gandcrab | NA_06442f325754c2exe_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NA_06442f325754c2exe_JC.exe
Size

92KB
MD5

06442f325754c2094cae72cd77a7002c
SHA1

d2e279525fcaec2922a6b581b4dde4712ae33150
SHA256

01a9c0c4818edb31821a2b16abefd53b598bafefe35872225f0b4bc721c6c867
SHA512

051c111ce7457c6f6ec8e56a5f916ee027a123367cb32cb189a3c970b193a61f11d361781d7c402e4f22b3171d077afe92f80ab26fca1f6477798e4b96d7d451
SSDEEP

1536:JZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXouWVU8hbHnAsMqqU+2bbbAV2/S2Lkvd6T:1BouWVzFHtMqqDL2/Lkvd

Score

10^/10

gandcrab

Malware Config

Signatures

GandCrab payload 1 IoCs

resource	yara_rule
sample	family_gandcrab

Gandcrab family
gandcrab

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NA_06442f325754c2exe_JC.exe

Files

NA_06442f325754c2exe_JC.exe
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.xObf
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE