DDU v18[.]1[.]5[.]6[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
DDU v18.1.5.6.exe
Size 1.2MB
Sample260808-xcdrtack4w
SHA256 5efd307306ca60b38caa114c8fffee94127da98ac8928d4c79ab54e919c15055
MD5 47e70952e817847c94b5799438a6aca9
SHA1 39b8bff39999f5ad79e8248263e7e74ea91048ba
SHA512 d56f6d3cc5069d93451a39efbed913619b12854d780e8d28ba752e07bd29e4c095aea9bc2993adf0980f5871ef609141a7baddc0ed3d87061836e3083b7491b9
SSDEEP 24576:fLk/SLXhjwookT2JIiH8mpA7PG+XIo/NLpLDhZ5uUl1ppeG2ARB0vHA:g/6lhUJICA7u+XIoXtua1p12uBx
TLSH
T1145512313BD0C9B7D25221318DDD67FAA2F9D3090F21848723D48F5D5E79AE1E23962A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

DDU v18.1.5.6.exe

.exe 1.2MB

DDU v18.1.5.6.exe

IMPHASH eb0cbb54ca401e820f6974e6548a4451
SHA256 5efd307306ca60b38caa114c8fffee94127da98ac8928d4c79ab54e919c15055
MD5 47e70952e817847c94b5799438a6aca9
SHA1 39b8bff39999f5ad79e8248263e7e74ea91048ba
SHA512 d56f6d3cc5069d93451a39efbed913619b12854d780e8d28ba752e07bd29e4c095aea9bc2993adf0980f5871ef609141a7baddc0ed3d87061836e3083b7491b9
SSDEEP 24576:fLk/SLXhjwookT2JIiH8mpA7PG+XIo/NLpLDhZ5uUl1ppeG2ARB0vHA:g/6lhUJICA7u+XIoXtua1p12uBx
TLSH
T1145512313BD0C9B7D25221318DDD67FAA2F9D3090F21848723D48F5D5E79AE1E23962A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

79:b3:be:0e:c6:04:fe:2b:9f:c1:48:a3:71:b9:ed:e1:23:db:85:36:91:c8:64:1c:50:1f:fe:09:a6:95:84:18

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Wagnardsoft,O=Wagnardsoft,ST=Quebec,C=CA

Chains

Jul 17, 2026

CN=Wagnardsoft,O=Wagnardsoft,ST=Quebec,C=CA

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Wagnardsoft,O=Wagnardsoft,ST=Quebec,C=CA

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Wagnardsoft,O=Wagnardsoft,ST=Quebec,C=CA

Serial Number

04:2e:ff:54:cd:ea:d1:ac:36:09:e2:b5:c9:9a:fa:3f

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 15, 2026 - Aug 13, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

165500

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

oleaut32

SysAllocStringLen SysAllocString VariantClear SysFreeString SysStringLen

ole32

CoUninitialize CoTaskMemFree CoCreateInstance CoInitialize OleInitialize

user32

CheckDlgButton IsDlgButtonChecked DestroyIcon EndDialog SetDlgItemTextW GetFocus SetFocus GetKeyState InvalidateRect SetWindowTextW EnableWindow PostMessageW MessageBoxW DialogBoxParamW SetWindowLongW SetTimer GetParent ShowWindow MoveWindow ScreenToClient GetDlgItem GetWindowRect MapDialogRect MonitorFromWindow GetMonitorInfoA SystemParametersInfoW GetWindowTextLengthW GetWindowTextW SendMessageW LoadStringW SetClipboardData EmptyClipboard CloseClipboard OpenClipboard CharUpperW LoadIconW SetCursor LoadCursorW KillTimer GetWindowLongW

shell32

SHBrowseForFolderW SHGetFileInfoW SHGetPathFromIDListW

msvcrt

memset strlen _beginthreadex _except_handler3 ??1type_info@@UAE@XZ ?terminate@@YAXXZ __dllonexit _onexit _exit _XcptFilter exit _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _controlfp wcsstr free malloc memcpy memmove _purecall memcmp _CxxThrowException __CxxFrameHandler wcscmp

kernel32

GetStartupInfoA InitializeCriticalSection ReleaseSemaphore CreateSemaphoreW ResetEvent SetEvent CreateEventW WaitForSingleObject GetVersion IsProcessorFeaturePresent VirtualFree VirtualAlloc SetPriorityClass WaitForMultipleObjects DeleteCriticalSection Sleep EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime GlobalMemoryStatus GetSystemInfo GetCurrentProcess GetProcessAffinityMask GetModuleHandleW FileTimeToLocalFileTime FileTimeToSystemTime CompareFileTime GlobalFree GlobalAlloc SetEndOfFile WriteFile ReadFile SetFilePointer GetFileSize GetLogicalDriveStringsW GetFileAttributesW GetModuleHandleA GetProcAddress FindNextFileW FindFirstFileW FindClose GetStdHandle GetFileInformationByHandle GetTickCount GetCurrentDirectoryW SetLastError DeleteFileW CreateDirectoryW MoveFileW RemoveDirectoryW SetFileAttributesW CreateFileW SetFileTime CloseHandle GetSystemDirectoryW FormatMessageW GetModuleFileNameW LoadLibraryExW GlobalLock GlobalUnlock MultiByteToWideChar GetLastError GetCommandLineW GetVersionExW LocalFree

Sharing

General

Malware Config

Signatures

File Explorer

DDU v18.1.5.6.exe

oleaut32

ole32

user32

shell32

msvcrt

kernel32

generic