gcleaner | 2496-7-0x0000000000400000-0x0000000000C58000-memory[.]dmp | Triage

Sharing

General

Target

2496-7-0x0000000000400000-0x0000000000C58000-memory.dmp
Size

8.3MB
MD5

e460cfaab84203c2d6291d57ae35c2f1
SHA1

20db31984f23523e41a3dccb1849be67284a9d09
SHA256

570dd67f012c806f9ec28f45090222a10bed22b4a50a575ea8ae18333868d364
SHA512

b5f4350930ef57267a67ce65729d315124c08b2b14b8ce1b0ac7f45c7fc4937c9a234f85c1ee0bddaf765dd9af186411f7e9d95ba26263c0d93bc2fe22733be1
SSDEEP

98304:mcmEuFO96q/q3SuMrFQ9KuPHPEdElIfxE1Th2yMiuQV:/H6UEGfe1l2zihV

Score

10^/10

gcleaner

Malware Config

Signatures

Gcleaner family
gcleaner

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2496-7-0x0000000000400000-0x0000000000C58000-memory.dmp

Files

2496-7-0x0000000000400000-0x0000000000C58000-memory.dmp
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ