Injector[.]exe | Triage™

General

Target
Injector.exe
Size 461KB
Sample240219-jaa19aag51
SHA256 95b45baa28467be3ca303f48f696990d3491aa9d24ee888d221d5170f7bf5a23
MD5 74e9c2da84432615f4562f724c8b792a
SHA1 f10ba74f0a8bdb74335a94ee377979a6b6204c84
SHA512 12990370f2ae48b2a3e6ad624704b3feffb7c71e44f08037e84f8ce1e75b0faf8a46facd90c4aa5ee576c063dbbbe1e39e8ad36fcd783741dc2f84fa52c39d33
SSDEEP 12288:wu/osQMgL96w0SVvV6fcaubLH31O2lxvdJGtKcctrJnSvLhTt:wur9gkEPGcHHX1OSr/cYtns
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack001/out.upx	autoit_exe

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
Injector.exe
unpack001/out.upx

File Explorer

Injector.exe

.exe 461KB
out.upx

.exe 920KB

Injector.exe

SHA256 95b45baa28467be3ca303f48f696990d3491aa9d24ee888d221d5170f7bf5a23
MD5 74e9c2da84432615f4562f724c8b792a
SHA1 f10ba74f0a8bdb74335a94ee377979a6b6204c84
SHA512 12990370f2ae48b2a3e6ad624704b3feffb7c71e44f08037e84f8ce1e75b0faf8a46facd90c4aa5ee576c063dbbbe1e39e8ad36fcd783741dc2f84fa52c39d33
SSDEEP 12288:wu/osQMgL96w0SVvV6fcaubLH31O2lxvdJGtKcctrJnSvLhTt:wur9gkEPGcHHX1OSr/cYtns
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

992432

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 7aa4ad76953528719384991e0c17bd58629c0296da322662f6b7732ded6d4d67
MD5 9a5fe81462e5b41fc17c3ed53053cafb
SHA1 c0caefcb885cd67c4649a0d002295b669b66213f
SHA512 b1847b7a169a8d2fbd18c32b3771a3abbe19b12bac56b24df7a6caf54ffd3dbf665527d2431fbb7f255ede208ab413cf352bfca917752cd3684bd535a06a36c2
SSDEEP 12288:EAHn2JK+HemNsqI3etnBHYPpAkApyRV3jRfP4S5LH28U3mcQuKXSoggdnLTteHzY:EAHnh+eWsN3skA4RV1Hom2KXSmVeHzf
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

163850

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Injector.exe

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

Injector.exe

generic

out.upx

generic