDeueWsCUCWT6LCICVOWM4tIP8scqwAOIW3eF+:yrRAoPFDeueWHUCWTVB+IZeY
Malware Config
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Gcleaner family
Files
-
1348-55-0x0000000000400000-0x00000000004C5000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 176KB - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ