dadada[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
dadada.exe
Size 464KB
Sample260708-294fysbt21
SHA256 f708a334d51a3cd87600e339176c4780fa79352eec3b40e7699cc4efaec4c3fe
MD5 81319572e04fec05e30d96daa93773d1
SHA1 8e64dba0082dfc4b87a4faf883577f8c7a19198a
SHA512 af3eb9f6cec54105768258ccd526fc7be15ea63ff0d26044da7307fd1b0f7acb25b51875ab461d45706e4356a7f5b0d1fa077b740402cc8957cf9b52406a4f94
SSDEEP 12288:CKbkoa4oJEsIeOFCG3S15pfdia33WQn40Drx:CAkoBvxsWS3xdijQn4+
TLSH
T1DCA4A046F1A891FCD02BA138D656690BEE353858072049DB73D498B82BF37F467BE712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dadada.exe

File Explorer

dadada.exe

.exe 464KB

dadada.exe

IMPHASH 2c7e6d2c3a675049643f052337054057
SHA256 f708a334d51a3cd87600e339176c4780fa79352eec3b40e7699cc4efaec4c3fe
MD5 81319572e04fec05e30d96daa93773d1
SHA1 8e64dba0082dfc4b87a4faf883577f8c7a19198a
SHA512 af3eb9f6cec54105768258ccd526fc7be15ea63ff0d26044da7307fd1b0f7acb25b51875ab461d45706e4356a7f5b0d1fa077b740402cc8957cf9b52406a4f94
SSDEEP 12288:CKbkoa4oJEsIeOFCG3S15pfdia33WQn40Drx:CAkoBvxsWS3xdijQn4+
TLSH
T1DCA4A046F1A891FCD02BA138D656690BEE353858072049DB73D498B82BF37F467BE712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

362504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\nam\source\repos\dadada\x64\Release\dadada.pdb

kernel32

OutputDebugStringA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter Process32FirstW GetModuleHandleW GetSystemTimeAsFileTime GetCurrentProcessId SetUnhandledExceptionFilter WakeAllConditionVariable GetCurrentThreadId Sleep SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive Process32NextW CreateToolhelp32Snapshot Module32NextW ReadProcessMemory Module32FirstW InitializeSListHead CloseHandle OpenProcess GetProcessId WriteProcessMemory

user32

SetWindowLongW GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW SendInput ShowWindow GetAsyncKeyState OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW DestroyWindow DispatchMessageW PostQuitMessage UpdateWindow GetCursorPos TranslateMessage SetLayeredWindowAttributes PeekMessageW FindWindowW

shell32

ShellExecuteW

msvcp140

?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ _Cnd_do_broadcast_at_thread_exit _Thrd_join _Query_perf_counter _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xlength_error@std@@YAXPEBD@Z _Thrd_id

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove memset __C_specific_handler __current_exception __current_exception_context _CxxThrowException memcpy memchr __std_terminate __std_exception_copy __std_exception_destroy memcmp

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode _callnewh free

api-ms-win-crt-string-l1-1-0

strncpy strcmp strlen strncmp _wcsicmp

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _get_initial_narrow_environment _initterm _initterm_e exit _exit _beginthreadex __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _crt_atexit system _register_onexit_function _initialize_onexit_table terminate _initialize_narrow_environment _configure_narrow_argv _cexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fwrite fseek fclose fflush __stdio_common_vfprintf ftell __acrt_iob_func __p__commode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-math-l1-1-0

sqrtf sinf cosf acosf powf logf fmodf ceilf __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale