Injector[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Injector.exe
Size

753KB
MD5

19712c421d880db767faae0df6ba50bd
SHA1

c8f27f234049a3326501790ab5a817cae6931619
SHA256

19099c405503843fe087e7c67fafe62f8532c79183fa1227b79f298b01a1154c
SHA512

1668be4f52ede4a9dbda4747a37a37de4cc99ccbc13c22894b1779ad3bc18283d2169c6e86b5425aa25864871c30db1601fa3da4edd4905e7244c02e10357099
SSDEEP

12288:XtS2o47FAov+bv3n8B9ll7gqtS9EJo4lsIpxxCMAeVFf2SHNFXSifu3fDY:0uFAombv3K8F4lvyeVrNo53fDY

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Injector.exe

Files

Injector.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: - Virtual size: 298KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 158KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 748KB - Virtual size: 747KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ