kdu[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

kdu.exe
Size

434KB
MD5

259ed6135b3f0dc3b7e5c6ca07cd202c
SHA1

0c88d9d63a371aec7ae6274dea07cc2dd08bd73e
SHA256

6a5331d9302684b3dc76049267efe1ad24ce5beb90c9f2eb2d84ca29ef6347ae
SHA512

e4b2444600ff003703ff3594c865e7570197e5ee0f8a833f43927d07448156c9e22a43b15c3436b4905366b08c932dd40fa838d80496b372170190aec0f0373a
SSDEEP

6144:ziZ6j8BP77OgQtsbWonKIYTETRV6d4a+aRNa92fk2W:zFKT7OgQKbWonfYoTRZa+uY0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
kdu.exe

Files

kdu.exe
.exe windows:6 windows x64 arch:x64

78be62399d2f7f7fa34f1c828f3f93de

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Pxrrot\Desktop\C++ Projects\KDU-1.2.8\Source\Hamakaze\output\x64\Release\kdu.pdb

Imports

kernel32

CloseHandle
RtlCompareMemory
GetSystemDirectoryW
GetProcAddress
FreeLibrary
LoadLibraryExW
VirtualFree
VirtualUnlock
VirtualLock
HeapCreate
HeapAlloc
HeapDestroy
GetStartupInfoW
WriteProcessMemory
ResumeThread
UnmapViewOfFile
DeleteFileW
CreateProcessW
GetModuleHandleW
TerminateProcess
Sleep
GetLastError
TerminateThread
CreateThread
HeapSetInformation
SetDllDirectoryW
CreateEventW
GetProcessHeap
GetCommandLineW
GetModuleFileNameW
CreateFileW
GetSystemInfo
ReadProcessMemory
GetSystemTimeAsFileTime
CreateFileMappingW
MapViewOfFile
GetFirmwareEnvironmentVariableW
GetConsoleMode
WriteConsoleW
WaitForSingleObject
GetStdHandle
SetConsoleTextAttribute
SetLastError
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
VirtualAlloc
HeapSize
HeapReAlloc
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
ReadFile
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapFree
GetCommandLineA
WriteFile
GetModuleHandleExW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetCPInfo
GetStringTypeW
LCMapStringEx
MultiByteToWideChar
DecodePointer
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
WideCharToMultiByte
InitializeSListHead
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

advapi32

RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

ntdll

NtOpenFile
LdrUnlockLoaderLock
NtSetInformationProcess
LdrLockLoaderLock
RtlTimeToSecondsSince1970
NtLoadDriver
NtWaitForSingleObject
NtSetValueKey
NtOpenSection
NtQueryObject
LdrFindEntryForAddress
NtFsControlFile
RtlLengthRequiredSid
NtUnloadDriver
RtlEqualUnicodeString
LdrGetProcedureAddress
RtlFreeAnsiString
NtSetSecurityObject
RtlDoesFileExists_U
NtCreateMutant
LdrUnloadDll
NtAlpcDisconnectPort
RtlCreateSecurityDescriptor
NtAlpcCreatePort
RtlCreateAcl
NtAlpcAcceptConnectPort
RtlAddAccessAllowedAce
RtlLengthSid
NtReplyWaitReceivePort
RtlSetDaclSecurityDescriptor
RtlSubAuthoritySid
RtlInitializeSid
NtDeviceIoControlFile
NtTerminateProcess
NtDuplicateObject
NtOpenKey
NtMapViewOfSection
NtUnmapViewOfSection
LdrLoadDll
NtCreateSection
LdrAccessResource
RtlSetLastWin32Error
NtCreateFile
RtlNtStatusToDosError
RtlEqualSid
RtlInitString
RtlFreeHeap
NtQueryDirectoryObject
RtlFreeSid
RtlExpandEnvironmentStrings
NtOpenDirectoryObject
NtFlushBuffersFile
RtlUnicodeStringToAnsiString
NtClose
RtlImageNtHeader
NtQueryInformationToken
RtlAllocateAndInitializeSid
LdrFindResource_U
RtlDosPathNameToNtPathName_U
RtlInitUnicodeString
NtOpenProcess
RtlFreeUnicodeString
NtQueryInformationProcess
NtWriteFile
NtQuerySystemInformation
RtlAllocateHeap
NtOpenThread
NtFreeVirtualMemory
NtOpenProcessToken
RtlAnsiStringToUnicodeString
NtAdjustPrivilegesToken
RtlGetVersion

rpcrt4

UuidCreate

setupapi

SetupDiCreateDeviceInfoW
SetupDiDestroyDeviceInfoList
SetupDiSetDeviceRegistryPropertyW
SetupDiGetINFClassW
SetupDiCreateDeviceInfoList
SetupDiCallClassInstaller
SetupDiRemoveDevice

newdev

UpdateDriverForPlugAndPlayDevicesW

bcrypt

BCryptDestroyKey
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptEncrypt
BCryptGenerateSymmetricKey

msdelta

DeltaFree
ApplyDeltaB

Sections

.text
Size: 253KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

78be62399d2f7f7fa34f1c828f3f93de

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

ntdll

rpcrt4

setupapi

newdev

bcrypt

msdelta

Sections

.text Size: 253KB - Virtual size: 252KB

.rdata Size: 84KB - Virtual size: 84KB

.data Size: 10KB - Virtual size: 15KB

.pdata Size: 13KB - Virtual size: 12KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 68KB - Virtual size: 68KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 253KB - Virtual size: 252KB

.rdata
Size: 84KB - Virtual size: 84KB

.data
Size: 10KB - Virtual size: 15KB

.pdata
Size: 13KB - Virtual size: 12KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 68KB - Virtual size: 68KB

.reloc
Size: 3KB - Virtual size: 3KB