6���t���a�%���q'�?W�.(m�lH�� �5<g�RMm2%; (����|pP�s:OT>�9G+׃�X�)�&�% <��3���H<�R澋�m�b��+*c�x��EҮ���>��a%rW:7�H�=[}| ;��^1�gK�NE�-z�Qa��v��H ��� C�RY��� }�� ���:�<.�Wˑ/�#EC.W���Kʰ�܃;��`e&�@6��M�ON3�������ڟƨM4���7?�P�*�C'F>z:�����&g�gI [n����ۉ!.(װ۬�8��7�u?˾Ї���� Y�9r&�O@B�\L\[���ȋ�������3�]t�O�hH��/�0Z���L�4XT>X� ���i�<�������|���͓�`GϖD���l`�G�.吵ѹ�Q�� rtri��y◧*��[�)�k���%�D�s�o�������UE\�����.��#ʏiK��b�2b���]�D���~0*��OUȕQ�9� p�����C~��#���B��!>��s�.+�7֩������o�iE<ZgO�̸�M���J����7��P{�б�D���0;���@=k��kX��Ř�r�%�pM��1�]�{� �pc\���r ���O��XW��_��W��&����,O��w%���gNb.�+�M�"5�I��r%+���̔Mw.n���r������3�7<�9�rп9����a�P�o��֤��IO�!VO����b�Ld�����L��L�c)��T�=�+�8�ۤ���+�Q$w���ᰙ�Ą}/�������I�7x��3$c�� N(��s`�䢿�.���X[�9�s^���s�4$%���D��B���M' ϥ��N���+`^���i��g��,����2�[���F-4�k[Ƒ]F���LTjZa ��<�_�}Ƿx=��#�W�tF��(��y�se'E���7z�y�Ԕ� �k)��&&�;ߟ����k��a���qg،|���8�$9a���?_=��H����U���q�PTZ i4N�X��YR���3��h��Uvs>.�G���m^��]�T�����}<����4���!�a������fgȆ���wЃ�?�]F�����x.���#�{QO-B�߶Q����v��+�Å�@H)^-cS�J�8�J:�]`ӕ��-��D��dC����zgz��������t�<k G���o�W��ym���P�S1b�;����V ƽ����H��]�������h��'�`�����i��0eI��G�U��Y�Z�t)D|f��A�����S�7�WN���3BKj���o��>�<,� �b�}T�@������W�>㇋��9�����Z2%����W��M"&�,�Th5�;*r8äl�cM�P�xM+7��L �t�Yc�pe���Ŝ�`5R�\�P<����4GN� v [L��)@뜑�H���1��W� G�.3N��.�F?fbߐ?�Y4}�M�=dm��%@b㪞,�J�q�x��V��&Eyp��te�`8����d�ˈA�Q>qy�`�rǴ#��ֺ���4|`���5{�����T��Vp��)�wb ��q��ӷb�7X�F#�0���P��[��7���I~�ô��ul�]��F� � ��9��jVDε�0�3;���˸+��\�i����97�;���~��@^ ���]�18bqw��Gcw��e"N�K�.,����a׆(&�92�J����c@H���|��,ա[DBԈ?��V�ư��3�4��>�Վ�h���ps�)����&~4�A��y�E�F�^�����^g�<Y�؉2��J�n�Uy������7�k�/]�y���L����X�����&��Zm��<a��J���#�5mA6(�q&XDL oۘ����j�l�b@QF�}BD�d�9e��8��� z���c�)��8����t�k�����A�=�,Jφ��*���p������x뒅�i~�����#-�=����*��05��&�o�j��S�m��-/Az�X"tѸ�JX>�/�>H?��G@��iH�>VBO(DL�VS�;���O]����F�V��M�n9���o!e����k���s&�펖"��uQ|��!;���%���6�mqVp���3#f��@�>y�Bt�CøNmҖnÝb��~�$���I��a��7)�a�L .��*^����6i���6��ǁY��z�f�5��%��e��&Z���b%�ډ�W���m ��c�A����?.>xO*�ۺ�rF:/ԫ�Pa�KJw^TH����{���u͙A��>=�A]Ld"��8���� �`@�]�<ډ}��I�6t�t(uPW&�=�.����;)���-�3���Sϋ$�'4ğ�Š�tX H�w^�Px���7�:��ԲJ\��� o2U�B�-){D4:�KQ���MO7���a��Zm�� �X�e��{",�BwP�;� T�飖`7��J�ZL�h+���� 垘؆~��N��i`�������n�F�I��l�@bLj�G5�C2Ðy��:��>-f���u���E�S6s�zS:D���q�����|���-"с�Z�?V.kM���Ӭ��-Н��rN�lkv������H#�P��D�%z��U3���G�W���su>W�Z{��Cx�K��:�AV6��Nڢ��l�ac3<뎃fD�M/���d�D�?:�v��Oy4���Gf�~`#�>_/�����]�)���,����e��sX�vA>�HMN�4��p�������b"1�ܴ�E�v�ٶ#mYW�V�/���A��Y�F��b�����hv����g5N�C��egy^������,�F��*9[�GcH@���1��wn�����������9`q"-ԋ=�W���G����͕��~��>���i���B5k�X���V��F�n��8?ʂc�뿉�ztrGg����s�8q����7��;X��{ɍ��:�:��8��S���3�BnL�.�ȁ��S=��|�z��,>� ��Ijr��R�$��E��,t0����rY+��<�W}=�!I�,��z���T�U�
Static task
static1
General
-
Target
Injector.exe
-
Size
4.8MB
-
MD5
8da7ffaee1e5988d56e536d37a5e5d7d
-
SHA1
ed799e5ec866ec3dff0bffb306de4b1ab2ca2361
-
SHA256
7450c90fad1d9ed73652c7fee391adb41ee2c62d5d43f3bdcab945e3fdec5485
-
SHA512
34579bfbee7ec802322b12cc91276dc440d2df63d8e02b55ec303a19b4a198810a97157cf82739d0c30a509928d797142cee133aec994f0c8f5c58c5a6aebd16
-
SSDEEP
98304:2sscM3M0egRUUYdiVF0Zx5NMEuRdvwp1cpY1t83Szkkak0jIiGELfHNz:Vrf0egyUKiVF0rF+dmcQtQSzkkakuR7V
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Injector.exe
Files
-
Injector.exe.exe windows:6 windows x64 arch:x64
076acaa656f74379ef1e60670f0fed54
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteProcessMemory
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PostThreadMessageA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegQueryValueExA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 588B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.acedia0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.acedia1 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ