Static task
static1
Behavioral task
behavioral1
Sample
grandcab.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
grandcab.exe
Resource
win10v2004-20231020-en
General
-
Target
grandcab.bin
-
Size
484KB
-
MD5
97a449fed7d800a8a635592605ff8a67
-
SHA1
2f339d8b2edb7c07126d9a3c37effe14966817c5
-
SHA256
233437b647f9482a8a3ba51d0af69039bb58fb48609704a39db1f709a0e6aca6
-
SHA512
85b4b260b801c54927f7b985d5f9fb891e44e5f72f9dcf9656684f8872339480ded94b4f3ba44d71fa491b88243f99155e3ecc7b3005fb5fbe24b1d10f47e4c3
-
SSDEEP
12288:hEm67VkaivvtYku9hoVw7G/znXoABEg6s0u1Tw:dEivv+bGuuznXONq10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource grandcab.bin
Files
-
grandcab.bin.exe windows:5 windows x86
72d3be2a4396d0ac38f25e12d06c98ec
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateEventW
WriteConsoleW
SetEndOfFile
SetStdHandle
FlushFileBuffers
GetStringTypeW
HeapSize
GetConsoleMode
GetConsoleCP
HeapReAlloc
LoadLibraryW
GetSystemTimeAsFileTime
GlobalAlloc
GetOverlappedResult
GlobalFree
GetCommandLineW
lstrlenW
lstrcpyA
WaitForSingleObject
CancelIoEx
CreateEventA
GetMailslotInfo
GetModuleHandleA
GetTempPathW
GetModuleFileNameW
VirtualLock
SetLastError
GetProcessHeap
HeapAlloc
OutputDebugStringA
GetCurrentProcess
GetTickCount
lstrlenA
EnumDateFormatsA
ExpandEnvironmentStringsW
GetModuleFileNameA
ReadFile
VirtualAlloc
IsBadReadPtr
SetFilePointer
WriteFile
GetLastError
CreateFileA
GetFileSize
CreateFileMappingA
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
GetCurrentProcessId
QueryPerformanceCounter
DeleteCriticalSection
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
WideCharToMultiByte
IsValidCodePage
GetOEMCP
CreateFileW
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
Sleep
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedDecrement
GetCurrentThreadId
InterlockedIncrement
TlsFree
TlsSetValue
CloseHandle
MultiByteToWideChar
TlsGetValue
TlsAlloc
EncodePointer
GetStdHandle
DecodePointer
ExitProcess
GetModuleHandleW
GetProcAddress
HeapCreate
GetStartupInfoW
HeapSetInformation
GetCommandLineA
RaiseException
CreateThread
ResumeThread
ExitThread
RtlUnwind
HeapFree
user32
EnumDisplaySettingsA
GetMonitorInfoA
LoadImageA
SendMessageA
BeginPaint
SystemParametersInfoA
EndPaint
DialogBoxParamA
GetParent
wsprintfA
MessageBoxA
DestroyWindow
CreateDialogParamW
GetDesktopWindow
GetWindowRect
SetDlgItemTextA
SetScrollRange
ReleaseDC
GetDC
gdi32
AddFontResourceExW
GetObjectA
CreateFontIndirectA
CombineRgn
GetTextMetricsW
TextOutW
MoveToEx
SelectObject
DeleteObject
BitBlt
GetStockObject
FillRgn
comdlg32
GetOpenFileNameA
CommDlgExtendedError
ChooseColorA
advapi32
ReportEventA
RegSetValueExW
IsTextUnicode
AllocateAndInitializeSid
OpenProcessToken
GetTokenInformation
GetSidSubAuthorityCount
GetSidLengthRequired
RegOpenKeyExA
RegQueryValueExA
RegisterEventSourceA
RegOpenKeyExW
DeregisterEventSource
RegQueryInfoKeyA
RegSetValueExA
RegEnumValueA
RegDeleteValueA
RegCloseKey
shell32
CommandLineToArgvW
ole32
RegisterDragDrop
CreateStreamOnHGlobal
ws2_32
WSAEnumNetworkEvents
accept
WSAStartup
bind
socket
WSAEventSelect
htons
netapi32
NetUserModalsGet
NetApiBufferFree
NetWkstaUserGetInfo
DsGetDcNameA
userenv
GetGPOListA
FreeGPOListA
msacm32
acmFormatEnumA
acmFormatTagEnumA
shlwapi
PathFileExistsW
PathRemoveFileSpecW
StrPBrkA
PathIsDirectoryW
comctl32
CreateToolbarEx
secur32
GetUserNameExA
dbghelp
EnumerateLoadedModules
urlmon
FaultInIEFeature
Sections
.text Size: 94KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.gcode Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gdata Size: 512B - Virtual size: 466B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ