gcleaner | 2604-7-0x0000000000400000-0x0000000000C52000-memory[.]dmp | Triage

Sharing

General

Target

2604-7-0x0000000000400000-0x0000000000C52000-memory.dmp
Size

8.3MB
MD5

eba6f06341e661c97c378019a3592789
SHA1

564f6d2ac449c88fac85ec65972f72a00e0b9499
SHA256

09eb3060e263b62a10f9e178d87dd6c56a0ad6e21aa0a81769708d33c1be2fca
SHA512

f82b6a1519ef0fe859cdf09abfec952b5f7d74768aa6c2fd2d2697ed436693dd0c43025352da8028f1d9b8f74a0686503b095df42ace97e0a3eaad6b61ad49f3
SSDEEP

98304:mcDUpbcUX660dtgM1DyEeMYsATTnLb1oloJkK/2MVeTnXImJ7T0y:J3ozeoJp2OeTnLJ7TN

Score

10^/10

gcleaner

Malware Config

Signatures

Gcleaner family
gcleaner

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2604-7-0x0000000000400000-0x0000000000C52000-memory.dmp

Files

2604-7-0x0000000000400000-0x0000000000C52000-memory.dmp
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ