ad0bf9bcb3f5e8bdf0e496ba2ad861a2
- SHA256 6ba57ff7553b6f4eba02a3eb326bdfb1a3e938349d7ffa8ea9b2795ec5bd2062
Overview
overview
7Static
static
7DDPPro3.0/DDPPro.exe
windows7-x64
7DDPPro3.0/DDPPro.exe
windows10-2004-x64
3DDPPro3.0/msctrl.dll
windows7-x64
7DDPPro3.0/msctrl.dll
windows10-2004-x64
7DDPPro3.0/msht.dll
windows7-x64
1DDPPro3.0/msht.dll
windows10-2004-x64
1游戏下载.url
windows7-x64
1游戏下载.url
windows10-2004-x64
1Behavioral task
behavioral1
Sample
DDPPro3.0/DDPPro.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
DDPPro3.0/DDPPro.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
DDPPro3.0/msctrl.dll
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
DDPPro3.0/msctrl.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
DDPPro3.0/msht.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
DDPPro3.0/msht.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
游戏下载.url
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
游戏下载.url
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target ad0bf9bcb3f5e8bdf0e496ba2ad861a2
- Size 773KB
- Sample240228-2nb5ksff4y
- SHA256 6ba57ff7553b6f4eba02a3eb326bdfb1a3e938349d7ffa8ea9b2795ec5bd2062
- MD5 ad0bf9bcb3f5e8bdf0e496ba2ad861a2
- SHA1 bfd7cc4038535db8c49a3671b46a8c8a933549cc
- SHA512 826071ce47114f2ca2758a9d613ce56d98b44bd24c391637dbf2fa8ac262a21898efd66c98045512ffe825f4fec7ac8187cce751431345e0f1c77b06e468fccf
- SSDEEP 12288:7QnCOUkdEPyN+qw1T85iHZ4qB5cTZK/nHwngeclyQN3LW2SNBD3xyFio:CCB2EPyMqmg64Y5WZKPwVclNN+AZ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack001/DDPPro3.0/msctrl.dll acprotect -
resource yara_rule static1/unpack001/DDPPro3.0/msht.dll aspack_v212_v242 -
resource yara_rule static1/unpack001/DDPPro3.0/msctrl.dll upx - Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/DDPPro3.0/DDPPro.exe unpack001/DDPPro3.0/msctrl.dll unpack002/out.upx unpack001/DDPPro3.0/msht.dll
File Explorer
-
ad0bf9bcb3f5e8bdf0e496ba2ad861a2.rar 773KB
-
DDPPro3.0/DDPPro.exe.exe 605KB
-
DDPPro3.0/msctrl.dll.dll 288KB
-
out.upx.dll 711KB
-
DDPPro3.0/msht.dll.dll 38KB
-
DDPPro3.0/说明.txt822B
-
游戏下载.url77B
-
说明.txt1KB
DDPPro3.0/DDPPro.exe
- IMPHASH 52bcca0293a2e7268dc0bc2b29d8148f
- SHA256 49eac4139ccfee6d68dbf5abb8b496825d73f8c532389d9311db3baad7d3cf75
- MD5 c04c7029c3086adf10a0f192bdd893ac
- SHA1 94f176ff81241d1844d582426c87c873e666bd2a
- SHA512 93a8fa473d58451412e40b3a24349486d81cb86af14916dea6b96b2bd83f3ca4e155ebff3d1ea5153ac6bd0831eee1de5db64a46a730b77ad08c84fdccea8762
- SSDEEP 12288:2SiVFjkiZqPJ1CfitiZs+1KKUcGFzcYFlMvYDIglC:2dFglSitiZKzyv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
225280
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ExitProcess
user32
MessageBoxA
comctl32
InitCommonControls
Name
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
172KB
Virtual Size
204KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
24B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
44KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
DDPPro3.0/msctrl.dll
- SHA256 6c1410977fda6876e2a4f6e91af49c6f92fb69378aea36f351c9bfca105249b4
- MD5 486eef5b4a427b58bf778a0d17081087
- SHA1 28a300e04418c29ad68704bd24be0fa477ff1ba7
- SHA512 af099d30b92f6539e25ea178abae4788b48b7c66c43ad555def8544addfd2c45443de41fec142a981e4187e81f3c3e1832422f29d3e0d142622c61eba025f485
- SSDEEP 6144:NwM4aVxOAsa+zH5p/ItRDIYXhTsewBL6UwvHNvC9DyiNfg/om:N3vxIloVQlBOUwvtvkOiNfB
- MD5 SHA1 SHA512 SSDEEP
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
790112
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
AntiMonitors
Antidebugging
GetHardwardID
SSUser
SS_DefaultKey
SS_GetUserKey
SS_GetUserName
SS_GetUserSerialID
SS_IServer
SS_Initialize
SS_IsUnlocked
SS_LicenseInfo
SS_R
SS_RemoveKey
SS_TrialExpired
SS_TrialMode
SetApplicationInfo
TripleDESDecrypt
TripleDESEncrypt
Name
UPX0
Size
Virtual Size
488KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
280KB
Virtual Size
284KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 e95a6343c4a9f47bf84dd707705b2ecf6eab805159b74e338c096f6bc31ca02b
- MD5 83ba1414773e0aee1fbccf438ba1b6fc
- SHA1 b63a028c6c91c1061174863261964050bb2c1f1a
- SHA512 6551ab3079c348ce1d922f7cfd820e3843e194847dc590c22a16789ec6f56842fc2e5e82353c4c62c8f9b18f12618ae018b958e834f3d49ea63c4744a4654012
- SSDEEP 12288:FENh13H1T/jmS/JmBxdYX8VSjhuai/za6xsJE/7A:2jR1sBx68Qj9im6xs8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
607888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
590KB
Virtual Size
589KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
5KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
511B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
DDPPro3.0/msht.dll
- SHA256 267e9830e99fa708a26c756c54121a4bc7568dc04fe7d4a40e43993c6dcd8bc2
- MD5 19600f4cbb9021f612ca6e7e5baf76b9
- SHA1 e67dc6a410d208e3db875c979ca8ec1ccfd10fad
- SHA512 ad7cd79f6e21deab650d0a39308125e782380c676d51912c473dbec9376e4cff1a379deb65e97efc4bbd0d5d1f19e8bbff813271e33936e777279e163e59327d
- SSDEEP 768:86WSXHdUp/L1LvoYAhbVWFapkh2XkgklY/xnha5:bWeCpJLvEdNpk0ilYD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
57345
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
SetSpeed
Name
.text
Size
16KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
1KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.shared
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.aspack
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=21, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=83, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=93, version=2067,
count=5, id=93, version=2179,
count=85, id=1, productName=Unmarked objects,
count=4, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=92, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
DDPPro3.0/说明.txt
- SHA256 c20757e269018345873a0384ba5eda3a7a0d77f89815f4c920ef7a3dc5b18d0c
- MD5 b13538ad5b9aa8d6a7ffe70107fa2a12
- SHA1 d77d41a71db81c4ee805315041177d9606df3c23
- SHA512 228fdafbc8051813388d476ed28a89c059df34bcd2684f3b84f0d0a2e6b1eae0b6d4f73f5690b174486a2f5f01d974f79c700bc34e3ba2c8e3bbcb51787e5e42
- MD5 SHA1 SHA512
游戏下载.url
- SHA256 b3f09f5f807166c80e691ddaf7cf3a55ccd765c071b71e7f7ba169c23a2ae1c7
- MD5 b18d17e3138a14f3bc3aed0431afb137
- SHA1 36c485020304bc5c5a854b275a6ad79fa107ab73
- SHA512 dd44d14f005b711a259c74ec0efeb12ef102911066029ee8e517260b7bad52a6de61076655d796af1b011135c3f54b8f345a56fc432b406e720edcd164f59581
- MD5 SHA1 SHA512
说明.txt
- SHA256 01061183065d63ba07538fbd5077296805c075c5f56b1946c8fa990fbb58a1bd
- MD5 a4b777040cfe3889b1691bf590481365
- SHA1 78ac35740e82c03e18c7c36902cf80cbbdaeaf9a
- SHA512 f301d1b32a3400b9b2a5c0d4a67136f95764d96c7638a102879a4b66ef2dcdab412cad1519fec006a8730a4a9bf1cbe2d5a18bae41b186c6f9cc830a2565b771
- MD5 SHA1 SHA512