Rwx-Injector-main[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Rwx-Injector-main.zip
Size

7.2MB
MD5

66aeb531ea06fde71edbb9fd967653ae
SHA1

042ca54a3b22862e918b60f43ed98a09808ab3b0
SHA256

6292ec346c0bf89d9ed2c741a21a10eb98b18519fd62034c12e314763390ccab
SHA512

72df05d6851b92876b1f083dc9850a800fe8fc1fe14e9562cdbdccac949decdec4b4ffda298c18fba1446b5defa7e1f77230280133f43fe02ead9118fa692d55
SSDEEP

196608:etmKKmkPLUdWYX21OY13qwJ5Lzhgfy8s80uQ4q4YBChfyp:eFkovm1TPJ5nhga8s8W7fIfyp

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/Rwx-Injector-main/emulate.exe	themida

Files

Rwx-Injector-main.zip
.zip
Rwx-Injector-main/IAT.dll
.dll windows x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

ClearEnd
ClearStart
CodeReplaceEnd
CodeReplaceStart
CustomVM00000100_End
CustomVM00000100_Start
CustomVM00000101_End
CustomVM00000101_Start
CustomVM00000102_End
CustomVM00000102_Start
CustomVM00000103_End
CustomVM00000103_Start
CustomVM00000104_End
CustomVM00000104_Start
CustomVM00000105_End
CustomVM00000105_Start
CustomVM00000106_End
CustomVM00000106_Start
CustomVM00000107_End
CustomVM00000107_Start
CustomVM00000108_End
CustomVM00000108_Start
CustomVM00000109_End
CustomVM00000109_Start
CustomVM00000110_End
CustomVM00000110_Start
CustomVM00000111_End
CustomVM00000111_Start
CustomVM00000112_End
CustomVM00000112_Start
CustomVM00000113_End
CustomVM00000113_Start
CustomVM00000114_End
CustomVM00000114_Start
CustomVM00000115_End
CustomVM00000115_Start
CustomVM00000116_End
CustomVM00000116_Start
CustomVM00000117_End
CustomVM00000117_Start
CustomVM00000118_End
CustomVM00000118_Start
CustomVM00000119_End
CustomVM00000119_Start
CustomVM00000120_End
CustomVM00000120_Start
CustomVM00000121_End
CustomVM00000121_Start
CustomVM00000122_End
CustomVM00000122_Start
CustomVM00000123_End
CustomVM00000123_Start
CustomVM00000124_End
CustomVM00000124_Start
CustomVM00000125_End
CustomVM00000125_Start
CustomVM00000126_End
CustomVM00000126_Start
CustomVM00000127_End
CustomVM00000127_Start
CustomVM00000128_End
CustomVM00000128_Start
CustomVM00000129_End
CustomVM00000129_Start
CustomVM00000130_End
CustomVM00000130_Start
CustomVM00000131_End
CustomVM00000131_Start
CustomVM00000132_End
CustomVM00000132_Start
CustomVM00000133_End
CustomVM00000133_Start
CustomVM00000134_End
CustomVM00000134_Start
CustomVM00000135_End
CustomVM00000135_Start
CustomVM00000136_End
CustomVM00000136_Start
CustomVM00000137_End
CustomVM00000137_Start
CustomVM00000138_End
CustomVM00000138_Start
CustomVM00000139_End
CustomVM00000139_Start
CustomVM00000140_End
CustomVM00000140_Start
CustomVM00000141_End
CustomVM00000141_Start
CustomVM00000142_End
CustomVM00000142_Start
CustomVM00000143_End
CustomVM00000143_Start
CustomVM00000144_End
CustomVM00000144_Start
CustomVM00000145_End
CustomVM00000145_Start
CustomVM00000146_End
CustomVM00000146_Start
CustomVM00000147_End
CustomVM00000147_Start
CustomVM00000148_End
CustomVM00000148_Start
CustomVM00000149_End
CustomVM00000149_Start
CustomVM00000150_End
CustomVM00000150_Start
CustomVM00000151_End
CustomVM00000151_Start
CustomVM00000152_End
CustomVM00000152_Start
CustomVM00000153_End
CustomVM00000153_Start
CustomVM00000154_End
CustomVM00000154_Start
CustomVM00000155_End
CustomVM00000155_Start
CustomVM00000156_End
CustomVM00000156_Start
CustomVM00000157_End
CustomVM00000157_Start
CustomVM00000158_End
CustomVM00000158_Start
CustomVM00000159_End
CustomVM00000159_Start
CustomVM00000160_End
CustomVM00000160_Start
CustomVM00000161_End
CustomVM00000161_Start
CustomVM00000162_End
CustomVM00000162_Start
CustomVM00000163_End
CustomVM00000163_Start
CustomVM00000164_End
CustomVM00000164_Start
CustomVM00000165_End
CustomVM00000165_Start
CustomVM00000166_End
CustomVM00000166_Start
CustomVM00000167_End
CustomVM00000167_Start
CustomVM00000168_End
CustomVM00000168_Start
CustomVM00000169_End
CustomVM00000169_Start
CustomVM00000170_End
CustomVM00000170_Start
CustomVM00000171_End
CustomVM00000171_Start
CustomVM00000172_End
CustomVM00000172_Start
CustomVM00000173_End
CustomVM00000173_Start
CustomVM00000174_End
CustomVM00000174_Start
CustomVM00000175_End
CustomVM00000175_Start
CustomVM00000176_End
CustomVM00000176_Start
CustomVM00000177_End
CustomVM00000177_Start
CustomVM00000178_End
CustomVM00000178_Start
CustomVM00000179_End
CustomVM00000179_Start
CustomVM00000180_End
CustomVM00000180_Start
CustomVM00000181_End
CustomVM00000181_Start
CustomVM00000182_End
CustomVM00000182_Start
CustomVM00000183_End
CustomVM00000183_Start
CustomVM00000184_End
CustomVM00000184_Start
CustomVM00000185_End
CustomVM00000185_Start
CustomVM00000186_End
CustomVM00000186_Start
CustomVM00000187_End
CustomVM00000187_Start
CustomVM00000188_End
CustomVM00000188_Start
CustomVM00000189_End
CustomVM00000189_Start
CustomVM00000190_End
CustomVM00000190_Start
CustomVM00000191_End
CustomVM00000191_Start
CustomVM00000192_End
CustomVM00000192_Start
CustomVM00000193_End
CustomVM00000193_Start
CustomVM00000194_End
CustomVM00000194_Start
CustomVM00000195_End
CustomVM00000195_Start
CustomVM00000196_End
CustomVM00000196_Start
CustomVM00000197_End
CustomVM00000197_Start
CustomVM00000198_End
CustomVM00000198_Start
CustomVM00000199_End
CustomVM00000199_Start
CustomVM00000200_End
CustomVM00000200_Start
CustomVM00000201_End
CustomVM00000201_Start
CustomVM00000202_End
CustomVM00000202_Start
CustomVM00000203_End
CustomVM00000203_Start
CustomVM00000204_End
CustomVM00000204_Start
CustomVM00000205_End
CustomVM00000205_Start
CustomVM00000206_End
CustomVM00000206_Start
CustomVM00000207_End
CustomVM00000207_Start
CustomVM00000208_End
CustomVM00000208_Start
CustomVM00000209_End
CustomVM00000209_Start
CustomVM00000210_End
CustomVM00000210_Start
CustomVM00000211_End
CustomVM00000211_Start
CustomVM00000212_End
CustomVM00000212_Start
CustomVM00000213_End
CustomVM00000213_Start
CustomVM00000214_End
CustomVM00000214_Start
CustomVM00000215_End
CustomVM00000215_Start
CustomVM00000216_End
CustomVM00000216_Start
CustomVM00000217_End
CustomVM00000217_Start
CustomVM00000218_End
CustomVM00000218_Start
CustomVM00000219_End
CustomVM00000219_Start
CustomVM00000220_End
CustomVM00000220_Start
CustomVM00000221_End
CustomVM00000221_Start
CustomVM00000222_End
CustomVM00000222_Start
CustomVM00000223_End
CustomVM00000223_Start
CustomVM00000224_End
CustomVM00000224_Start
CustomVM00000225_End
CustomVM00000225_Start
CustomVM00000226_End
CustomVM00000226_Start
CustomVM00000227_End
CustomVM00000227_Start
CustomVM00000228_End
CustomVM00000228_Start
CustomVM00000229_End
CustomVM00000229_Start
CustomVM00000230_End
CustomVM00000230_Start
CustomVM00000231_End
CustomVM00000231_Start
CustomVM00000232_End
CustomVM00000232_Start
CustomVM00000233_End
CustomVM00000233_Start
CustomVM00000234_End
CustomVM00000234_Start
CustomVM00000235_End
CustomVM00000235_Start
CustomVM00000236_End
CustomVM00000236_Start
CustomVM00000237_End
CustomVM00000237_Start
CustomVM00000238_End
CustomVM00000238_Start
CustomVM00000239_End
CustomVM00000239_Start
CustomVM00000240_End
CustomVM00000240_Start
CustomVM00000241_End
CustomVM00000241_Start
CustomVM00000242_End
CustomVM00000242_Start
CustomVM00000243_End
CustomVM00000243_Start
CustomVM00000244_End
CustomVM00000244_Start
CustomVM00000245_End
CustomVM00000245_Start
CustomVM00000246_End
CustomVM00000246_Start
CustomVM00000247_End
CustomVM00000247_Start
CustomVM00000248_End
CustomVM00000248_Start
CustomVM00000249_End
CustomVM00000249_Start
CustomVM00000250_End
CustomVM00000250_Start
CustomVM00000251_End
CustomVM00000251_Start
CustomVM00000252_End
CustomVM00000252_Start
CustomVM00000253_End
CustomVM00000253_Start
CustomVM00000254_End
CustomVM00000254_Start
CustomVM00000255_End
CustomVM00000255_Start
CustomVM00000256_End
CustomVM00000256_Start
CustomVM00000257_End
CustomVM00000257_Start
CustomVM00000258_End
CustomVM00000258_Start
CustomVM00000259_End
CustomVM00000259_Start
CustomVM00000260_End
CustomVM00000260_Start
CustomVM00000261_End
CustomVM00000261_Start
CustomVM00000262_End
CustomVM00000262_Start
CustomVM00000263_End
CustomVM00000263_Start
CustomVM00000264_End
CustomVM00000264_Start
CustomVM00000265_End
CustomVM00000265_Start
CustomVM00000266_End
CustomVM00000266_Start
CustomVM00000267_End
CustomVM00000267_Start
CustomVM00000268_End
CustomVM00000268_Start
CustomVM00000269_End
CustomVM00000269_Start
CustomVM00000270_End
CustomVM00000270_Start
CustomVM00000271_End
CustomVM00000271_Start
CustomVM00000272_End
CustomVM00000272_Start
CustomVM00000273_End
CustomVM00000273_Start
CustomVM00000274_End
CustomVM00000274_Start
CustomVM00000275_End
CustomVM00000275_Start
CustomVM00000276_End
CustomVM00000276_Start
CustomVM00000277_End
CustomVM00000277_Start
CustomVM00000278_End
CustomVM00000278_Start
CustomVM00000279_End
CustomVM00000279_Start
CustomVM00000280_End
CustomVM00000280_Start
CustomVM00000281_End
CustomVM00000281_Start
CustomVM00000282_End
CustomVM00000282_Start
CustomVM00000283_End
CustomVM00000283_Start
CustomVM00000284_End
CustomVM00000284_Start
CustomVM00000285_End
CustomVM00000285_Start
CustomVM00000286_End
CustomVM00000286_Start
CustomVM00000287_End
CustomVM00000287_Start
CustomVM00000288_End
CustomVM00000288_Start
CustomVM00000289_End
CustomVM00000289_Start
CustomVM00000290_End
CustomVM00000290_Start
CustomVM00000291_End
CustomVM00000291_Start
CustomVM00000292_End
CustomVM00000292_Start
CustomVM00000293_End
CustomVM00000293_Start
CustomVM00000294_End
CustomVM00000294_Start
CustomVM00000295_End
CustomVM00000295_Start
CustomVM00000296_End
CustomVM00000296_Start
CustomVM00000297_End
CustomVM00000297_Start
CustomVM00000298_End
CustomVM00000298_Start
CustomVM00000299_End
CustomVM00000299_Start
CustomVM00000300_End
CustomVM00000300_Start
CustomVM00000301_End
CustomVM00000301_Start
CustomVM00000302_End
CustomVM00000302_Start
CustomVM00000303_End
CustomVM00000303_Start
CustomVM00000304_End
CustomVM00000304_Start
CustomVM00000305_End
CustomVM00000305_Start
CustomVM00000306_End
CustomVM00000306_Start
CustomVM00000307_End
CustomVM00000307_Start
CustomVM00000308_End
CustomVM00000308_Start
CustomVM00000309_End
CustomVM00000309_Start
CustomVM00000310_End
CustomVM00000310_Start
CustomVM00000311_End
CustomVM00000311_Start
CustomVM00000312_End
CustomVM00000312_Start
CustomVM00000313_End
CustomVM00000313_Start
CustomVM00000314_End
CustomVM00000314_Start
CustomVM00000315_End
CustomVM00000315_Start
CustomVM00000316_End
CustomVM00000316_Start
CustomVM00000317_End
CustomVM00000317_Start
CustomVM00000318_End
CustomVM00000318_Start
CustomVM00000319_End
CustomVM00000319_Start
CustomVM00000320_End
CustomVM00000320_Start
CustomVM00000321_End
CustomVM00000321_Start
CustomVM00000322_End
CustomVM00000322_Start
CustomVM00000323_End
CustomVM00000323_Start
CustomVM00000324_End
CustomVM00000324_Start
CustomVM00000325_End
CustomVM00000325_Start
CustomVM00000326_End
CustomVM00000326_Start
CustomVM00000327_End
CustomVM00000327_Start
CustomVM00000328_End
CustomVM00000328_Start
CustomVM00000329_End
CustomVM00000329_Start
CustomVM00000330_End
CustomVM00000330_Start
CustomVM00000331_End
CustomVM00000331_Start
CustomVM00000332_End
CustomVM00000332_Start
CustomVM00000333_End
CustomVM00000333_Start
CustomVM00000334_End
CustomVM00000334_Start
CustomVM00000335_End
CustomVM00000335_Start
CustomVM00000336_End
CustomVM00000336_Start
CustomVM00000337_End
CustomVM00000337_Start
CustomVM00000338_End
CustomVM00000338_Start
CustomVM00000339_End
CustomVM00000339_Start
CustomVM00000340_End
CustomVM00000340_Start
CustomVM00000341_End
CustomVM00000341_Start
CustomVM00000342_End
CustomVM00000342_Start
CustomVM00000343_End
CustomVM00000343_Start
CustomVM00000344_End
CustomVM00000344_Start
CustomVM00000345_End
CustomVM00000345_Start
CustomVM00000346_End
CustomVM00000346_Start
CustomVM00000347_End
CustomVM00000347_Start

Sections

.text
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Rwx-Injector-main/README.md
Rwx-Injector-main/emulate.exe
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 107KB - Virtual size: 203KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 35KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 46KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 133B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 275B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
Rwx-Injector-main/imports.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

ClearEnd
ClearStart
CodeReplaceEnd
CodeReplaceStart
CustomVM00000100_End
CustomVM00000100_Start
CustomVM00000101_End
CustomVM00000101_Start
CustomVM00000102_End
CustomVM00000102_Start
CustomVM00000103_End
CustomVM00000103_Start
CustomVM00000104_End
CustomVM00000104_Start
CustomVM00000105_End
CustomVM00000105_Start
CustomVM00000106_End
CustomVM00000106_Start
CustomVM00000107_End
CustomVM00000107_Start
CustomVM00000108_End
CustomVM00000108_Start
CustomVM00000109_End
CustomVM00000109_Start
CustomVM00000110_End
CustomVM00000110_Start
CustomVM00000111_End
CustomVM00000111_Start
CustomVM00000112_End
CustomVM00000112_Start
CustomVM00000113_End
CustomVM00000113_Start
CustomVM00000114_End
CustomVM00000114_Start
CustomVM00000115_End
CustomVM00000115_Start
CustomVM00000116_End
CustomVM00000116_Start
CustomVM00000117_End
CustomVM00000117_Start
CustomVM00000118_End
CustomVM00000118_Start
CustomVM00000119_End
CustomVM00000119_Start
CustomVM00000120_End
CustomVM00000120_Start
CustomVM00000121_End
CustomVM00000121_Start
CustomVM00000122_End
CustomVM00000122_Start
CustomVM00000123_End
CustomVM00000123_Start
CustomVM00000124_End
CustomVM00000124_Start
CustomVM00000125_End
CustomVM00000125_Start
CustomVM00000126_End
CustomVM00000126_Start
CustomVM00000127_End
CustomVM00000127_Start
CustomVM00000128_End
CustomVM00000128_Start
CustomVM00000129_End
CustomVM00000129_Start
CustomVM00000130_End
CustomVM00000130_Start
CustomVM00000131_End
CustomVM00000131_Start
CustomVM00000132_End
CustomVM00000132_Start
CustomVM00000133_End
CustomVM00000133_Start
CustomVM00000134_End
CustomVM00000134_Start
CustomVM00000135_End
CustomVM00000135_Start
CustomVM00000136_End
CustomVM00000136_Start
CustomVM00000137_End
CustomVM00000137_Start
CustomVM00000138_End
CustomVM00000138_Start
CustomVM00000139_End
CustomVM00000139_Start
CustomVM00000140_End
CustomVM00000140_Start
CustomVM00000141_End
CustomVM00000141_Start
CustomVM00000142_End
CustomVM00000142_Start
CustomVM00000143_End
CustomVM00000143_Start
CustomVM00000144_End
CustomVM00000144_Start
CustomVM00000145_End
CustomVM00000145_Start
CustomVM00000146_End
CustomVM00000146_Start
CustomVM00000147_End
CustomVM00000147_Start
CustomVM00000148_End
CustomVM00000148_Start
CustomVM00000149_End
CustomVM00000149_Start
CustomVM00000150_End
CustomVM00000150_Start
CustomVM00000151_End
CustomVM00000151_Start
CustomVM00000152_End
CustomVM00000152_Start
CustomVM00000153_End
CustomVM00000153_Start
CustomVM00000154_End
CustomVM00000154_Start
CustomVM00000155_End
CustomVM00000155_Start
CustomVM00000156_End
CustomVM00000156_Start
CustomVM00000157_End
CustomVM00000157_Start
CustomVM00000158_End
CustomVM00000158_Start
CustomVM00000159_End
CustomVM00000159_Start
CustomVM00000160_End
CustomVM00000160_Start
CustomVM00000161_End
CustomVM00000161_Start
CustomVM00000162_End
CustomVM00000162_Start
CustomVM00000163_End
CustomVM00000163_Start
CustomVM00000164_End
CustomVM00000164_Start
CustomVM00000165_End
CustomVM00000165_Start
CustomVM00000166_End
CustomVM00000166_Start
CustomVM00000167_End
CustomVM00000167_Start
CustomVM00000168_End
CustomVM00000168_Start
CustomVM00000169_End
CustomVM00000169_Start
CustomVM00000170_End
CustomVM00000170_Start
CustomVM00000171_End
CustomVM00000171_Start
CustomVM00000172_End
CustomVM00000172_Start
CustomVM00000173_End
CustomVM00000173_Start
CustomVM00000174_End
CustomVM00000174_Start
CustomVM00000175_End
CustomVM00000175_Start
CustomVM00000176_End
CustomVM00000176_Start
CustomVM00000177_End
CustomVM00000177_Start
CustomVM00000178_End
CustomVM00000178_Start
CustomVM00000179_End
CustomVM00000179_Start
CustomVM00000180_End
CustomVM00000180_Start
CustomVM00000181_End
CustomVM00000181_Start
CustomVM00000182_End
CustomVM00000182_Start
CustomVM00000183_End
CustomVM00000183_Start
CustomVM00000184_End
CustomVM00000184_Start
CustomVM00000185_End
CustomVM00000185_Start
CustomVM00000186_End
CustomVM00000186_Start
CustomVM00000187_End
CustomVM00000187_Start
CustomVM00000188_End
CustomVM00000188_Start
CustomVM00000189_End
CustomVM00000189_Start
CustomVM00000190_End
CustomVM00000190_Start
CustomVM00000191_End
CustomVM00000191_Start
CustomVM00000192_End
CustomVM00000192_Start
CustomVM00000193_End
CustomVM00000193_Start
CustomVM00000194_End
CustomVM00000194_Start
CustomVM00000195_End
CustomVM00000195_Start
CustomVM00000196_End
CustomVM00000196_Start
CustomVM00000197_End
CustomVM00000197_Start
CustomVM00000198_End
CustomVM00000198_Start
CustomVM00000199_End
CustomVM00000199_Start
CustomVM00000200_End
CustomVM00000200_Start
CustomVM00000201_End
CustomVM00000201_Start
CustomVM00000202_End
CustomVM00000202_Start
CustomVM00000203_End
CustomVM00000203_Start
CustomVM00000204_End
CustomVM00000204_Start
CustomVM00000205_End
CustomVM00000205_Start
CustomVM00000206_End
CustomVM00000206_Start
CustomVM00000207_End
CustomVM00000207_Start
CustomVM00000208_End
CustomVM00000208_Start
CustomVM00000209_End
CustomVM00000209_Start
CustomVM00000210_End
CustomVM00000210_Start
CustomVM00000211_End
CustomVM00000211_Start
CustomVM00000212_End
CustomVM00000212_Start
CustomVM00000213_End
CustomVM00000213_Start
CustomVM00000214_End
CustomVM00000214_Start
CustomVM00000215_End
CustomVM00000215_Start
CustomVM00000216_End
CustomVM00000216_Start
CustomVM00000217_End
CustomVM00000217_Start
CustomVM00000218_End
CustomVM00000218_Start
CustomVM00000219_End
CustomVM00000219_Start
CustomVM00000220_End
CustomVM00000220_Start
CustomVM00000221_End
CustomVM00000221_Start
CustomVM00000222_End
CustomVM00000222_Start
CustomVM00000223_End
CustomVM00000223_Start
CustomVM00000224_End
CustomVM00000224_Start
CustomVM00000225_End
CustomVM00000225_Start
CustomVM00000226_End
CustomVM00000226_Start
CustomVM00000227_End
CustomVM00000227_Start
CustomVM00000228_End
CustomVM00000228_Start
CustomVM00000229_End
CustomVM00000229_Start
CustomVM00000230_End
CustomVM00000230_Start
CustomVM00000231_End
CustomVM00000231_Start
CustomVM00000232_End
CustomVM00000232_Start
CustomVM00000233_End
CustomVM00000233_Start
CustomVM00000234_End
CustomVM00000234_Start
CustomVM00000235_End
CustomVM00000235_Start
CustomVM00000236_End
CustomVM00000236_Start
CustomVM00000237_End
CustomVM00000237_Start
CustomVM00000238_End
CustomVM00000238_Start
CustomVM00000239_End
CustomVM00000239_Start
CustomVM00000240_End
CustomVM00000240_Start
CustomVM00000241_End
CustomVM00000241_Start
CustomVM00000242_End
CustomVM00000242_Start
CustomVM00000243_End
CustomVM00000243_Start
CustomVM00000244_End
CustomVM00000244_Start
CustomVM00000245_End
CustomVM00000245_Start
CustomVM00000246_End
CustomVM00000246_Start
CustomVM00000247_End
CustomVM00000247_Start
CustomVM00000248_End
CustomVM00000248_Start
CustomVM00000249_End
CustomVM00000249_Start
CustomVM00000250_End
CustomVM00000250_Start
CustomVM00000251_End
CustomVM00000251_Start
CustomVM00000252_End
CustomVM00000252_Start
CustomVM00000253_End
CustomVM00000253_Start
CustomVM00000254_End
CustomVM00000254_Start
CustomVM00000255_End
CustomVM00000255_Start
CustomVM00000256_End
CustomVM00000256_Start
CustomVM00000257_End
CustomVM00000257_Start
CustomVM00000258_End
CustomVM00000258_Start
CustomVM00000259_End
CustomVM00000259_Start
CustomVM00000260_End
CustomVM00000260_Start
CustomVM00000261_End
CustomVM00000261_Start
CustomVM00000262_End
CustomVM00000262_Start
CustomVM00000263_End
CustomVM00000263_Start
CustomVM00000264_End
CustomVM00000264_Start
CustomVM00000265_End
CustomVM00000265_Start
CustomVM00000266_End
CustomVM00000266_Start
CustomVM00000267_End
CustomVM00000267_Start
CustomVM00000268_End
CustomVM00000268_Start
CustomVM00000269_End
CustomVM00000269_Start
CustomVM00000270_End
CustomVM00000270_Start
CustomVM00000271_End
CustomVM00000271_Start
CustomVM00000272_End
CustomVM00000272_Start
CustomVM00000273_End
CustomVM00000273_Start
CustomVM00000274_End
CustomVM00000274_Start
CustomVM00000275_End
CustomVM00000275_Start
CustomVM00000276_End
CustomVM00000276_Start
CustomVM00000277_End
CustomVM00000277_Start
CustomVM00000278_End
CustomVM00000278_Start
CustomVM00000279_End
CustomVM00000279_Start
CustomVM00000280_End
CustomVM00000280_Start
CustomVM00000281_End
CustomVM00000281_Start
CustomVM00000282_End
CustomVM00000282_Start
CustomVM00000283_End
CustomVM00000283_Start
CustomVM00000284_End
CustomVM00000284_Start
CustomVM00000285_End
CustomVM00000285_Start
CustomVM00000286_End
CustomVM00000286_Start
CustomVM00000287_End
CustomVM00000287_Start
CustomVM00000288_End
CustomVM00000288_Start
CustomVM00000289_End
CustomVM00000289_Start
CustomVM00000290_End
CustomVM00000290_Start
CustomVM00000291_End
CustomVM00000291_Start
CustomVM00000292_End
CustomVM00000292_Start
CustomVM00000293_End
CustomVM00000293_Start
CustomVM00000294_End
CustomVM00000294_Start
CustomVM00000295_End
CustomVM00000295_Start
CustomVM00000296_End
CustomVM00000296_Start
CustomVM00000297_End
CustomVM00000297_Start
CustomVM00000298_End
CustomVM00000298_Start
CustomVM00000299_End
CustomVM00000299_Start
CustomVM00000300_End
CustomVM00000300_Start
CustomVM00000301_End
CustomVM00000301_Start
CustomVM00000302_End
CustomVM00000302_Start
CustomVM00000303_End
CustomVM00000303_Start
CustomVM00000304_End
CustomVM00000304_Start
CustomVM00000305_End
CustomVM00000305_Start
CustomVM00000306_End
CustomVM00000306_Start
CustomVM00000307_End
CustomVM00000307_Start
CustomVM00000308_End
CustomVM00000308_Start
CustomVM00000309_End
CustomVM00000309_Start
CustomVM00000310_End
CustomVM00000310_Start
CustomVM00000311_End
CustomVM00000311_Start
CustomVM00000312_End
CustomVM00000312_Start
CustomVM00000313_End
CustomVM00000313_Start
CustomVM00000314_End
CustomVM00000314_Start
CustomVM00000315_End
CustomVM00000315_Start
CustomVM00000316_End
CustomVM00000316_Start
CustomVM00000317_End
CustomVM00000317_Start
CustomVM00000318_End
CustomVM00000318_Start
CustomVM00000319_End
CustomVM00000319_Start
CustomVM00000320_End
CustomVM00000320_Start
CustomVM00000321_End
CustomVM00000321_Start
CustomVM00000322_End
CustomVM00000322_Start
CustomVM00000323_End
CustomVM00000323_Start
CustomVM00000324_End
CustomVM00000324_Start
CustomVM00000325_End
CustomVM00000325_Start
CustomVM00000326_End
CustomVM00000326_Start
CustomVM00000327_End
CustomVM00000327_Start
CustomVM00000328_End
CustomVM00000328_Start
CustomVM00000329_End
CustomVM00000329_Start
CustomVM00000330_End
CustomVM00000330_Start
CustomVM00000331_End
CustomVM00000331_Start
CustomVM00000332_End
CustomVM00000332_Start
CustomVM00000333_End
CustomVM00000333_Start
CustomVM00000334_End
CustomVM00000334_Start
CustomVM00000335_End
CustomVM00000335_Start
CustomVM00000336_End
CustomVM00000336_Start
CustomVM00000337_End
CustomVM00000337_Start
CustomVM00000338_End
CustomVM00000338_Start
CustomVM00000339_End
CustomVM00000339_Start
CustomVM00000340_End
CustomVM00000340_Start
CustomVM00000341_End
CustomVM00000341_Start
CustomVM00000342_End
CustomVM00000342_Start
CustomVM00000343_End
CustomVM00000343_Start
CustomVM00000344_End
CustomVM00000344_Start
CustomVM00000345_End
CustomVM00000345_Start
CustomVM00000346_End
CustomVM00000346_Start
CustomVM00000347_End
CustomVM00000347_Start

Sections

.text
Size: 1024B - Virtual size: 910B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Rwx-Injector-main/remote_call.txt
Rwx-Injector-main/rwxVuln.dll
.dll windows x64

Code Sign

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

30/03/2016, 19:21

Not After

30/06/2017, 19:21

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6f:50:69:a0:59:b7:8a:a6:64:1a:48:27:36:89:fb:07:07:c0:fc:a9:49:c3:7d:99:17:af:4f:ea:3a:ff:2f:bc
Signer

Actual PE Digest

6f:50:69:a0:59:b7:8a:a6:64:1a:48:27:36:89:fb:07:07:c0:fc:a9:49:c3:7d:99:17:af:4f:ea:3a:ff:2f:bc

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

23/09/2022, 10:49
Valid: false

7c:f4:1c:08:4c:22:39:18:81:cb:8f:a6:4b:76:d5:73:02:25:38:c5
Signer

Actual PE Digest

7c:f4:1c:08:4c:22:39:18:81:cb:8f:a6:4b:76:d5:73:02:25:38:c5

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/06/2016, 07:27
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.data
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xdata
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 7.9MB - Virtual size: 7.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 222KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

.text Size: 1024B - Virtual size: 840B

.rdata Size: 26KB - Virtual size: 25KB

Headers

DLL Characteristics

File Characteristics

Sections

Size: 107KB - Virtual size: 203KB

Size: 35KB - Virtual size: 78KB

Size: 46KB - Virtual size: 111KB

Size: 5KB - Virtual size: 9KB

Size: 133B - Virtual size: 244B

Size: 275B - Virtual size: 488B

Size: 1KB - Virtual size: 2KB

.imports Size: 512B - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 4KB

.themida Size: - Virtual size: 5.7MB

.boot Size: 3.2MB - Virtual size: 3.2MB

.reloc Size: 16B - Virtual size: 4KB

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

.text Size: 1024B - Virtual size: 910B

.rdata Size: 26KB - Virtual size: 25KB

Code Sign

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9bCertificate

Extended Key Usages

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0aCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

6f:50:69:a0:59:b7:8a:a6:64:1a:48:27:36:89:fb:07:07:c0:fc:a9:49:c3:7d:99:17:af:4f:ea:3a:ff:2f:bcSigner

Signature Validations

Verification

23/09/2022, 10:49 Valid: false

7c:f4:1c:08:4c:22:39:18:81:cb:8f:a6:4b:76:d5:73:02:25:38:c5Signer

Signature Validations

Verification

21/06/2016, 07:27 Valid: false

Headers

DLL Characteristics

File Characteristics

Sections

.data Size: 2.0MB - Virtual size: 2.0MB

.xdata Size: 177KB - Virtual size: 177KB

.text Size: 7.9MB - Virtual size: 7.9MB

.reloc Size: 222KB - Virtual size: 222KB

.text
Size: 1024B - Virtual size: 840B

.rdata
Size: 26KB - Virtual size: 25KB

.imports
Size: 512B - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 4KB

.themida
Size: - Virtual size: 5.7MB

.boot
Size: 3.2MB - Virtual size: 3.2MB

.reloc
Size: 16B - Virtual size: 4KB

.text
Size: 1024B - Virtual size: 910B

.rdata
Size: 26KB - Virtual size: 25KB

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

6f:50:69:a0:59:b7:8a:a6:64:1a:48:27:36:89:fb:07:07:c0:fc:a9:49:c3:7d:99:17:af:4f:ea:3a:ff:2f:bc
Signer

23/09/2022, 10:49
Valid: false

7c:f4:1c:08:4c:22:39:18:81:cb:8f:a6:4b:76:d5:73:02:25:38:c5
Signer

21/06/2016, 07:27
Valid: false

.data
Size: 2.0MB - Virtual size: 2.0MB

.xdata
Size: 177KB - Virtual size: 177KB

.text
Size: 7.9MB - Virtual size: 7.9MB

.reloc
Size: 222KB - Virtual size: 222KB