F:\Work\NetBar\前端\服务模块\WXYD_Combine\x64\Debug\ExpInj.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ExpInj.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ExpInj.exe
Resource
win10v2004-20231215-en
General
-
Target
ExpInj.exe
-
Size
4.6MB
-
MD5
e71191ec50b9425c04e6184add1c9f47
-
SHA1
bba9e8d6a6dfd1587c7b564bc6ab2a41ecbc6dff
-
SHA256
7fc6a9470d1b9be2d909bcd9abd0f1c97e65a9e24eef1559fc50bbf88ad9e12e
-
SHA512
c39038c646dfdbaae5c5f9d260cf77789043c99f6c63fbb76598fd875075d4602f6e6de33f8b9a9f2edc901fe60c828bbe8d52cebb26345ca5dd7becde753486
-
SSDEEP
98304:O6y6mkqZMu2GahDVEXXGUnZx4yiN+FMiPbObmh:VgMZlVEXX1Zc+FMUabmh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ExpInj.exe
Files
-
ExpInj.exe.exe windows:5 windows x64 arch:x64
bdb75b8c19c4207db70fcab1e1555184
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
WriteProcessMemory
VirtualAllocEx
OpenProcess
LockResource
LoadResource
SizeofResource
GetCurrentProcessId
FindResourceW
Sleep
WideCharToMultiByte
FindResourceExW
VirtualQuery
OpenEventW
SetErrorMode
SetEnvironmentVariableA
CompareStringW
SetUnhandledExceptionFilter
GetCurrentProcess
GetLastError
CloseHandle
CompareStringA
SetEndOfFile
CreateFileA
GetTimeZoneInformation
GetLocaleInfoW
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
RaiseException
SetEvent
OpenEventA
OutputDebugStringA
OutputDebugStringW
MultiByteToWideChar
lstrlenA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
UnmapViewOfFile
GetSystemInfo
MapViewOfFile
CreateFileMappingA
GetCurrentThread
OpenFileMappingA
GetModuleFileNameW
GetProcAddress
VirtualFree
LoadLibraryA
OpenFileMappingW
ReleaseMutex
CreateFileMappingW
WaitForSingleObject
CreateMutexW
CreateThread
VirtualFreeEx
CreateRemoteThread
GetModuleHandleA
GetTickCount
ExitThread
IsBadReadPtr
SuspendThread
WaitForMultipleObjects
TerminateThread
ResumeThread
SetThreadContext
GetThreadContext
GetModuleHandleW
CreateEventW
GetVersionExW
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
QueryPerformanceCounter
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
GetModuleFileNameA
HeapValidate
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
FatalAppExitA
DebugBreak
EncodePointer
DecodePointer
TlsAlloc
FlsGetValue
FlsSetValue
GetCurrentThreadId
FlsAlloc
FlsFree
SetLastError
GetStdHandle
WriteFile
WriteConsoleW
GetFileType
ExitProcess
SetConsoleCtrlHandler
LoadLibraryW
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
GetSystemTimeAsFileTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapSetInformation
HeapCreate
HeapQueryInformation
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointer
InitializeCriticalSectionAndSpinCount
FreeLibrary
LCMapStringW
LCMapStringA
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
CreateFileW
user32
FindWindowW
FindWindowExW
GetWindowThreadProcessId
IsWindow
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
SetThreadToken
RevertToSelf
OpenThreadToken
OpenProcessToken
vmprotectsdk64
VMProtectBegin
VMProtectEnd
psapi
GetModuleFileNameExW
ole32
StringFromCLSID
CoTaskMemFree
CoCreateGuid
shlwapi
PathFileExistsW
Sections
.text Size: 597KB - Virtual size: 597KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 30KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3.9MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ