Static task
static1
Behavioral task
behavioral1
Sample
ddodiag.exe
Resource
win10v2004-20231020-en
General
-
Target
ddodiag.exe
-
Size
68KB
-
MD5
0581dbc3715ec547372261e95caae080
-
SHA1
f6838fec32d75aa564bd56561c8b24683c9658be
-
SHA256
48bb5bdf5436a2545528d9f6a50c154865b556cbbccdbc5969cf62ec2a7e362b
-
SHA512
a933092c9903b4342f20e2f61c5b5cd34b2ae58e212bf1fa929a4fe20cb6e2b4e45fa0954ca92529f07dc6863c01975998f9d3e778f18422fa2ccab0c900c516
-
SSDEEP
1536:vs2brg7S1DqJBGK/hc3aZkLmMgMaouZl6iTOJtt1UI:vrXUasm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ddodiag.exe
Files
-
ddodiag.exe.exe windows:10 windows x64 arch:x64
835450f6c906da1e68b05e2c968111e4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
msvcrt
?terminate@@YAXXZ
_commode
_wcsicmp
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_vsnwprintf
_exit
memset
kernel32
SetFilePointerEx
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
Sleep
FileTimeToSystemTime
GetTempPath2W
CloseHandle
GetLastError
DuplicateHandle
CreateFileW
WriteFile
GetCurrentProcess
GetFileSizeEx
ReadFile
ole32
PropVariantClear
CoInitializeEx
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
StringFromCLSID
xmllite
CreateXmlWriter
Sections
.text Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 444B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 608B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ