| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2021-Dec-21 16:10:08 |
| Detected languages |
English - United States
|
| Debug artifacts |
G:\Medusa\Release\gaze.pdb
|
| Info | Matching compiler(s): | Microsoft Visual C++ 6.0 - 8.0 |
| Info | Libraries used to perform cryptographic operations: | Microsoft's Cryptography API |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 61/72 (Scanned on 2025-01-16 06:50:30) |
ALYac:
Trojan.Ransom.Filecoder
AVG: Win32:RansomX-gen [Ransom] AhnLab-V3: Ransomware/Win.MEDUSALOCKER.C5402963 Alibaba: Ransom:Win32/MedusaLocker.a7ccc022 Antiy-AVL: Trojan[Ransom]/Win32.Medusa Arcabit: Trojan.Ransom.Imps.1 Avast: Win32:RansomX-gen [Ransom] Avira: HEUR/AGEN.1318692 BitDefender: Gen:Heur.Ransom.Imps.1 Bkav: W32.AIDetectMalware CAT-QuickHeal: Ransom.Medusa.S32195177 CTX: exe.ransomware.medusa ClamAV: Win.Ransomware.Medusa-10025438-0 CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe Cynet: Malicious (score: 99) DrWeb: Trojan.Siggen23.61227 ESET-NOD32: a variant of Win32/Filecoder.Medusa.A Elastic: malicious (high confidence) Emsisoft: Gen:Heur.Ransom.Imps.1 (B) F-Secure: Heuristic.HEUR/AGEN.1318692 FireEye: Generic.mg.84b88ac81e4872ff Fortinet: W32/Filecoder.MEDU!tr.ransom GData: Win32.Trojan-Ransom.MedusaLocker.A Google: Detected Gridinsoft: Ransom.Win32.Generic.oa!s1 Ikarus: Trojan-Ransom.Medusa Jiangmin: Trojan.Generic.hrdek K7AntiVirus: Trojan ( 0059f3a21 ) K7GW: Trojan ( 0059f3a21 ) Kaspersky: HEUR:Trojan-Ransom.Win32.Generic Kingsoft: Win32.Trojan-Ransom.Generic.a Lionic: Trojan.Win32.Medusa.j!c Malwarebytes: Ransom.Medusa MaxSecure: Trojan.Malware.10307848.susgen McAfee: Ransom-Medusa!84B88AC81E48 McAfeeD: ti!4D4DF87CF8D8 MicroWorld-eScan: Gen:Heur.Ransom.Imps.1 Microsoft: Ransom:Win32/Medusa.PA!MTB NANO-Antivirus: Trojan.Win32.Filecoder.kbqsmi Paloalto: generic.ml Panda: Trj/GdSda.A Rising: Ransom.Medusa!1.10015 (CLASSIC) Sangfor: Ransom.Win32.Medusa.Vqfw SentinelOne: Static AI - Malicious PE Skyhigh: Ransom-Medusa!84B88AC81E48 Sophos: Mal/Medusa-C Symantec: Ransom.Medusa Tencent: Malware.Win32.Gencirc.10bf15e6 TrendMicro: Ransom.Win32.MEDUSA.THIAHBD TrendMicro-HouseCall: Ransom.Win32.MEDUSA.THIAHBD VBA32: BScope.TrojanPSW.Stealer VIPRE: Gen:Heur.Ransom.Imps.1 Varist: W32/Medusa.B.gen!Eldorado ViRobot: Trojan.Win.S.Medusa.639488 VirIT: Trojan.Win32.GenusT.DYIQ Xcitium: Malware@#2a3z9vul8pull Yandex: Trojan.Filecoder!kFKy0lrvcmg Zillya: Trojan.Generic.Win32.1807576 alibabacloud: Ransomware:Win/Medusa.A huorong: HEUR:Ransom/LockFile.a |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x100 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2021-Dec-21 16:10:08 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x77c00 |
| SizeOfInitializedData | 0x2ea00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00038273 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x79000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xaa000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
ReadFile
SetHandleInformation lstrlenW CreatePipe GetFileAttributesW SetFileAttributesW GetLogicalDriveStringsW Sleep GetTickCount64 GetDiskFreeSpaceExW CloseHandle GetConsoleWindow CreateProcessA MoveFileW GetDriveTypeW GetSystemFirmwareTable HeapSize SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation HeapReAlloc FlushFileBuffers GetFileSizeEx GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetProcessHeap HeapAlloc WriteConsoleW HeapFree RaiseException WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo MultiByteToWideChar LocalFree FormatMessageA CreateFileW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW SetEndOfFile SetFilePointerEx AreFileApisANSI GetLastError WideCharToMultiByte EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetProcAddress QueryPerformanceCounter EncodePointer DecodePointer GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo SetEvent ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleFileNameW GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree DuplicateHandle ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW RtlUnwind ExitThread GetModuleHandleExW SetEnvironmentVariableW ExitProcess GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetConsoleMode ReadConsoleW GetFileType GetDateFormatW GetTimeFormatW |
|---|---|
| USER32.dll |
wsprintfW
ShowWindow |
| bcrypt.dll |
BCryptImportKeyPair
BCryptCloseAlgorithmProvider BCryptFinishHash BCryptSetProperty BCryptGetProperty BCryptDestroyKey BCryptEncrypt BCryptHashData BCryptGenerateSymmetricKey BCryptCreateHash BCryptOpenAlgorithmProvider |
| CRYPT32.dll |
CryptStringToBinaryA
CryptDecodeObjectEx |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2021-Dec-21 16:10:08 |
| Version | 0.0 |
| SizeofData | 51 |
| AddressOfRawData | 0x8d1a0 |
| PointerToRawData | 0x8c1a0 |
| Referenced File | G:\Medusa\Release\gaze.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2021-Dec-21 16:10:08 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x8d1d4 |
| PointerToRawData | 0x8c1d4 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2021-Dec-21 16:10:08 |
| Version | 0.0 |
| SizeofData | 940 |
| AddressOfRawData | 0x8d1e8 |
| PointerToRawData | 0x8c1e8 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2021-Dec-21 16:10:08 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
| StartAddressOfRawData | 0x48d5a4 |
|---|---|
| EndAddressOfRawData | 0x48d5ac |
| AddressOfIndex | 0x4967d0 |
| AddressOfCallbacks | 0x4792e8 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0xb8 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x493018 |
| SEHandlerTable | 0x48cddc |
| SEHandlerCount | 241 |
| XOR Key | 0xc0268e29 |
|---|---|
| Unmarked objects | 0 |
| ASM objects (VS2017 v14.15 compiler 26715) | 17 |
| C++ objects (VS2017 v14.15 compiler 26715) | 182 |
| C objects (VS2017 v14.15 compiler 26715) | 23 |
| C objects (VS 2015/2017/2019 runtime 28920) | 18 |
| ASM objects (VS 2015/2017/2019 runtime 28920) | 23 |
| C++ objects (VS 2015/2017/2019 runtime 28920) | 146 |
| Imports (VS2017 v14.15 compiler 26715) | 9 |
| Total imports | 172 |
| C++ objects (LTCG) (VS2019 Update 7 (16.7.1) compiler 29111) | 3 |
| Resource objects (VS2019 Update 7 (16.7.1) compiler 29111) | 1 |
| Linker (VS2019 Update 7 (16.7.1) compiler 29111) | 1 |