filename446c0e0e409c926e05bbe9edf736423c1f0bd6c5.bin
size99840 (0x18600)
md53c03701002cddaf95e3581ba73d7ae12
typePE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
mimetypeapplication/x-dosexec
clamavWin.Ransomware.Gandcrab-6502432-0 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
223208064
224208062
224210052
001
1473072921
10134
2292100519
220210051
219210051
222210051

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 a1 d4 58 db 30  b3 6d 20 63 61 6e 6e 6f  |is ..X.0.m canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x5a8c5ad9
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x302
Magic0x10b
LinkerVersion12.0
SizeOfCode0x7000
SizeOfInitializedData0x1000
SizeOfUninitializedData0x10000
AddressOfEntryPoint0x4bf0
BaseOfCode0x11000
BaseOfData0x18000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x1b000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x540
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

namevavsizeraw sizeflags
UPX00x10000x100000xf800RWX CODE UDATA
UPX10x110000x70000x7000RWX IDATA
.rsrc0x180000x10000x400RW- IDATA
.imports0x190000x10000xa00RW- IDATA
.reloc0x1a0000x10000xc00RW- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x104e00x55
IMPORT0x190000xb4
RESOURCE0x180000x1dc
EXCEPTION00
SECURITY00
BASERELOC0x1a0000xac4
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#23810
module_namehintordfunction_name
KERNEL32.DLLSetFilePointer
KERNEL32.DLLGetFileAttributesW
KERNEL32.DLLReadFile
KERNEL32.DLLGetLastError
KERNEL32.DLLMoveFileW
KERNEL32.DLLlstrcpyW
KERNEL32.DLLSetFileAttributesW
KERNEL32.DLLCreateMutexW
KERNEL32.DLLGetDriveTypeW
KERNEL32.DLLVerSetConditionMask
KERNEL32.DLLWaitForSingleObject
KERNEL32.DLLGetTickCount
KERNEL32.DLLInitializeCriticalSection
KERNEL32.DLLOpenProcess
KERNEL32.DLLGetSystemDirectoryW
KERNEL32.DLLTerminateThread
KERNEL32.DLLSleep
KERNEL32.DLLTerminateProcess
KERNEL32.DLLVerifyVersionInfoW
KERNEL32.DLLWaitForMultipleObjects
KERNEL32.DLLDeleteCriticalSection
KERNEL32.DLLExpandEnvironmentStringsW
KERNEL32.DLLlstrlenW
KERNEL32.DLLSetHandleInformation
KERNEL32.DLLlstrcatA
KERNEL32.DLLMultiByteToWideChar
KERNEL32.DLLCreatePipe
KERNEL32.DLLlstrcmpiA
KERNEL32.DLLProcess32NextW
KERNEL32.DLLCreateToolhelp32Snapshot
KERNEL32.DLLLeaveCriticalSection
KERNEL32.DLLEnterCriticalSection
KERNEL32.DLLFindFirstFileW
KERNEL32.DLLlstrcmpW
KERNEL32.DLLFindClose
KERNEL32.DLLFindNextFileW
KERNEL32.DLLGetNativeSystemInfo
KERNEL32.DLLGetComputerNameW
KERNEL32.DLLGetDiskFreeSpaceW
KERNEL32.DLLGetWindowsDirectoryW
KERNEL32.DLLGetVolumeInformationW
KERNEL32.DLLLoadLibraryA
KERNEL32.DLLlstrcmpiW
KERNEL32.DLLVirtualFree
KERNEL32.DLLCreateThread
KERNEL32.DLLCloseHandle
KERNEL32.DLLlstrcatW
KERNEL32.DLLCreateFileMappingW
KERNEL32.DLLExitThread
KERNEL32.DLLCreateFileW
KERNEL32.DLLGetModuleFileNameW
KERNEL32.DLLWriteFile
KERNEL32.DLLGetModuleHandleW
KERNEL32.DLLUnmapViewOfFile
KERNEL32.DLLMapViewOfFile
KERNEL32.DLLGetFileSize
KERNEL32.DLLGetEnvironmentVariableW
KERNEL32.DLLlstrcpyA
KERNEL32.DLLGetModuleHandleA
KERNEL32.DLLVirtualAlloc
KERNEL32.DLLGetProcAddress
KERNEL32.DLLProcess32FirstW
KERNEL32.DLLGetTempPathW
KERNEL32.DLLGetProcessHeap
KERNEL32.DLLHeapFree
KERNEL32.DLLHeapAlloc
KERNEL32.DLLlstrlenA
KERNEL32.DLLCreateProcessW
KERNEL32.DLLExitProcess
KERNEL32.DLLIsProcessorFeaturePresent
ADVAPI32.dllFreeSid
ADVAPI32.dllRegSetValueExW
ADVAPI32.dllRegCreateKeyExW
ADVAPI32.dllRegCloseKey
ADVAPI32.dllCryptExportKey
ADVAPI32.dllCryptAcquireContextW
ADVAPI32.dllCryptGetKeyParam
ADVAPI32.dllCryptReleaseContext
ADVAPI32.dllCryptImportKey
ADVAPI32.dllCryptEncrypt
ADVAPI32.dllCryptGenKey
ADVAPI32.dllCryptDestroyKey
ADVAPI32.dllGetUserNameW
ADVAPI32.dllRegQueryValueExW
ADVAPI32.dllRegOpenKeyExW
ADVAPI32.dllAllocateAndInitializeSid
CRYPT32.dllCryptStringToBinaryA
CRYPT32.dllCryptBinaryToStringA
GDI32.dllTextOutW
PSAPI.DLLEnumDeviceDrivers
PSAPI.DLLGetDeviceDriverBaseNameW
SHELL32.dllShellExecuteW
SHELL32.dllSHGetSpecialFolderPathW
SHELL32.dllShellExecuteExW
USER32.dllBeginPaint
USER32.dllwsprintfW
USER32.dllTranslateMessage
USER32.dllLoadCursorW
USER32.dllLoadIconW
USER32.dllMessageBoxA
USER32.dllGetMessageW
USER32.dllEndPaint
USER32.dllDestroyWindow
USER32.dllRegisterClassExW
USER32.dllShowWindow
USER32.dllCreateWindowExW
USER32.dllSendMessageW
USER32.dllDispatchMessageW
USER32.dllDefWindowProcW
USER32.dllUpdateWindow
USER32.dllGetForegroundWindow
USER32.dllSetWindowLongW
WININET.dllInternetCloseHandle
WININET.dllHttpAddRequestHeadersW
WININET.dllHttpSendRequestW
WININET.dllInternetConnectW
WININET.dllHttpOpenRequestW
WININET.dllInternetOpenW
WININET.dllInternetReadFile
ordentry_vafunction_name
10x5ec0_ReflectiveLoader@0
module_nameencryption.dll
flags0
timestamp2018-02-20 17:28:56
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0x1050c
Functions(1)0x10508
NameOrdinals(1)0x10510
offsetsizetypecomment
099840EXE02/20/2018 17:28:57#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK