VLONEINJECTOR[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
VLONEINJECTOR.exe
Size 22KB
Sample260415-rrfbasg14p
SHA256 7f38c4d3a9988356a88b1e217367b9db523b1a8ad4c127d7384a1801a335da50
MD5 495bd2b4f850abcab73357f2d827ff31
SHA1 abc80fc9b3746c525f453a214f0af457bcb8b3a1
SHA512 879d038fceb9233dddb560385cfef14e7ce8bccb3b54c903a3ec4456995dbaf69dcaa2a459266c2123304f368427762a2e3a45b1660f5cea0e54091ed1810362
SSDEEP 384:PHiR/++8RSp0Dkp59eiYb5bxJNSpjzP2SSK03A9azkZCAH53g:vc++8sR6b5bvEp2Sb0w9xH53g
TLSH
T122A21A76E3DD24EED022A2BCBED64D55D270B80D4311BBCB475099260FA6FA0DB3E581
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VLONEINJECTOR.exe

File Explorer

VLONEINJECTOR.exe

.exe 22KB

VLONEINJECTOR.exe

IMPHASH 1cd4d5cc203b71ef8b9971bbb2dadcd3
SHA256 7f38c4d3a9988356a88b1e217367b9db523b1a8ad4c127d7384a1801a335da50
MD5 495bd2b4f850abcab73357f2d827ff31
SHA1 abc80fc9b3746c525f453a214f0af457bcb8b3a1
SHA512 879d038fceb9233dddb560385cfef14e7ce8bccb3b54c903a3ec4456995dbaf69dcaa2a459266c2123304f368427762a2e3a45b1660f5cea0e54091ed1810362
SSDEEP 384:PHiR/++8RSp0Dkp59eiYb5bxJNSpjzP2SSK03A9azkZCAH53g:vc++8sR6b5bvEp2Sb0w9xH53g
TLSH
T122A21A76E3DD24EED022A2BCBED64D55D270B80D4311BBCB475099260FA6FA0DB3E581
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

Minor OS version

Major OS version

Entry point

12664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\DVRST\Desktop\VLONEINJECTOR\x64\Release\VLONEINJECTOR.pdb

wininet

InternetCloseHandle InternetOpenA InternetReadFile InternetOpenUrlA

kernel32

GetCurrentProcess CreateMutexA WaitForSingleObject ReleaseMutex GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep WriteProcessMemory Process32Next CloseHandle GetProcAddress VirtualAllocEx CreateRemoteThread CreateDirectoryA VirtualFreeEx Process32First InitializeSListHead QueryPerformanceCounter GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetFileAttributesA SetUnhandledExceptionFilter GetModuleHandleW

advapi32

AdjustTokenPrivileges RegCloseKey LookupPrivilegeValueA RegSetValueExA OpenProcessToken RegCreateKeyExA

shell32

SHGetFolderPathA

msvcp140

?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xlength_error@std@@YAXPEBD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?uncaught_exceptions@std@@YAHXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?good@ios_base@std@@QEBA_NXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate _CxxThrowException __std_exception_destroy __current_exception __current_exception_context memset __std_exception_copy memcpy __C_specific_handler

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode fopen_s fwrite fclose

api-ms-win-crt-heap-l1-1-0

_set_new_mode free _callnewh malloc

api-ms-win-crt-runtime-l1-1-0

_cexit _c_exit _register_thread_local_exe_atexit_callback __p___argc _exit exit _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initterm_e _initterm _get_initial_narrow_environment __p___argv _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

strlen strcmp