gcleaner | 1820-7-0x0000000000400000-0x0000000000C4C000-memory[.]dmp | Triage

Sharing

General

Target

1820-7-0x0000000000400000-0x0000000000C4C000-memory.dmp
Size

8.3MB
MD5

87e0ec4f8bd0c1852ce4b0534de563e0
SHA1

f0a182740efb0e8dab3a53b67f0b63dd861df751
SHA256

0a7495db673f347a74e1337e5a6fd637e58c77574eabd0aeb0397417c4b1c2ba
SHA512

fb970fb8570bca9c689cb64cd16189337ff7f680090093ab36b679138c854394fd13772a74713f87e576489fb5bf0b4e0060b038a4dea7e51f8575a6853aa32b
SSDEEP

98304:mcsuSYKIXJ0fXH5wSwc4YCPkU1ayfPxUTjM52N:q+uiSP4Y8k6aoxL2

Score

10^/10

gcleaner

Malware Config

Signatures

Gcleaner family
gcleaner

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1820-7-0x0000000000400000-0x0000000000C4C000-memory.dmp

Files

1820-7-0x0000000000400000-0x0000000000C4C000-memory.dmp
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ