gandcrab | NEAS[.]ea68f1a05175d0c03ec4941568227180[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.ea68f1a05175d0c03ec4941568227180.exe
Size

92KB
MD5

ea68f1a05175d0c03ec4941568227180
SHA1

254b1de4eff4e9bdc9c94d41fe90edb49529f0a4
SHA256

f981610111081ae3e5eeec0dbaf058c129ea02a84c5a47e15820eb9ff88f92ce
SHA512

50fd5351b759dd7e8c1fbebd48ff9d53cbe988006b6ae6543f6acf06b653c791f113a1b83ac180318388b6113b80ba43b9e5ca5a44aabd78f827b730da0cdef9
SSDEEP

1536:MppppppppppppZEt70RLSffxxzvaPkyJMqqU+2bbbAV2/S2TrKUx:p0xkfxxuZJMqqDL2/TrK

Score

10^/10

gandcrab

Malware Config

Signatures

GandCrab payload 1 IoCs

resource	yara_rule
sample	family_gandcrab

Gandcrab family
gandcrab

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.ea68f1a05175d0c03ec4941568227180.exe

Files

NEAS.ea68f1a05175d0c03ec4941568227180.exe
.dll windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ