General

  • Target

    Duqu.zip

  • Size

    690KB

  • MD5

    33d59864adac062d7cad138434e7e251

  • SHA1

    09ffc8b7da4039dacac2dd6cf0835effef602ca3

  • SHA256

    99dda908d9a3c3e697a9b2a42b765ca60ae5b404ffb651312ac8e2ddab9ef9fc

  • SHA512

    0202f0f864fd9ca7688cbe45ee9b18e440dac02095a435d3efc29e0f1664100f1a52abca6c9bfe59962a64dd604e1ba1a5b8759b10db345f550bdc4d240aea88

  • SSDEEP

    12288:Rg2vKeIR40hFrrHmG1FrYFfkVQg6EjyMPjiNqU8HWabth3JOW6BqZd19EjX:R7vKeo4yN+cVQ/Ejyu3Wabr5EBm0X

Score
3/10

Malware Config

Signatures

  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

Files

  • Duqu.zip
    .zip

    Password: poop

  • DRVS/DUQU_1
  • DRVS/SYS_info.txt
  • detection/duqudetector-v1_01.zip
    .zip

    Password: poop

  • CalcPNFEntropy.exe
    .exe windows:5 windows x86 arch:x86

    Password: poop

    24246b39ec74d0e4a1d6c8254ee6b05f


    Headers

    Imports

    Sections

  • FindDuquRunme.bat
    .bat .vbs
  • FindDuquSys.exe
    .exe windows:5 windows x86 arch:x86

    Password: poop

    c2aa86657066429187a51e9671741422


    Headers

    Imports

    Sections

  • FindDuquTmp.exe
    .exe windows:5 windows x86 arch:x86

    Password: poop

    05602f4cc94286ffde14583eb3825533


    Headers

    Imports

    Sections

  • FindPNFnoINF.exe
    .exe windows:5 windows x86 arch:x86

    Password: poop

    8f0218d8d83f33f4a03747be7c80fbed


    Headers

    Imports

    Sections

  • manual-v1_01.txt
  • msvcr100.dll
    .dll windows:5 windows x86 arch:x86

    Password: poop

    5271d5ce8b44dd47bc92563e27585466


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • sources/calcpnfentropy.cpp
  • sources/common.cpp
  • sources/common.h
  • sources/findduqusys.cpp
  • sources/findduqutmp.cpp
  • sources/findpnfnoinf.cpp
  • reg/dequ jmiNET3.reg