gcleaner | 2436-1413-0x0000000000400000-0x0000000000C8A000-memory[.]dmp | Triage

Sharing

General

Target

2436-1413-0x0000000000400000-0x0000000000C8A000-memory.dmp
Size

8.5MB
MD5

0173b4d9545a5c66ea8d4b7be2c736e5
SHA1

b3d45a69a4afe2d43f77304097daae4c8f1ff721
SHA256

b87800a01ee687393516444a56f00b9158ba34b038c02f4e7b328be2cc6d4d71
SHA512

7359bd6b75abf2ecc8eb2898c3b5ded8a7b000cee13f55314875c1c6f690d88926a7ac0e2921c2a49dfc66b1cd740862bdfebf319028638d94b1973db3e943ef
SSDEEP

98304:vjilKMlllYZ0sshYTP+vtnv+orGcc6w2xQ4WPejLc+JRZlrz21hn:w1nqcQ2xQ0/c4ZRA

Score

10^/10

gcleaner

Malware Config

Signatures

Gcleaner family
gcleaner

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2436-1413-0x0000000000400000-0x0000000000C8A000-memory.dmp

Files

2436-1413-0x0000000000400000-0x0000000000C8A000-memory.dmp
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ