InjectorUm[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
InjectorUm.exe
Size 61KB
Sample260629-tsrrtsbs3m
SHA256 40ff2d7f7d40cdefa2d4cf88ea8eb028f975559a400dcf888e716edf3b2fcc7a
MD5 3cb9f25a7191ed8479933450ab441f18
SHA1 09ba05f235d63594283fdb3bb60a982266707108
SHA512 aa31181913a45ab0e4dce8c165350abbeea0c2b6b280dcb761c453ec62f956759adcb24ad677e95eedebe916bba0bb9b86f2dbe62bbd8f80c782903f3a0d1ac6
SSDEEP 1536:K3ln3hgE2Z5bGmMv16J2sx3GTLaZ6SdkdF:qln3hgnZ5bGmSkJ2G32K6iuF
TLSH
T18D531916CD1A507BD32AD87CEE434A13EF627C4A87A279EF6B844DE60D259E45B3D300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
InjectorUm.exe

File Explorer

InjectorUm.exe

.exe 61KB

InjectorUm.exe

IMPHASH 2820ffe25cc8ab2bf349f82212efa781
SHA256 40ff2d7f7d40cdefa2d4cf88ea8eb028f975559a400dcf888e716edf3b2fcc7a
MD5 3cb9f25a7191ed8479933450ab441f18
SHA1 09ba05f235d63594283fdb3bb60a982266707108
SHA512 aa31181913a45ab0e4dce8c165350abbeea0c2b6b280dcb761c453ec62f956759adcb24ad677e95eedebe916bba0bb9b86f2dbe62bbd8f80c782903f3a0d1ac6
SSDEEP 1536:K3ln3hgE2Z5bGmMv16J2sx3GTLaZ6SdkdF:qln3hgnZ5bGmSkJ2G32K6iuF
TLSH
T18D531916CD1A507BD32AD87CEE434A13EF627C4A87A279EF6B844DE60D259E45B3D300
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\Injector - MM - Copy\x64\Release\InjectorUm.pdb

kernel32

ReadFile WriteProcessMemory GetCurrentProcess DeviceIoControl GetModuleFileNameW K32GetModuleFileNameExW Thread32Next Thread32First WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId SuspendThread ResumeThread GetModuleHandleA OpenProcess CreateToolhelp32Snapshot GetExitCodeThread Sleep GetModuleHandleExA GetTickCount64 GetLastError Process32NextW TerminateThread LoadLibraryA Process32FirstW CloseHandle LoadLibraryW VirtualProtectEx GetThreadContext GetProcAddress VirtualAllocEx GetFileSize ReadProcessMemory GetCurrentProcessId GetModuleHandleW CreateRemoteThread K32EnumProcessModules VirtualFreeEx SetThreadContext OpenThread AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter ReleaseSRWLockExclusive

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

wininet

InternetOpenUrlA InternetCloseHandle InternetOpenA HttpQueryInfoA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strchr wcsrchr memcmp memcpy __std_exception_copy memset _CxxThrowException __current_exception __current_exception_context __std_exception_destroy __C_specific_handler memmove

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vsprintf_s __stdio_common_vfprintf __acrt_iob_func __stdio_common_vfwprintf __p__commode

api-ms-win-crt-string-l1-1-0

strlen wcscpy_s tolower _wcsicmp _stricmp strcpy_s wcslen

api-ms-win-crt-convert-l1-1-0

mbstowcs_s atoi wcstombs_s atol

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e _get_initial_wide_environment _exit _initialize_wide_environment _configure_wide_argv __p___argc __p___wargv _cexit _c_exit exit _seh_filter_exe _set_app_type terminate _initialize_onexit_table _register_onexit_function _crt_atexit _register_thread_local_exe_atexit_callback

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale