Injector[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Injector.exe
Size 58KB
Sample260702-mczn6set7r
SHA256 d66cf4f9f826f542f48df8459dcfd3fad046a26eaf934b637acafbfded143179
MD5 6a962d09bea3123cefcdd2a2c875f25c
SHA1 2544d78a8c647607fef2661b1813f413a7325e54
SHA512 7e2e32fc1f1e9535f0f33da3a932b0d6888de34d43a194766e6ea64d41ed58ad7c3112149028a8470bb66c930a238a5e7004e61e2c4896c06ace57c809e4b17a
SSDEEP 1536:HD6/VarcIGhQIrHnFaWHCacqtgyYoLA8n:HDCVarjcQCnF8QyJoLd
TLSH
T13F437D57A76800ECE17AD2BDC6E34A49F7B1B4050321ABCF1790D6170F17AE8A97F621
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Injector.exe

File Explorer

Injector.exe

.exe 58KB

Injector.exe

IMPHASH 2a69852d5cec1a2e89aeb8310e965f8e
SHA256 d66cf4f9f826f542f48df8459dcfd3fad046a26eaf934b637acafbfded143179
MD5 6a962d09bea3123cefcdd2a2c875f25c
SHA1 2544d78a8c647607fef2661b1813f413a7325e54
SHA512 7e2e32fc1f1e9535f0f33da3a932b0d6888de34d43a194766e6ea64d41ed58ad7c3112149028a8470bb66c930a238a5e7004e61e2c4896c06ace57c809e4b17a
SSDEEP 1536:HD6/VarcIGhQIrHnFaWHCacqtgyYoLA8n:HDCVarjcQCnF8QyJoLd
TLSH
T13F437D57A76800ECE17AD2BDC6E34A49F7B1B4050321ABCF1790D6170F17AE8A97F621
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\forlo\source\repos\EludornInjector\x64\Release\Injector.pdb

kernel32

WriteProcessMemory SetConsoleTitleA GetStdHandle WriteConsoleA SetConsoleMode GetModuleHandleA Sleep GetConsoleMode LoadLibraryA CloseHandle SetStdHandle GetProcAddress ReadProcessMemory AllocConsole FindFirstFileA GetCurrentProcess DeleteFileTransactedA FindNextFileA FindClose CreateToolhelp32Snapshot GetTempPathA CopyFileA CreateFileA DeleteFileA VirtualProtectEx GetTempFileNameA VirtualQueryEx Thread32Next Thread32First SuspendThread ResumeThread DuplicateHandle OpenThread Process32First OpenProcess Process32Next GetThreadId VirtualAllocEx VirtualFreeEx FormatMessageA GetLocaleInfoEx FindFirstFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetLastError GetModuleHandleW GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte LocalFree QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter

user32

FindWindowA

msvcp140

?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Winerror_map@std@@YAHH@Z ?_Xlength_error@std@@YAXPEBD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Syserror_map@std@@YAPEBDH@Z _Xtime_get_ticks ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A

ktmw32

CommitTransaction CreateTransaction

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler _CxxThrowException __std_exception_destroy memcpy memmove memset __current_exception __std_exception_copy __current_exception_context

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free _set_new_mode

api-ms-win-crt-time-l1-1-0

_localtime64_s strftime

api-ms-win-crt-runtime-l1-1-0

system terminate _crt_atexit _cexit __p___argv __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _register_onexit_function _set_app_type _seh_filter_exe _initialize_onexit_table _register_thread_local_exe_atexit_callback abort _c_exit

api-ms-win-crt-stdio-l1-1-0

_fseeki64 fread fsetpos ungetc __p__commode setvbuf fgetpos fwrite _set_fmode _get_stream_buffer_pointers fgetc __stdio_common_vsnprintf_s fclose fflush fputc

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-string-l1-1-0

_stricmp strlen wcscmp

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr