GDI malware

Warning icon

Not enough notable sources.

The subject "GDI malware" may not have enough notable sources online. Please discuss on the talk page.

Warning! This article documents malware!

DO NOT download and run any linked samples on your main PC, or else it can result in your data being deleted! Please make sure to only run them on a virtual machine when testing the samples!

GDI malwares are malwares made for the Windows operating system that have been developed by various creators. None of these malwares are intended for malicious purposes, they are instead meant to be tested for educational purposes, usually in VMware or VirtualBox.

Execution

Upon execution, they often display 2 warnings, asking the user if they want to run the malware, to prevent further execution by users who are running it on their main device. If the user answers "Yes" to both warnings, the malware will run.

GDI payloads

The main part of these malwares are the GDI effects. Each payload features GDI visual effects on the screen and Bytebeat sounds.

Other payloads

Some malwares have other non-GDI payloads, including:

• Displaying a fake error message.
• Shaking open windows.
• Opening random system programs.

Destructive payloads

Some GDI malwares have safe versions that do not have the destructive payloads listed below, but still have the GDI payloads.

Destructive versions of GDI malware can run the following destructive payloads:

• Overwrite the Master Boot Record.
• Disable Task Manager, Registry Editor, Command Prompt, and other important Windows utilities.
• Corrupt the BCD.
• Unmount all drives.

Final destruction

Once the malware runs its last payload, the system will crash with a Blue Screen of Death. The system will then reboot to an overwritten MBR, showing either an image or some text, depending on the malware.

Examples of GDI malwares

Pankoza

• Trihydridoarsenic.exe
• Gadolinium.exe
• xpmalwrdest.exe
• destr3ktdows.exe
• Heptoxide.exe
• Triphenylarsine.exe
• Technetium.exe
• xgqgxtxxgs.exe
• rwqvhhbsld.exe
• trichloromethane.exe
• Holmium.exe
• salinewin.exe
• ksdcbrctys.exe
• MS 0735.6+7421.exe
• DETTAMROFNIW.exe
• wgwcpdpgbf.exe
• dhzfxwwdll.exe
• oxhzulzwrt.exe
• jwzyexgnlc.exe
• 2,3,7,8-Tetrachlorodibenzodioxin.exe
• btfoiuthns.exe
• Olthaltlzpz.exe
• Cytochalasin.exe
• Getaparane.exe
• Hexachlorocyclohexane.exe
• xjmjivqdmpn.exe
• dlwxzypwwzdtd.exe
• kclglegrgq.exe
• Phenylsilatrane.exe
• webm.exe
• Oxymorphazone.exe
• cdm.exe
• APM 08279+5255.exe
• xcf.exe

References

This article "GDI malware" is from Wikipedia. The list of its authors can be seen in its historical and/or the page Edithistory:GDI malware. Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.

---