Ddos[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Ddos.exe
Size 8.7MB
Sample261015-pbt4eacv9v
SHA256 616742ae42ce8c82246dfe01eb5397ff17d1416f6cbcc7c480e91add9e417138
MD5 831a1b2cb17d7065bbd6c91e1a9b62e2
SHA1 50ff1b26bdde8e780814bafae5afdfcd726855db
SHA512 42b3eb9cce57b4752ffe5c6e65d25d974c09d7932c1b7b2eba0f1108d6b7374faf6a877c39753025fab7742f7966bf494cac50ea1f2fd897514538631d60fcb0
SSDEEP 49152:TH/npjXT1tk0i4WIU9BvV0BUk+AUgmTOrEhMSp8PVahD2y4iUaOoM8xLmebjneOa:7TFPVa6f+8lstbN1CznKV2
TLSH
T1AF962A16E36990D9D07FC0789283AB63BD217489073977F78AC086652F60EF8AD3D764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Ddos.exe

File Explorer

Ddos.exe

.exe 8.7MB

Ddos.exe

IMPHASH 7c876c549b878f99ab9141d73875884c
SHA256 616742ae42ce8c82246dfe01eb5397ff17d1416f6cbcc7c480e91add9e417138
MD5 831a1b2cb17d7065bbd6c91e1a9b62e2
SHA1 50ff1b26bdde8e780814bafae5afdfcd726855db
SHA512 42b3eb9cce57b4752ffe5c6e65d25d974c09d7932c1b7b2eba0f1108d6b7374faf6a877c39753025fab7742f7966bf494cac50ea1f2fd897514538631d60fcb0
SSDEEP 49152:TH/npjXT1tk0i4WIU9BvV0BUk+AUgmTOrEhMSp8PVahD2y4iUaOoM8xLmebjneOa:7TFPVa6f+8lstbN1CznKV2
TLSH
T1AF962A16E36990D9D07FC0789283AB63BD217489073977F78AC086652F60EF8AD3D764
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5322428

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

UDP_Flooding.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

ImpersonateAnonymousToken SystemFunction036 RevertToSelf

opengl32

wglMakeCurrent wglGetCurrentDC wglGetCurrentContext wglDeleteContext wglCreateContext wglShareLists wglGetProcAddress

shlwapi

AssocQueryStringW

kernel32

IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime CreateMutexA GetCurrentThreadId CloseHandle LoadLibraryW GetProcAddress GetLastError LoadLibraryExW FreeLibrary GetModuleFileNameW SetThreadErrorMode GlobalLock GlobalSize GlobalUnlock GlobalFree GetCurrentThread GlobalAlloc WideCharToMultiByte MultiByteToWideChar FormatMessageW LoadLibraryA GetProcessHeap HeapAlloc HeapFree WaitForSingleObject Sleep GetModuleHandleA FreeEnvironmentStringsW DeleteProcThreadAttributeList CompareStringOrdinal AddVectoredExceptionHandler SetThreadStackGuarantee SwitchToThread CreateWaitableTimerExW SetWaitableTimer QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW SetFileInformationByHandle GetCurrentProcess DuplicateHandle GetStdHandle GetCurrentProcessId SetHandleInformation WriteFileEx SleepEx GetExitCodeProcess QueryPerformanceFrequency HeapReAlloc lstrlenW ReleaseMutex FindClose CreateFileW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileW GetConsoleMode GetModuleHandleW ExitProcess CreateNamedPipeW ReadFileEx GetFullPathNameW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute WriteConsoleW CreateThread WaitForSingleObjectEx IsProcessorFeaturePresent

user32

GetActiveWindow FlashWindowEx ReleaseDC GetWindowLongPtrW SendMessageW CreateIconFromResourceEx DestroyWindow MapVirtualKeyA GetMessageW TranslateMessage DispatchMessageW PeekMessageW PostThreadMessageW SetWindowLongPtrW DefWindowProcW MonitorFromRect TrackMouseEvent GetMenu GetTouchInputInfo CloseTouchInputHandle ScreenToClient LoadCursorW SetCursor MonitorFromWindow GetMonitorInfoW ValidateRect GetUpdateRect GetDC GetWindowPlacement GetClassNameW GetClassInfoExW ClientToScreen GetClipboardData EmptyClipboard OpenClipboard IsClipboardFormatAvailable CloseClipboard SetClipboardData SetWindowDisplayAffinity RegisterClipboardFormatW RemovePropW CallWindowProcW GetPropW SetPropW MsgWaitForMultipleObjectsEx RegisterWindowMessageA SetCapture CreateIcon RegisterRawInputDevices GetRawInputData ShowWindow GetSystemMenu EnableMenuItem SetWindowLongW GetWindowLongW AdjustWindowRectEx SetWindowTextW ChangeDisplaySettingsExW SetWindowPlacement MapVirtualKeyW SendInput SetForegroundWindow GetWindowRect ShowCursor GetClipCursor ClipCursor IsIconic SystemParametersInfoA IsProcessDPIAware DestroyIcon EnumDisplayMonitors MonitorFromPoint GetKeyState GetKeyboardState ToUnicodeEx GetKeyboardLayout InvalidateRgn SetWindowPos RedrawWindow GetForegroundWindow PostMessageW ReleaseCapture GetCursorPos GetClientRect CreateWindowExW RegisterClassExW RegisterTouchWindow GetSystemMetrics

shell32

DragFinish DragQueryFileW

gdi32

DescribePixelFormat SwapBuffers DeleteObject CreateRectRgn SetPixelFormat ChoosePixelFormat GetDeviceCaps

ws2_32

WSACleanup WSAStartup getaddrinfo WSASocketW WSAGetLastError freeaddrinfo sendto bind closesocket

ole32

CoInitializeEx CoCreateInstance CoUninitialize OleInitialize RevokeDragDrop RegisterDragDrop

dwmapi

DwmEnableBlurBehindWindow

oleaut32

GetErrorInfo SafeArrayCreateVector SafeArrayPutElement SysStringLen SetErrorInfo SysFreeString SysAllocStringLen

uiautomationcore

UiaLookupId UiaRaiseAutomationPropertyChangedEvent UiaGetReservedNotSupportedValue UiaReturnRawElementProvider UiaRaiseAutomationEvent UiaHostProviderFromHwnd

winmm

timeGetDevCaps timeEndPeriod timeBeginPeriod

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetCompositionStringW ImmAssociateContextEx ImmGetContext

uxtheme

SetWindowTheme

ntdll

RtlNtStatusToDosError NtWriteFile

vcruntime140

__current_exception_context __current_exception __C_specific_handler _CxxThrowException memmove memcmp memset __CxxFrameHandler3 memcpy

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-math-l1-1-0

log10 cosf __setusermatherr _hypotf atan2f acosf floor cbrtf ceil truncf floorf powf ceilf trunc sinf expf roundf round pow cos sin

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table terminate _crt_atexit _configure_narrow_argv strerror _set_app_type _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _seh_filter_exe _exit _get_initial_narrow_environment _initterm _initterm_e exit _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free