inj[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
inj.exe
Size 563KB
Sample240410-sc3cysfb8v
SHA256 4d7ef7d2821d2ef90d1a8ac02c18380aaf3377a851337447540a807883b5af6e
MD5 cf694f497b3c5775750e5e7f3cf66dc0
SHA1 8d4027195ed3eced0fda4a858cac98d24b45f562
SHA512 b035a318bca1ee7d44369323a09ee72bce731f32c1ad4b34e35824f9dbb736b481e771a659f02b5a601299e3c3d84bfdaffc0244b581d482fefeaf6560cdde79
SSDEEP 12288:WtQEV6bPAjGGmgwNfAQt28Awnm1puLxW:WmEV6LAiBrfAQtl/n8uVW
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
inj.exe

File Explorer

inj.exe

.exe 563KB

inj.exe

IMPHASH 5c632bb689f9c2d30b9334b6b639c6e0
SHA256 4d7ef7d2821d2ef90d1a8ac02c18380aaf3377a851337447540a807883b5af6e
MD5 cf694f497b3c5775750e5e7f3cf66dc0
SHA1 8d4027195ed3eced0fda4a858cac98d24b45f562
SHA512 b035a318bca1ee7d44369323a09ee72bce731f32c1ad4b34e35824f9dbb736b481e771a659f02b5a601299e3c3d84bfdaffc0244b581d482fefeaf6560cdde79
SSDEEP 12288:WtQEV6bPAjGGmgwNfAQt28Awnm1puLxW:WmEV6LAiBrfAQtl/n8uVW
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

443464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\zuxvi\Desktop\Vex\injector source\x64\Release\inj.pdb

kernel32

QueryPerformanceCounter GetTickCount MoveFileExA WaitForSingleObjectEx MultiByteToWideChar GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects CreateFileA GetFileSizeEx WideCharToMultiByte OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess QueryFullProcessImageNameW GetProcAddress GetModuleHandleW GetModuleHandleA GetModuleFileNameA UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualProtect GetCurrentThread CreateThread GetCurrentProcess DeleteCriticalSection InitializeCriticalSectionEx FreeLibrary HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW ResetEvent SetEvent InitializeCriticalSectionAndSpinCount VerifyVersionInfoA GetSystemDirectoryA QueryPerformanceFrequency VerSetConditionMask SleepEx LeaveCriticalSection EnterCriticalSection FormatMessageA LocalFree GetProcessHeap CreateFileW CreateRemoteThread GetConsoleWindow VirtualAllocEx CloseHandle Process32Next LoadLibraryA Sleep CreateToolhelp32Snapshot OpenProcess WriteProcessMemory Process32First SetLastError

user32

ShowWindow MessageBoxA BlockInput

advapi32

InitializeAcl AddAccessAllowedAce GetLengthSid GetTokenInformation IsValidSid SetSecurityInfo CopySid ConvertSidToStringSidA CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptEncrypt CryptImportKey CryptDestroyKey OpenProcessToken

shell32

ShellExecuteA

msvcp140

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setf@ios_base@std@@QEAAHHH@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xbad_function_call@std@@YAXXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

normaliz

IdnToAscii

wldap32

ord26 ord22 ord41 ord50 ord32 ord60 ord211 ord46 ord217 ord27 ord45 ord33 ord35 ord79 ord30 ord301 ord200 ord143

crypt32

CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CertFreeCertificateChain PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CryptQueryObject CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CryptDecodeObjectEx CertOpenStore

ws2_32

WSASetLastError WSAIoctl send WSAStartup WSACleanup WSAGetLastError bind connect getpeername recvfrom getsockname accept getsockopt htons htonl listen ioctlsocket closesocket getaddrinfo freeaddrinfo recv sendto ntohs setsockopt select ntohl __WSAFDIsSet gethostname socket

rpcrt4

UuidToStringA RpcStringFreeA UuidCreate

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception strstr strrchr __current_exception_context memset __C_specific_handler memmove memcpy memcmp strchr memchr __std_exception_destroy __std_exception_copy __std_terminate _CxxThrowException

api-ms-win-crt-heap-l1-1-0

calloc malloc _set_new_mode _callnewh realloc free

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type terminate _get_initial_narrow_environment _initterm _initterm_e _exit __sys_nerr __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo strerror _resetstkoflw _invalid_parameter_noinfo_noreturn _getpid _errno exit system _beginthreadex

api-ms-win-crt-stdio-l1-1-0

_close _open _fseeki64 _write _read fputc fflush fread __p__commode _set_fmode fclose fsetpos ungetc setvbuf _lseeki64 fgets fgetc _pclose _popen ftell fseek feof fwrite __stdio_common_vsscanf fputs fopen __stdio_common_vsprintf fgetpos __acrt_iob_func _get_stream_buffer_pointers

api-ms-win-crt-filesystem-l1-1-0

_stat64 _unlock_file _fstat64 _lock_file _access _unlink

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64

api-ms-win-crt-string-l1-1-0

tolower strpbrk strcmp strncmp strcspn strspn isupper _strdup _stricmp strncpy

api-ms-win-crt-convert-l1-1-0

strtod atoi strtoul strtoull strtoll strtol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

_dclass __setusermatherr

api-ms-win-crt-utility-l1-1-0

qsort