Occ'xDDoS.rar
- SHA256 20139724a2be4ee978d05c14037fbde89d37bb90c485f13ac5713f240d176494
Password
x13
General
- Target Occ'xDDoS.rar
- Size 42.7MB
- Sample260704-cdhryaas5x
- SHA256 20139724a2be4ee978d05c14037fbde89d37bb90c485f13ac5713f240d176494
- MD5 1f58ba53735d6d1c79e70995536b7b3c
- SHA1 4b33e91c312584c6854d8d376fa039a322078eec
- SHA512 8fe8e8c9b5eaa8704d6b0cda90e27756223d2d7c450d4b82987dd1f0d0a08b02434161299a543acd18ec615ce1172bf5441a257bd4cc39992ec26254ac685879
- SSDEEP 786432:yoN/kVog8WLh4C+xOMYRaQm3lmhVIp4JZTvDMBasMRyNRCftRar2aMFVgDza:yqSJV4C9MHQym3IqJZbDIas+ye3a6NeS
- TLSH T1EDA7333A4CB6B31164DEC64386CFA9CA45DCBD74D4EE4888E5E2D1D3F8635D9808BB81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Occ'xDDoS/Occ'xDDoS.bat pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Occ'xDDoS/Occ'xDDoS.bat
File Explorer
-
Occ'xDDoS.rar.rar 42.7MB
-
Occ'xDDoS/Occ'xDDoS.bat.exe 43.2MB
-
21.pyc18KB
-
Occ'xDDoS/requirements.txt29B
-
Occ'xDDoS/runner.bat206B
Occ'xDDoS/Occ'xDDoS.bat
- IMPHASH 064967a99ade726316dc79a4a929fe96
- SHA256 2e28f928298dd00b3ef9e9a73f9319a7acc4ea964017e6755fd1edc8e904dd60
- MD5 d3cc6cc99822a79657439b0cd583c734
- SHA1 4d508f28140e546f19184accf19cc2049d3a36d2
- SHA512 aaa5824bfc4962d944c200ae60af08fb45d4224e13fb87bd4374f4525509bc0e31d2588d63744dcff7b277674f7938488287b39f4022d6572be4b5d8665e3051
- SSDEEP 786432:b+gX4BMdhwzTQXR5FbPp6FcSS5U/LT2KzVyPVLBdRH/v8Eb4PCz8SewOSS:FXGMK4XR3bLSCU/+6yPl3RH/EEb4PCIv
- TLSH T175A73310E5D406CCFAF50A7CA192CB06E318F8AF53A2C6E641F4019359B7FD06A57EB9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Password
x13
Minor OS version
0
Major OS version
6
Entry point
50768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
TranslateMessage
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
GetMessageW
kernel32
GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
HeapSize
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
GetFileAttributesExW
HeapReAlloc
WriteConsoleW
SetEndOfFile
FindNextFileW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
CompareStringW
LCMapStringW
FlushFileBuffers
SetEnvironmentVariableW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
175KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=182, id=261, version=33140,
count=12, id=260, version=33140,
count=8, id=259, version=33140,
count=2, id=253, version=34321,
count=9, id=259, version=34321,
count=17, id=260, version=34321,
count=40, id=261, version=34321,
count=7, id=257, version=33140,
count=140, id=1, productName=Unmarked objects,
count=25, id=260, version=34808,
count=1, id=258, version=34808,
21.pyc
- SHA256 6c4393207f45208667ff2e95ccd6f244f258e2f73dcd1065f989de921ccd515d
- MD5 d23b5ad1a176cc6a5bae2ba2d80bcdcb
- SHA1 7d18392dcea5ff467c1bda1245b76f7555c5c07e
- SHA512 6294e019e685d87701c861eea6765621f433b2a3a95f1944b5927828ee62c22047d3b2ef4603efcb9e1d77a294ef6705d3ca33aacf7adb8454b76142274c857f
- SSDEEP 192:bAiiOXwvUUlScBAJtRdUGLDPtIe+dH7A8FxEOAPuGJBcswPQXKK:bBwNScBADRGGXy1MOAPuS+swPQaK
- TLSH T19C824AE7C5018415FFB4E0F750D05280A75EAD23B520E393B60E42B4ADDF76AE9B1388
- MD5 SHA1 SHA512 SSDEEP TLSH
Occ'xDDoS/requirements.txt
- SHA256 204d0b3e9ac7f72e7b0c8206e23aec15c7552f81f4ff92b0a7ad6ad5238f3ab1
- MD5 e45556f3ee2d516d1868dd844c8a0880
- SHA1 3b0bbb13624ad1430981ad3be611c5d568dedcd9
- SHA512 2c64973644655eb53208db5afb775802e2feffd39c03180c55052b3f6f76b88fd9502127ea12218be32d7f6df339beea976520a3fb54f54c36a74f4597ed59c6
- MD5 SHA1 SHA512
Occ'xDDoS/runner.bat
- SHA256 6055741ed5aef6139333b6506176adc80344740abf4c7a685ae7410311abd566
- MD5 d55939e78c15cf7e28e5aee671e3033c
- SHA1 65bae0e083ea80c53f7d724eb0ea0c12e9766776
- SHA512 db6f659abe438aac822b879608b4364a9a489be9f267a8bb56ce446991bc1b720bc79de5034ec0af181b851f5f8642b1864833d6619649d5ba65bf5b85d892ca
- TLSH T186D022093391D3FA78053DCA88BB8803344AF61763812902F17B01BC6CD0482A239D2A
- MD5 SHA1 SHA512 TLSH