Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
2708-277-0x0000000000400000-0x0000000000C66000-memory.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2708-277-0x0000000000400000-0x0000000000C66000-memory.exe
Resource
win10v2004-20241007-en
General
-
Target
2708-277-0x0000000000400000-0x0000000000C66000-memory.dmp
-
Size
8.4MB
-
MD5
1c936828dc9e80fad4165c74afa63f06
-
SHA1
25e77bdd70a6d4ca086f6418f55441eeaad649fe
-
SHA256
7fd2be495b41fc0cdd62844c168e5af4b8eca4be0dca31fe5fa22eb50abc4a7e
-
SHA512
a7dad72475839f8ccc0c836b11dca362f61bb2e3f05581282d6155cfeca623b8516d926ce85a306df209ef55366d5147378b18b1624ae6e166e91aae37bc30b1
-
SSDEEP
98304:mc7TCnxTdPm+aFIym2uOF5A8SNxFSVnfDs028aPYg2My:JDuO8xCnfE8dg2
Malware Config
Signatures
-
Gcleaner family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2708-277-0x0000000000400000-0x0000000000C66000-memory.dmp
Files
-
2708-277-0x0000000000400000-0x0000000000C66000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 109KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ