Behavioral task
behavioral1
Sample
1b54420df6aaa65cfa29159b3bd0387ea2e6ce0a22de3fb5aace5200f2d69b0fN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1b54420df6aaa65cfa29159b3bd0387ea2e6ce0a22de3fb5aace5200f2d69b0fN.exe
Resource
win10v2004-20241007-en
General
-
Target
1b54420df6aaa65cfa29159b3bd0387ea2e6ce0a22de3fb5aace5200f2d69b0fN.exe
-
Size
1.6MB
-
MD5
c89e2fee6ae55cebb8954d7068abee30
-
SHA1
a10c19f243757d451861de2424f09ed940b92fd6
-
SHA256
1b54420df6aaa65cfa29159b3bd0387ea2e6ce0a22de3fb5aace5200f2d69b0f
-
SHA512
6feb38a06d486505f8ee74b98d2c24abbe03a07a9b39d46ff2e98c4e209ac457e8369910bfa3cdca343b818587f0af196a50070070dbb15d2cfcf88f89893fbd
-
SSDEEP
6144:Udt56eh8ITcleMH9SDomjDBvMYos+CmDyZYIMsCIxl0J8kEMAOU1g:Udt56ehi/H9SDomjDBvMYojCmDu7esg
Malware Config
Extracted
gcleaner
208.67.104.97
85.31.46.167
-
url_path
....!..../software.php
....!..../software.php
Signatures
-
Gcleaner family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1b54420df6aaa65cfa29159b3bd0387ea2e6ce0a22de3fb5aace5200f2d69b0fN.exe
Files
-
1b54420df6aaa65cfa29159b3bd0387ea2e6ce0a22de3fb5aace5200f2d69b0fN.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ