C:\Users\nicholas\Downloads\Inj-2-master-fixed\Inj-2-master-fixed\x64\Release\Inj.pdb
Static task
static1
Behavioral task
behavioral1
Sample
injector.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
injector.exe
Resource
win10v2004-20240226-en
General
-
Target
injector.exe
-
Size
101KB
-
MD5
faa6a470296428b96b1d5aef3428392a
-
SHA1
8716b7f00aef6caeca5a7c7f0b383620a293c609
-
SHA256
7faaefb5940a7a451286e7dde9b429520199178f4adbb8656320a8ac77b2282d
-
SHA512
0ffaa62edbe029f627846a7fe82056f4d3b08d146b0ef25ccc2ee83c84af9bf593255599ad0fb122ea4ac583ce878e59f7690a45a28a56d4ec5a5f358759a7a9
-
SSDEEP
1536:lBcQGueDxFz/+/x9RYMTAQZVRIMlaqktLX9l:bcQeFFK/3RYOAQ36Ml5ktLX9l
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource injector.exe
Files
-
injector.exe.exe windows:6 windows x64 arch:x64
b8bbedae9d5566e96207ad309ac433bf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
CreateDirectoryW
VirtualFree
VirtualAlloc
lstrlenA
CreateFileW
OpenProcess
GetLastError
GetFileAttributesExW
DeleteFileW
CloseHandle
GetCurrentProcessId
GetModuleFileNameA
Sleep
GetProcessId
CreateToolhelp32Snapshot
Module32FirstW
ReadProcessMemory
Module32NextW
WriteProcessMemory
VirtualProtect
GetCurrentProcess
GetModuleHandleA
GetFileAttributesA
Process32NextW
LoadLibraryA
Process32FirstW
K32GetModuleInformation
LoadLibraryW
GetCurrentDirectoryW
GetProcAddress
VirtualAllocEx
VirtualFreeEx
GetTickCount64
GetModuleHandleW
GetTickCount
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
LocalFree
TerminateProcess
ReleaseSRWLockExclusive
user32
SetForegroundWindow
SetWindowsHookExW
GetClassNameW
SendMessageA
EnumWindows
UnhookWindowsHookEx
GetForegroundWindow
GetWindowTextW
IsWindowVisible
GetWindowThreadProcessId
ole32
StringFromGUID2
oleaut32
VariantClear
SysAllocString
SysFreeString
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0_Lockit@std@@QEAA@H@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?bad@ios_base@std@@QEBA_NXZ
?good@ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?fail@ios_base@std@@QEBA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??1_Lockit@std@@QEAA@XZ
dbghelp
SymCleanup
SymUnloadModule64
SymSetOptions
SymInitializeW
SymFromName
SymLoadModuleExW
urlmon
URLDownloadToFileW
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
__std_exception_destroy
_CxxThrowException
__C_specific_handler
__current_exception_context
__current_exception
strchr
__std_exception_copy
memcpy
memmove
memset
api-ms-win-crt-convert-l1-1-0
atoi
mbstowcs_s
wcstombs_s
_itoa_s
api-ms-win-crt-stdio-l1-1-0
fputc
_fseeki64
__p__commode
fread
ungetc
_set_fmode
__acrt_iob_func
setvbuf
fgetpos
fwrite
fsetpos
_get_stream_buffer_pointers
__stdio_common_vfprintf
fgetc
fclose
fflush
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
malloc
free
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-string-l1-1-0
tolower
_wcsicmp
_stricmp
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_initialize_narrow_environment
_initterm
_initterm_e
exit
_exit
_configure_narrow_argv
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_get_initial_narrow_environment
_invalid_parameter_noinfo_noreturn
terminate
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 79KB - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ