Behavioral task
behavioral1
Sample
34bf233959e477039639db2cd69fb043_gandcrab_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
34bf233959e477039639db2cd69fb043_gandcrab_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
34bf233959e477039639db2cd69fb043_gandcrab_JC.exe
-
Size
344KB
-
MD5
34bf233959e477039639db2cd69fb043
-
SHA1
27dbabfe6ebac861634bc937902c84f26251301d
-
SHA256
ac99939838c6a055444ca99458982c4e1906d8ceec10a6cddfb0ab97adaded19
-
SHA512
1b92fca3ae30c6fa2c8d8c9d4710a8c655336b6386d54471209cc74641958ed31f6ceeb8d4061d597e61fa7ad21e143611f2e11cf5b9b8df6ac079d4e70b3ff6
-
SSDEEP
6144:lcytwby1yTS+xqqDL6HKswFZbFPF1Xy96F8C9Ej:Cyiy1Rqn6qskbFPbXy9zr
Malware Config
Signatures
-
GandCrab payload 1 IoCs
resource yara_rule sample family_gandcrab -
Gandcrab family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 34bf233959e477039639db2cd69fb043_gandcrab_JC.exe
Files
-
34bf233959e477039639db2cd69fb043_gandcrab_JC.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 81KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ