gcleaner | 3000-7-0x0000000000400000-0x0000000000C62000-memory[.]dmp | Triage

Sharing

General

Target

3000-7-0x0000000000400000-0x0000000000C62000-memory.dmp
Size

8.4MB
MD5

3574e3e831af1888962ba3bea486b98d
SHA1

2f2afec487a464d31b45d8de77d499181ca4d1b6
SHA256

affa8c7d1636f28e16042a7fc1d65d170b0df696b8a8f48123200064daabd02a
SHA512

5657bb84112f811bd6dab7fd6697be6fccf92a114f3580ee39a8b359b757da1e9443688aeaf4cb665b488167ad7bece99fac123610cd6ec2a478a29c20be46f2
SSDEEP

98304:mcJw7pboLKRY+NLB/NriVIQNxMwtZSDDkslgadViutHkjjc0:fTS/NriVIQNxTSDDbxNFkjjc0

Score

10^/10

gcleaner

Malware Config

Signatures

Gcleaner family
gcleaner

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3000-7-0x0000000000400000-0x0000000000C62000-memory.dmp

Files

3000-7-0x0000000000400000-0x0000000000C62000-memory.dmp
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ