gcleaner | 640-1505-0x0000000000400000-0x0000000000C74000-memory[.]dmp | Triage

Sharing

General

Target

640-1505-0x0000000000400000-0x0000000000C74000-memory.dmp
Size

8.5MB
MD5

ff871bdfb29c427141fa8b2d705db965
SHA1

66301087454462acba4bbf6c64abbfc89c4a0be5
SHA256

ae853e3d04a9d638cf7994862d4552fb7ab6171975fa1120387bfe554aa29879
SHA512

08031166ab35a2d96e462e4a68a7b9e8c387d12df60ee2882b912f69529dfd811f040098bd87c028bb255424c96873e25e1ee402dba0e28fdfabb6d299a66c08
SSDEEP

98304:mcGB/etc9A435zpA7M7TM+CwQfj0x0owt0:5v7mw4wj0x0o

Score

10^/10

gcleaner

Malware Config

Signatures

Gcleaner family
gcleaner

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
640-1505-0x0000000000400000-0x0000000000C74000-memory.dmp

Files

640-1505-0x0000000000400000-0x0000000000C74000-memory.dmp
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ