Radon Injector[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Radon Injector.exe
Size 426KB
Sample260415-tnvb6afx2x
SHA256 27032cb214e8fba94d77ba0337739296e30741bbb1761e7c6c9062a22ae2f6fa
MD5 4bb36c00975201d1011dc43e60865dec
SHA1 c2a68ae8064b0c929c5cb712364ceae68a95d298
SHA512 5842538cf0104471f373bd28baac97a96bf191bb187183c3c21dc0b9762cee320c54c13edc69548ec2a5b18bc5ca1dc28f398a95106f0938efd077527e0ecaf0
SSDEEP 6144:DQ6sA1F3Horz97mpQOb9CB6sqODABGVqZkBXhDh3xlVu:t3FrLC69ODCnZkzD/
TLSH
T1BC946E1A979501FCE0B7A27889174A02F776780A03A1DBDF03D4C5B62F676D19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Radon Injector.exe

File Explorer

Radon Injector.exe

.exe 426KB

Radon Injector.exe

IMPHASH 5359c24c46a967c27252e969942b1764
SHA256 27032cb214e8fba94d77ba0337739296e30741bbb1761e7c6c9062a22ae2f6fa
MD5 4bb36c00975201d1011dc43e60865dec
SHA1 c2a68ae8064b0c929c5cb712364ceae68a95d298
SHA512 5842538cf0104471f373bd28baac97a96bf191bb187183c3c21dc0b9762cee320c54c13edc69548ec2a5b18bc5ca1dc28f398a95106f0938efd077527e0ecaf0
SSDEEP 6144:DQ6sA1F3Horz97mpQOb9CB6sqODABGVqZkBXhDh3xlVu:t3FrLC69ODCnZkzD/
TLSH
T1BC946E1A979501FCE0B7A27889174A02F776780A03A1DBDF03D4C5B62F676D19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

172628

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Thread32First OpenProcess CreateToolhelp32Snapshot Process32NextW QueryFullProcessImageNameA Process32FirstW Module32FirstW WideCharToMultiByte GetThreadTimes Module32NextW GlobalDeleteAtom GlobalAddAtomA GetLocalTime SetEndOfFile WriteConsoleW HeapSize CreateFileW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose Thread32Next LocalFree ReadConsoleW ReadFile EnumSystemLocalesW GetModuleHandleA IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetFileType HeapAlloc HeapFree WriteFile GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW CompareFileTime IsWow64Process GetCurrentProcess VirtualFreeEx ReadProcessMemory VirtualAllocEx VirtualProtectEx WriteProcessMemory OpenThread SetThreadContext GetThreadContext QueueUserAPC LoadLibraryA ResumeThread SuspendThread FormatMessageA CreateRemoteThread HeapReAlloc FreeLibrary TlsFree TlsSetValue GetProcAddress CloseHandle GetLastError Sleep GetExitCodeThread TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException WaitForSingleObject LoadLibraryExA ExitProcess GetUserDefaultLCID GetModuleFileNameW RtlPcToFileHeader RtlUnwindEx TerminateProcess InitializeSListHead GetCurrentProcessId IsProcessorFeaturePresent RtlUnwind GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW SleepConditionVariableSRW WakeAllConditionVariable LCMapStringEx MultiByteToWideChar DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW

user32

GetDesktopWindow EnumWindows IsWindowVisible SendMessageTimeoutW GetWindowThreadProcessId GetWindowTextW EndPaint BeginPaint GetCursorPos ReleaseDC InvalidateRect SetWindowsHookExA UpdateWindow PtInRect MessageBoxW KillTimer DrawTextW GetClientRect LoadCursorW TranslateMessage SetLayeredWindowAttributes TrackMouseEvent MapWindowPoints PeekMessageW PostThreadMessageA ReleaseCapture CreateIconIndirect SetTimer DispatchMessageW ShowWindow RegisterClassExW UnhookWindowsHookEx PostQuitMessage GetWindowLongPtrW GetWindowTextLengthW GetMessageW DefWindowProcW PostMessageW GetWindowRect DestroyWindow InflateRect SetWindowTextW SetWindowPos SetWindowLongPtrW FillRect CreateWindowExW ScreenToClient SendMessageW GetSystemMetrics UnregisterClassW GetDC

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateDIBSection CreateCompatibleDC CreateFontW GetStockObject DeleteDC GetTextExtentPoint32W SetTextColor SetBkMode LineTo CreatePen MoveToEx SetBkColor DeleteObject CreateSolidBrush CreateBitmap ExtTextOutW

msimg32

AlphaBlend

comctl32

ord410 ord17 ord413

comdlg32

GetOpenFileNameW

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

uxtheme

SetWindowTheme

shell32

ShellExecuteExW

advapi32

LookupPrivilegeValueA OpenProcessToken GetTokenInformation AdjustTokenPrivileges

gdiplus

GdipSetPathGradientSurroundColorsWithCount GdipDrawLineI GdipCreatePen1 GdipDeletePen GdipDrawLines GdipDeleteGraphics GdipFillRectangleI GdipGetPathGradientPointCount GdipCloneBrush GdipCreateFromHDC GdipDrawPath GdipFree GdipClosePathFigure GdipAddPathEllipse GdipFillRectangle GdipFillPath GdipCreateSolidFill GdipSetLinePresetBlend GdipCreatePath GdipSetSmoothingMode GdipCreatePathGradientFromPath GdipSetPathGradientCenterColor GdipDeletePath GdipAlloc GdipDeleteBrush GdipCreateLineBrushI GdiplusShutdown GdiplusStartup GdipAddPathArc

Name

.text

Size

311KB

Virtual Size

310KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Radon Injector.exe

kernel32

user32

gdi32

msimg32

comctl32

comdlg32

dwmapi

uxtheme

shell32

advapi32

gdiplus

generic