Static task
static1
Behavioral task
behavioral1
Sample
dll_injector32.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dll_injector32.exe
Resource
win10v2004-20240426-en
General
-
Target
dll_injector32.exe
-
Size
335KB
-
MD5
899de6f7d13cedab53eba18764c5af9a
-
SHA1
590ee04270212f9e5329b1c938e24f4d3ce84dbb
-
SHA256
cf798a7400592909303c9a47f7ef3a7f0aecb20a03bf51ccaa9528fb90bcaa87
-
SHA512
ab09ef30630db09e72a22275bb1f6f4cf0db8d58d801c6e64820a0cb8888696f7734b83e379b6f5a9f1bd0eccd9a2862931695e46587cdab3bb5cfe41b6193c1
-
SSDEEP
6144:iEHBYLyhigSCvaiVf5RlZE6s7SI8CcNAO6wZenQ:iyBAb1CvJ5RDEBuxenQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource dll_injector32.exe
Files
-
dll_injector32.exe.exe windows:6 windows x86 arch:x86
cbcd6bb8b97cefbd20b9a24193fb032b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenProcess
VirtualAllocEx
VirtualFreeEx
WriteProcessMemory
GetModuleHandleW
GetProcAddress
CloseHandle
GetCurrentThread
Sleep
CreateRemoteThread
IsWow64Process
K32EnumProcessModules
K32GetModuleFileNameExW
GetStdHandle
GetConsoleScreenBufferInfo
FlushConsoleInputBuffer
SetConsoleTextAttribute
WaitForSingleObject
GetLastError
CreateProcessW
GetCurrentProcess
ResumeThread
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RaiseException
RtlUnwind
FreeLibrary
LoadLibraryExW
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
GetExitCodeProcess
CreateProcessA
GetFileAttributesExW
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetStdHandle
WriteConsoleW
ReadConsoleW
HeapSize
CreateFileW
advapi32
ImpersonateSelf
AdjustTokenPrivileges
OpenThreadToken
LookupPrivilegeValueA
Sections
.text Size: 243KB - Virtual size: 243KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 1024B - Virtual size: 772B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ