tst.rar
- SHA256 450442e24a9a1f703402570cabeb63387fe69aaeb8c5a2160f3a2c81fc1f29d2
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tst.rar
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
tst.rar
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target tst.rar
- Size 76KB
- Sample260924-sc1jcsvz7k
- SHA256 450442e24a9a1f703402570cabeb63387fe69aaeb8c5a2160f3a2c81fc1f29d2
- MD5 794d063cb541d6166aca946762271077
- SHA1 976933b0bf1e99f771c87c5e28ecb40357b829c7
- SHA512 7058423892d29fae5094e39c007a82a2637c0866fee6431639eb610ad2881f5e4f4628c616da9bcd3be0ab674e4a568c45deed3153fa9e05da4c6af9105ae5dc
- SSDEEP 1536:HljuC/ICziCI/K6eDiQ4LV3q4EK/hWcREyYwWIcpaV25TYyeOcE2Mymw:FjuCACzY1Fq4EiWcQw1DV21Nzyt
- TLSH T1717302D36DEE9553F25A923D8B3ACDC8AB144B50FA708420C05B6CE82EAFBC7D54446D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Srmdia DDoS/Srmdia DDoS.dll unpack001/Srmdia DDoS/Srmdia DDoS.exe
File Explorer
-
tst.rar.rar 76KB
-
Srmdia DDoS/Srmdia DDoS.dll.exe 8KB
-
Srmdia DDoS/Srmdia DDoS.exe.exe 172KB
-
Srmdia DDoS/Srmdia DDoS.pdb11KB
-
Srmdia DDoS/Srmdia DDos.deps.json425B
-
Srmdia DDoS/Srmdia DDos.runtimeconfig.json268B
Srmdia DDoS/Srmdia DDoS.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3ff8e5b4b19712e1c82561a5c11fb40d86ce1396bd8d9c0fc5b16fe8a1e42709
- MD5 f340c551f72eda9ca0d46af0d750b84e
- SHA1 016cc3c4b9d263d1271d9134dfb6d2a5f29b4d1e
- SHA512 6ef09f9aeb2d7e796238f11978a9c3a80e5b886f2c99b058b70667e2e6ee4c6a86f396abd2308ee2bf2ab1a85c797aba3c73daf332a956f0607d0cc1a5951cf7
- SSDEEP 96:R9kJtAoLOumdK+Jlyi54T3U+4+RnpbO6c9Qss7U74q9c3Wem:RSAu5Li4kl+5pgyss7Kc
- TLSH T1EDF10A00BFFCB622F8AF06B686AF53400735FB06582EC7AF4585513A4D63E4489E5B72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12826
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Administrator\source\repos\Srmdia DDos\Srmdia DDos\obj\Debug\net9.0\Srmdia DDoS.pdb
mscoree
_CorExeMain
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Srmdia DDoS/Srmdia DDoS.exe
- IMPHASH 7a8c872f8e13d32f36a675b52eda1d6e
- SHA256 73c951225f7edd42472b983982ffd1c300d7d165c5aa5fb67682bcc4955ca850
- MD5 d4a169c216e23704fcb3189faae51f09
- SHA1 eeaaaf72db65b687a3db83fb6f7cb6249399cd2f
- SHA512 480c7867f5ff260ba82ebd07d634be7c11d3e8a0096519cf55fc49721e8921eb4709c0f8c00634b6ebbb73e9fac8d0ccf039e22c1647ab0be323ae1988f76ae9
- SSDEEP 3072:29G2U1qr+L6n2dIrOaWkwI1RcCtZKeP7GVs57S9I7:2MCgIrOa1bvDtgEL
- TLSH T16D041907A698C3BEE0A69639C99249F1E7723C754B7177CF035079768E62790EE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
75200
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
shell32
ShellExecuteW
advapi32
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
kernel32
GetSystemTimeAsFileTime
TlsFree
CreateActCtxW
ActivateActCtx
GetLastError
FindResourceW
GetWindowsDirectoryW
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetStdHandle
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
MultiByteToWideChar
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
WriteConsoleW
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
OutputDebugStringW
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
user32
MessageBoxW
api-ms-win-crt-runtime-l1-1-0
terminate
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__p___argc
_exit
exit
_initterm_e
_errno
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
abort
_invoke_watson
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
malloc
_callnewh
free
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64_s
wcsftime
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfwprintf
__p__commode
fputwc
__acrt_iob_func
__stdio_common_vswprintf
_set_fmode
_wfsopen
fflush
setvbuf
__stdio_common_vsnwprintf_s
api-ms-win-crt-locale-l1-1-0
_create_locale
___mb_cur_max_func
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_configthreadlocale
setlocale
_lock_locales
_free_locale
_unlock_locales
api-ms-win-crt-string-l1-1-0
strlen
strcmp
wcsncmp
toupper
strcpy_s
_wcsdup
wcsnlen
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
91KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33140,
count=209, id=1, productName=Unmarked objects,
count=10, id=265, version=35217,
count=1, id=258, version=35217,
Srmdia DDoS/Srmdia DDoS.pdb
- SHA256 9a8e71b7c964c54d0a244f298d9ea673b1725541311fd7b91ee8778fd1660722
- MD5 2b44f699259169a9d01b5ec3a7c2e93d
- SHA1 43222afbf321e137a5618ee1c93140721791084c
- SHA512 c8de828abb089e35a0b39a6d9b4a8d069a2737d3775ee60b0446dd32bfc16a68aa19cbd291073dc0c8ff8bce5f9608e20060ae98a48accf15280bf82107fcdd2
- SSDEEP 192:DnvMevjLtcXJ6yPTgayZWrxBBHP+Aaost1UD9aSmZ9omhiRPj5ki4mJTHIfbwOOE:DnvHA6yPTgayZWrvJpaoA1MkSmZ9oyRb
- TLSH T10D32B57B939CC621C58925B25825C1DC7772C3202340EEB9F1E56A08DDAFADD07F62B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Srmdia DDoS/Srmdia DDos.deps.json
- SHA256 f0b1544407f7b15448f541c3bb1c1b72ab23e90af8dee2f649c0279b00207a77
- MD5 f8a4d3cad4d8627d640a289d391f1def
- SHA1 937c57dca82ab9b5c87c2dd39a9beba195e35e8e
- SHA512 c83e7569babae92beec4bffe95b0936aa0139bb61f63356e1a2f5df895f2f66da5e2709199569e81dd410b575acc73f8a953250a3336a3e9b6f6cb1f039e4ba9
- TLSH T11AE0ED19E9841DD701B623F585378343F92352330024180AB4BE900C4FB3D570022E68
- MD5 SHA1 SHA512 TLSH
Srmdia DDoS/Srmdia DDos.runtimeconfig.json
- SHA256 a45057885f807f4a337fdea3ccdfa64e1675d22a6d6a6fc7c7394fd44ba9eebe
- MD5 736f910c5e3628eb081902af0baac09d
- SHA1 9277849d039e9056f0ca1a6b58d43c77fa923392
- SHA512 05cbcf0f6f0e5410e3688fb0ee5b62f5db80c96ba8bcf9debdd63afdb7b38f8dbbae08aa92e9c290827ff493bec82ccc1de87af537e096f0f207b2b8ac6a66a0
- TLSH T13AD05B55CE415D5315FE777BD531C142FB35571710141495B4E8400C1F77D650211F55
- MD5 SHA1 SHA512 TLSH