gandcrab | NEAS[.]ec68acf8be05e909622b3390dcb035b0[.]exe | Triage

Sharing

General

Target

NEAS.ec68acf8be05e909622b3390dcb035b0.exe
Size

92KB
MD5

ec68acf8be05e909622b3390dcb035b0
SHA1

b4a95d8251ea225a2bf38f8f5b6df691735a1f2a
SHA256

35095c17c5cf087d714bf66db397f0b9f4b887f51eb46f913fc292a99f1abdec
SHA512

2ebfa9c8a64cbee2479229fb4b9388a6496c96e6a90a33438f76c1caf0e9545b820538a35052dcd093efbe47dcf527212e2b44f74527ddf4c4a8540be06860f5
SSDEEP

1536:sFFFFFFFFFFFF1Uj2HdSH0X3Vzkgczu1KYUMqqU+2bbbAV2/S2TOKU1:i9M0nVzkZu1UMqqDL2/TOK

Score

10^/10

gandcrab

Malware Config

Signatures

GandCrab payload 1 IoCs

resource	yara_rule
sample	family_gandcrab

Gandcrab family
gandcrab

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.ec68acf8be05e909622b3390dcb035b0.exe

Files

NEAS.ec68acf8be05e909622b3390dcb035b0.exe
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ