Behavioral task
behavioral1
Sample
dx9injector.exe
Resource
win7-20230831-en
General
-
Target
dx9injector.exe
-
Size
632KB
-
MD5
d69d90a0ac5890b22e0932e7a24ba9c2
-
SHA1
d303ab6a4cf6e7ab113a60e2392a8ae42b455c07
-
SHA256
96ac460a603a209e2c8167613b292181f7f2f5ede977258a096f7d2c4f1e3870
-
SHA512
ec4804d65edf28de02d9889f83e37c0262da3e875a2707050213799662676f5ac9824b388f15f38312d6b303276b7a8a9cb3803e655087dce0f1d336b89bc7c8
-
SSDEEP
6144:XloZMLrIkd8g+EtXHkv/iD4PNWNvFuW558VHCCHTib8e1mKivanvOG2NYg7Cn+A7:1oZ0L+EP8PNWNvFuW558VHCCHy4LDA7
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1124332723931185242/OmV2GIsC1NUjLtGwP4q_EQTwB9SgZaU961Sl1T1h_56IhSYPJ0nSgKpGlbCRx1G1yqfn
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dx9injector.exe
Files
-
dx9injector.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 228KB - Virtual size: 228KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 403KB - Virtual size: 402KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ