gcleaner | 2944-159-0x0000000000400000-0x0000000000C71000-memory[.]dmp | Triage

Sharing

General

Target

2944-159-0x0000000000400000-0x0000000000C71000-memory.dmp
Size

8.4MB
MD5

d97c8504dc814777c7e7c9c636adc595
SHA1

192f1ffe70c5cd6135e0134337214a8b725ae855
SHA256

24cbe35ca2c05a97d332cace35a77b5f9dc1d7ea971374b174f60471e69c1454
SHA512

1ba834a123bfa2dfde3fda15210447ef935da8b2b78b4de69676a2f488f60b09adb72ccb56905f8026c7109af4db8e987ba8a47aad97f1bb5709967214845f4f
SSDEEP

49152:vjilq8Y9Xo4GqP9bhRv4qs2ygUYBnRyqN9UneONweQVmC75SS6:vjillYlo4GqP9bvgj2yV3S9/ewmCn6

Score

10^/10

gcleaner

Malware Config

Signatures

Gcleaner family
gcleaner

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2944-159-0x0000000000400000-0x0000000000C71000-memory.dmp

Files

2944-159-0x0000000000400000-0x0000000000C71000-memory.dmp
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ