Behavioral task
behavioral1
Sample
f9da69e4f17ec41e657ab1760a01413f8cd7788cded97d3dfa4190e494dff4ca.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f9da69e4f17ec41e657ab1760a01413f8cd7788cded97d3dfa4190e494dff4ca.exe
Resource
win10v2004-20240802-en
General
-
Target
f9da69e4f17ec41e657ab1760a01413f8cd7788cded97d3dfa4190e494dff4ca
-
Size
256KB
-
MD5
4e737a6cf6b48d1505f5d9f059164842
-
SHA1
8a626da694b29b9b02a613540d5b0e5ce3f9547c
-
SHA256
f9da69e4f17ec41e657ab1760a01413f8cd7788cded97d3dfa4190e494dff4ca
-
SHA512
b88b7d5da6ceeceddbfde9b400de74723feed0f957c74e1c0dc922b557faee721eda2c0fb37bbf41fa2618ae1343bcbdf8240e2179bd4b1a8ba7838d3d5be604
-
SSDEEP
6144:DlLxH5j46nMNiRPx25HGvprekNi7YeTee06r2ATMaCRSodxk3xPQFjJNHz5Kc3S:DxxH5jjMNiRPx25HGvprekNi7YeTee0X
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
Signatures
-
Gcleaner family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f9da69e4f17ec41e657ab1760a01413f8cd7788cded97d3dfa4190e494dff4ca
Files
-
f9da69e4f17ec41e657ab1760a01413f8cd7788cded97d3dfa4190e494dff4ca.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 161KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 58KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ