C:\Users\x\Documents\GitHub\Project-Apparatus\ProjectApparatus\obj\x64\Release\ProjectApparatus.pdb
Static task
static1
Behavioral task
behavioral1
Sample
!inject.bat
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
!inject.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ProjectApparatus.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
ProjectApparatus.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
SharpMonoInjector.dll
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
SharpMonoInjector.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
smi.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
smi.exe
Resource
win10v2004-20240802-en
General
-
Target
Project Apparatus v1.2.0_[unknowncheats.me]_.zip
-
Size
1.0MB
-
MD5
3b28718fa16c47707e83bceeef8b6b6e
-
SHA1
7b59a69c3fd701762519a2615858d8f485af7df2
-
SHA256
a78f41c5a6b3750c18f5b3a2b837f7a48b789eb6bbc681367d1b9c23892202fb
-
SHA512
2cfefa79642f32aa8fcdb5d3fbc0b6ef3b0ed6a797db2aa06beee383bcf90cf009c36611dfd803d53ab763db6e40114dd6199e4fdca3518b2150a698623fede7
-
SSDEEP
24576:GiDnR078BOaoPfcJNoEzsElUEwgs9T7mEYgKr0xp4ZZ3jB+h/hj:LRE88nfc1zs6s9eEYgKYXqZ3Fa
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/ProjectApparatus.dll unpack001/SharpMonoInjector.dll unpack001/smi.exe
Files
-
Project Apparatus v1.2.0_[unknowncheats.me]_.zip.zip
-
!inject.bat
-
ProjectApparatus.dll.dll windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Sections
.text Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 952B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
SharpMonoInjector.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\Users\James\Documents\Visual Studio 2017\Projects\SharpMonoInjector\SharpMonoInjector\obj\Release\SharpMonoInjector.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
smi.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
C:\Users\James\Documents\Visual Studio 2017\Projects\SharpMonoInjector\SharpMonoInjector.Console\obj\Release\smi.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ