General

Malware Config

Signatures

Files

• 2024-06-20_4c79af78d4e097c0e5aab647ae6902ed_gandcrab

  .exe windows:5 windows x86 arch:x86

  6b11af918234585a966ca8fab046dc6c

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_NO_BIND

  IMAGE_DLLCHARACTERISTICS_APPCONTAINER

  IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_AGGRESIVE_WS_TRIM

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DEBUG_STRIPPED

  IMAGE_FILE_NET_RUN_FROM_SWAP

  IMAGE_FILE_UP_SYSTEM_ONLY

  IMAGE_FILE_BYTES_REVERSED_HI

  Imports

  kernel32

  SetFilePointer

  GetFileAttributesW

  ReadFile

  GetLastError

  MoveFileW

  lstrcpyW

  SetFileAttributesW

  CreateMutexW

  GetDriveTypeW

  VerSetConditionMask

  WaitForSingleObject

  GetTickCount

  InitializeCriticalSection

  OpenProcess

  GetSystemDirectoryW

  TerminateThread

  Sleep

  TerminateProcess

  VerifyVersionInfoW

  WaitForMultipleObjects

  DeleteCriticalSection

  ExpandEnvironmentStringsW

  lstrlenW

  SetHandleInformation

  lstrcatA

  MultiByteToWideChar

  CreatePipe

  lstrcmpiA

  Process32NextW

  CreateToolhelp32Snapshot

  LeaveCriticalSection

  EnterCriticalSection

  FindFirstFileW

  lstrcmpW

  FindClose

  FindNextFileW

  GetNativeSystemInfo

  GetComputerNameW

  GetDiskFreeSpaceW

  GetWindowsDirectoryW

  GetVolumeInformationW

  LoadLibraryA

  lstrcmpiW

  VirtualFree

  CreateThread

  CloseHandle

  lstrcatW

  CreateFileMappingW

  ExitThread

  CreateFileW

  GetModuleFileNameW

  WriteFile

  GetModuleHandleW

  UnmapViewOfFile

  MapViewOfFile

  GetFileSize

  GetEnvironmentVariableW

  lstrcpyA

  GetModuleHandleA

  VirtualAlloc

  GetProcAddress

  Process32FirstW

  GetTempPathW

  GetProcessHeap

  HeapFree

  HeapAlloc

  lstrlenA

  CreateProcessW

  ExitProcess

  IsProcessorFeaturePresent

  user32

  BeginPaint

  wsprintfW

  TranslateMessage

  LoadCursorW

  LoadIconW

  MessageBoxA

  GetMessageW

  EndPaint

  DestroyWindow

  RegisterClassExW

  ShowWindow

  CreateWindowExW

  SendMessageW

  DispatchMessageW

  DefWindowProcW

  UpdateWindow

  GetForegroundWindow

  SetWindowLongW

  gdi32

  TextOutW

  advapi32

  FreeSid

  RegSetValueExW

  RegCreateKeyExW

  RegCloseKey

  CryptExportKey

  CryptAcquireContextW

  CryptGetKeyParam

  CryptReleaseContext

  CryptImportKey

  CryptEncrypt

  CryptGenKey

  CryptDestroyKey

  GetUserNameW

  RegQueryValueExW

  RegOpenKeyExW

  AllocateAndInitializeSid

  shell32

  ShellExecuteW

  SHGetSpecialFolderPathW

  ShellExecuteExW

  crypt32

  CryptStringToBinaryA

  CryptBinaryToStringA

  wininet

  InternetCloseHandle

  HttpAddRequestHeadersW

  HttpSendRequestW

  InternetConnectW

  HttpOpenRequestW

  InternetOpenW

  InternetReadFile

  psapi

  EnumDeviceDrivers

  GetDeviceDriverBaseNameW

  Exports

  Exports

  _ReflectiveLoader@0

  Sections

  .text

  Size: 33KB - Virtual size: 32KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 4B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .brdata

  Size: 726B - Virtual size: 726B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE