cloudiddos[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cloudiddos.exe
Size 53KB
Sample260805-ffbm7adf82
SHA256 7742348c93c5f488c2345f82b3921271025bb216b581d30992c045d7134379ac
MD5 58aafce32460992ec252d1cba36d4514
SHA1 d1f1cba7ec245b29f3713a94fbc7026f386c6a2f
SHA512 3773e887d076bb5d310a6de90cc70290de3c572538e864b36440a1178dcb0cb462bb9e3b79a59d68666afbca853af616fcc16b3111fd7c5666a1dcc9bdd216b1
SSDEEP 768:RrzCIrV6oRW7+hqLWe9/eMhqzXOPcGIA08wfJGyedBdnRUg9I2hx83UQn:TIdWkVubbadBdnRUg9PbrQ
TLSH
T18A335CAB6B5540ECE176C07DD9635253E2B178072322ABCF33EC92261F275D06D7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cloudiddos.exe

File Explorer

cloudiddos.exe

.exe 53KB

cloudiddos.exe

IMPHASH b5c0171b80f5dad614592cc62e628ccd
SHA256 7742348c93c5f488c2345f82b3921271025bb216b581d30992c045d7134379ac
MD5 58aafce32460992ec252d1cba36d4514
SHA1 d1f1cba7ec245b29f3713a94fbc7026f386c6a2f
SHA512 3773e887d076bb5d310a6de90cc70290de3c572538e864b36440a1178dcb0cb462bb9e3b79a59d68666afbca853af616fcc16b3111fd7c5666a1dcc9bdd216b1
SSDEEP 768:RrzCIrV6oRW7+hqLWe9/eMhqzXOPcGIA08wfJGyedBdnRUg9I2hx83UQn:TIdWkVubbadBdnRUg9PbrQ
TLSH
T18A335CAB6B5540ECE176C07DD9635253E2B178072322ABCF33EC92261F275D06D7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\lando\Downloads\Claude Files\ddos\x64\Release\ddos.pdb

ws2_32

htons freeaddrinfo sendto WSACleanup closesocket inet_pton getaddrinfo WSAStartup send socket connect WSASocketA setsockopt inet_ntop

kernel32

GetModuleHandleW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SetConsoleTextAttribute SetConsoleTitleA GetStdHandle GetCurrentThreadId Sleep SetConsoleCursorInfo GetConsoleWindow SetConsoleCursorPosition RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry

user32

SetWindowPos

msvcp140

?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_join ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency _Thrd_hardware_concurrency ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset __current_exception memmove __std_exception_copy __std_exception_destroy __C_specific_handler __current_exception_context _CxxThrowException memcmp memcpy __std_terminate

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func fflush __stdio_common_vsprintf _set_fmode __stdio_common_vfprintf __p__commode putchar

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _crt_atexit _get_initial_narrow_environment _c_exit _initialize_narrow_environment _configure_narrow_argv _register_thread_local_exe_atexit_callback _set_app_type _cexit _initterm _seh_filter_exe __p___argv __p___argc _beginthreadex _initterm_e _invoke_watson _exit system terminate exit

api-ms-win-crt-string-l1-1-0

tolower

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale