gandcrab | 2024-10-06_3a43da104b66b5538d60c2b8985400c4_gandcrab

General

Target
2024-10-06_3a43da104b66b5538d60c2b8985400c4_gandcrab
Size 97KB
Sample241006-e4nf8axaqh
SHA256 e9d39abb209b31d0c54f5516e6dbf9c5b0942fa56c3dcb1c9cbb56423effded7
MD5 3a43da104b66b5538d60c2b8985400c4
SHA1 99ddc16c8ef2bfebc835477298d3ac3989ef23e5
SHA512 ee1a91ad0c3e4c28ea84ebea4673b0abcf49b92286d95d0f53b8a37c80e185eda55f4d7c14364f1e4c1c8b3db29749f7a4642196cb4b097cf3d2c40ad6b022e5
SSDEEP 1536:qZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAlMqqU+2bbbAV2/S2LNmHkf:cBounVyFHkMqqDL2/LgHkctc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upx gandcrab

GandCrab payload 1 IoCs

resource	yara_rule
sample	family_gandcrab

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-10-06_3a43da104b66b5538d60c2b8985400c4_gandcrab

SHA256 e9d39abb209b31d0c54f5516e6dbf9c5b0942fa56c3dcb1c9cbb56423effded7
MD5 3a43da104b66b5538d60c2b8985400c4
SHA1 99ddc16c8ef2bfebc835477298d3ac3989ef23e5
SHA512 ee1a91ad0c3e4c28ea84ebea4673b0abcf49b92286d95d0f53b8a37c80e185eda55f4d7c14364f1e4c1c8b3db29749f7a4642196cb4b097cf3d2c40ad6b022e5
SSDEEP 1536:qZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAlMqqU+2bbbAV2/S2LNmHkf:cBounVyFHkMqqDL2/LgHkctc
MD5 SHA1 SHA512 SSDEEP

GandCrab payload
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

19440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths