傀儡机驱动级复活DDoS攻击穿透破防版[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

傀儡机驱动级复活DDoS攻击穿透破防版.zip
Size

601KB
MD5

84de40af0145e020f504b60e123a821f
SHA1

2a3941680d6a923b04ce82a7d0508b3bf5f114ae
SHA256

238dbfa8caffc12795ad8e1b10cd998f77034801a9a327197957300418637965
SHA512

6d41d414f1bd6cc505a78a40d0a306cf3f7d4d5613da6a2e5b68f6a28a9d1edd5cb0fdeba58dfc2e6f3f734c15fa6db74b166a78e9342278f9d5296600a29d5f
SSDEEP

12288:FAF+9kaBwpnpf+KJcG7v8PzOrkchrrn6XfXWjSafpVsDQyUPf0L:yF+tAVRJcG7SzOrkcNrn1jSafpV+UPf0

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/傀儡机驱动级复活DDoS攻击穿透破防版/SkinH.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/傀儡机驱动级复活DDoS攻击穿透破防版/SkinH.dll	upx

Files

傀儡机驱动级复活DDoS攻击穿透破防版.zip
.zip
傀儡机驱动级复活DDoS攻击穿透破防版/Cache/klj.dat
.exe windows x86

6afc9bba35195e07cb6d944f6eae2ba4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetThreadPriority
GetCurrentThread
GetCurrentProcess
SetPriorityClass
GetEnvironmentVariableA
GetShortPathNameA
ExitProcess
GetTickCount
CloseHandle
ReleaseMutex
OpenMutexA
lstrlenA
lstrcpynA
SetFilePointer
WriteFile
CreateFileA
LockResource
LoadResource
FindResourceA
CreateThread
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
GlobalFree
ReadFile
GlobalAlloc
GetFileSize
GetFileAttributesA
WaitForSingleObject
GetModuleHandleA
GetLastError
GetWindowsDirectoryA
GlobalMemoryStatusEx
GetSystemInfo
lstrcpyA
GetSystemDefaultUILanguage
TerminateProcess
ExitThread
GetStartupInfoA
lstrcmpA
Sleep
GetLocalTime
WinExec
GetModuleFileNameA
LoadLibraryA
EnumResourceNamesA
GetProcAddress
CreateProcessA

user32

GetDesktopWindow
wsprintfA

advapi32

StartServiceCtrlDispatcherA
RegOpenKeyExA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
DeleteService
RegQueryValueExA

shell32

SHChangeNotify
ShellExecuteExA
ShellExecuteA

ws2_32

send
select
__WSAFDIsSet
recv
WSAIoctl
socket
connect
gethostname
gethostbyname
WSACleanup
WSAStartup
closesocket
inet_ntoa
setsockopt
htonl
inet_addr
sendto
htons

shlwapi

SHDeleteKeyA

iphlpapi

GetIfTable
GetAdaptersInfo

msvcrt

strstr
strncmp
strcat
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
free
strcmp
??2@YAPAXI@Z
??3@YAXPAX@Z
realloc
malloc
strlen
sprintf
memset
memcpy
atoi
strncpy
strcspn
exit
strcpy
localtime
time
_except_handler3

Sections

.data
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
傀儡机驱动级复活DDoS攻击穿透破防版/SkinH.dll
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

SkinH_AdjustAero
SkinH_AdjustHSV
SkinH_Attach
SkinH_AttachEx
SkinH_AttachExt
SkinH_AttachRes
SkinH_AttachResEx
SkinH_Detach
SkinH_DetachEx
SkinH_GetColor
SkinH_LockUpdate
SkinH_Map
SkinH_NineBlt
SkinH_SetAero
SkinH_SetBackColor
SkinH_SetFont
SkinH_SetFontEx
SkinH_SetForeColor
SkinH_SetMenuAlpha
SkinH_SetTitleMenuBar
SkinH_SetWindowAlpha
SkinH_SetWindowMovable
SkinH_VerifySign

Sections

UPX0
Size: - Virtual size: 140KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 86KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
傀儡机驱动级复活DDoS攻击穿透破防版/傀儡机驱动级复活DDoS攻击穿透破防版.exe
.exe windows x86

f75b6f1a7ba3cefab3188c040a002ad7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrToIntExA

kernel32

RtlUnwind
HeapFree
ExitProcess
TerminateProcess
RaiseException
GetStartupInfoA
GetCommandLineA
HeapSize
GetACP
GetTimeZoneInformation
VirtualFree
VirtualAlloc
IsBadWritePtr
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapAlloc
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
HeapReAlloc
FileTimeToLocalFileTime
SetErrorMode
GetFileTime
GetOEMCP
GetCPInfo
GetProcessVersion
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
GlobalFlags
GetCurrentThread
lstrcmpA
MulDiv
SetLastError
LocalFree
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
GetCurrentProcess
DuplicateHandle
MultiByteToWideChar
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
FreeLibrary
GetVersion
GetCurrentThreadId
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GlobalLock
GlobalUnlock
FreeResource
FileTimeToSystemTime
lstrcpynA
CompareFileTime
lstrcpyA
lstrlenA
GetLocalTime
GetSystemInfo
PostQueuedCompletionStatus
TerminateThread
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSection
GetLastError
CreateIoCompletionPort
GetQueuedCompletionStatus
EnterCriticalSection
LeaveCriticalSection
GlobalFree
WritePrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStringA
LoadLibraryA
Sleep
GetModuleHandleA
OpenFile
GetFileSize
ReadFile
VirtualProtect
SystemTimeToFileTime
CreateThread
GetTickCount
GetProcAddress
FindResourceA
SizeofResource
LoadResource
GlobalAlloc
LockResource
GetCurrentDirectoryA
DeleteFileA
CreateFileA
WriteFile
CloseHandle
GetModuleFileNameA
lstrcatA
GetFileAttributesA
FreeEnvironmentStringsA

user32

SetRect
GetDCEx
LockWindowUpdate
SetParent
DestroyMenu
GetSysColorBrush
GetDesktopWindow
GetClassNameA
SetRectEmpty
PostQuitMessage
GrayStringA
DrawTextA
TabbedTextOutA
EndPaint
BeginPaint
GetWindowDC
GetMessageA
TranslateMessage
ValidateRect
CharUpperA
wvsprintfA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
ShowWindow
SetWindowTextA
IsDialogMessageA
UpdateWindow
SendDlgItemMessageA
MapWindowPoints
PeekMessageA
DispatchMessageA
GetFocus
AdjustWindowRectEx
EqualRect
DeferWindowPos
IsWindowVisible
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetWindowTextLengthA
GetWindowTextA
GetKeyState
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
SetDlgItemTextA
GetWindow
SetWindowPos
RegisterWindowMessageA
IntersectRect
GetWindowPlacement
GetNextDlgTabItem
EndDialog
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
IsIconic
PostMessageA
DrawIcon
LoadIconA
RedrawWindow
ReleaseDC
GetDC
InflateRect
GetIconInfo
SetWindowRgn
DrawIconEx
wsprintfA
ChildWindowFromPointEx
KillTimer
SetTimer
ScreenToClient
ClientToScreen
FillRect
OffsetRect
CopyRect
WindowFromPoint
GetSystemMetrics
GetWindowRect
SystemParametersInfoA
GetDlgCtrlID
LoadStringA
IsChild
SetFocus
GetCursorPos
GetSysColor
IsWindow
LoadCursorA
GetParent
SetCapture
InvalidateRect
GetClientRect
PtInRect
SetCursor
SetWindowLongA
ReleaseCapture
SendMessageA
EnableWindow
MessageBoxA
RegisterClassA
UnregisterClassA

gdi32

GetDeviceCaps
CreatePatternBrush
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SetRectRgn
StretchDIBits
CreateCompatibleDC
CreateCompatibleBitmap
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetBkMode
IntersectClipRect
ExcludeClipRect
SelectClipRgn
ScaleWindowExtEx
GetObjectA
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
CreateRectRgnIndirect
PatBlt
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
FrameRgn
FillRgn
CreateRoundRectRgn
CreatePolygonRgn
CreateRectRgn
CombineRgn
DeleteObject
GetTextMetricsA
GetTextExtentPoint32A
Rectangle
Polygon
CreateSolidBrush
CreateFontIndirectA
SetWindowExtEx

comdlg32

GetSaveFileNameA
GetFileTitleA
GetOpenFileNameA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA

shell32

ShellExecuteA

comctl32

ImageList_ReplaceIcon
ord17
ImageList_Destroy
ImageList_Create

ws2_32

WSASend
WSAAccept
setsockopt
WSAIoctl
getpeername
htonl
shutdown
recv
send
WSAGetLastError
inet_addr
WSASocketA
gethostname
WSARecv
WSACleanup
closesocket
select
connect
htons
gethostbyname
ioctlsocket
socket
WSAStartup
inet_ntoa
accept
listen
bind

skinh

SkinH_AdjustHSV
SkinH_AttachRes
SkinH_SetAero

Sections

.text
Size: 196KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 520KB - Virtual size: 517KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
傀儡机驱动级复活DDoS攻击穿透破防版/傀儡机驱动级复活DDoS攻击穿透破防版.ini

Sharing

General

Malware Config

Signatures

Files

6afc9bba35195e07cb6d944f6eae2ba4

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ws2_32

shlwapi

iphlpapi

msvcrt

Sections

.data Size: 33KB - Virtual size: 33KB

.rsrc Size: 13KB - Virtual size: 12KB

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 140KB

UPX1 Size: 86KB - Virtual size: 88KB

.rsrc Size: 2KB - Virtual size: 4KB

f75b6f1a7ba3cefab3188c040a002ad7

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ws2_32

skinh

Sections

.text Size: 196KB - Virtual size: 192KB

.rdata Size: 44KB - Virtual size: 41KB

.data Size: 24KB - Virtual size: 34KB

.rsrc Size: 520KB - Virtual size: 517KB

.data
Size: 33KB - Virtual size: 33KB

.rsrc
Size: 13KB - Virtual size: 12KB

UPX0
Size: - Virtual size: 140KB

UPX1
Size: 86KB - Virtual size: 88KB

.rsrc
Size: 2KB - Virtual size: 4KB

.text
Size: 196KB - Virtual size: 192KB

.rdata
Size: 44KB - Virtual size: 41KB

.data
Size: 24KB - Virtual size: 34KB

.rsrc
Size: 520KB - Virtual size: 517KB