NebulaInjector[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
NebulaInjector.exe
Size 937KB
Sample260707-ty64psav2r
SHA256 9d03e52b55caba5c7dd72da2bf334d80eae704b7e1ae43f6e12c260e930773ec
MD5 99b61d0b783962d9894627135493b973
SHA1 5da1c4eec5fbd2a9fe8a2607ad8e4bdb25aaef1b
SHA512 bee7309aab1b997b7f1b1d22b3b753784de832f4eaaaa685d1e00685a0823554ee6df19c0f95ca499c51028b86444cef4ea29bbb7674db5a7b8e9401ae8d99ce
SSDEEP 12288:vasuooCCo7jFbLfh300ZuKNLr0rVphia7MSMXikWRPlZEF:vQypLJEYN30rnhL+zWRtZ
TLSH
T148156C15E6A510FEE177D57CCA634902EBB27C860770EACB13A049A62F177D48E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NebulaInjector.exe

File Explorer

NebulaInjector.exe

.exe 937KB

NebulaInjector.exe

IMPHASH 47bef08b815a26c5e3e234722898c870
SHA256 9d03e52b55caba5c7dd72da2bf334d80eae704b7e1ae43f6e12c260e930773ec
MD5 99b61d0b783962d9894627135493b973
SHA1 5da1c4eec5fbd2a9fe8a2607ad8e4bdb25aaef1b
SHA512 bee7309aab1b997b7f1b1d22b3b753784de832f4eaaaa685d1e00685a0823554ee6df19c0f95ca499c51028b86444cef4ea29bbb7674db5a7b8e9401ae8d99ce
SSDEEP 12288:vasuooCCo7jFbLfh300ZuKNLr0rVphia7MSMXikWRPlZEF:vQypLJEYN30rnhL+zWRtZ
TLSH
T148156C15E6A510FEE177D57CCA634902EBB27C860770EACB13A049A62F177D48E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

96256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdiplusStartup GdiplusShutdown GdipCreateStringFormat GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipCloneImage GdipSetPenStartCap GdipAddPathEllipseI GdipDeleteBrush GdipAlloc GdipDeletePath GdipSetPathGradientCenterColor GdipCreatePathGradientFromPath GdipDisposeImage GdipSetSmoothingMode GdipCreateLineBrush GdipCreatePath GdipSetStringFormatLineAlign GdipCreateFont GdipCreateSolidFill GdipFillPath GdipDrawLine GdipClosePathFigure GdipFree GdipDrawPath GdipDrawString GdipCreateFromHDC GdipSetPenEndCap GdipSetTextRenderingHint GdipCloneBrush GdipGetImageGraphicsContext GdipGetPathGradientPointCount GdipFillRectangleI GdipAddPathArc GdipDeleteGraphics GdipDrawArc GdipDeleteStringFormat GdipDeleteFont GdipDeletePen GdipCreateBitmapFromScan0 GdipDrawImageI GdipCreatePen1 GdipSetStringFormatAlign GdipSetPathGradientSurroundColorsWithCount

user32

GetMessageW EndPaint SetWindowRgn CreateWindowExW SendMessageW GetSystemMetrics ShowWindow OpenClipboard DispatchMessageW SetTimer DefWindowProcW CloseClipboard RegisterClassW TrackMouseEvent EnumWindows TranslateMessage GetClipboardData LoadCursorW SetCursor PostQuitMessage UpdateWindow ReleaseCapture InvalidateRect BeginPaint GetWindowTextW

gdi32

CreateRoundRectRgn

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey SetEntriesInAclW SetNamedSecurityInfoW GetNamedSecurityInfoW ConvertStringSidToSidW OpenProcessToken RegOpenKeyExW RegQueryValueExW

ole32

CoCreateInstance CoInitializeEx CoSetProxyBlanket

oleaut32

SysFreeString SysAllocString SysStringLen VariantClear VariantInit

kernel32

GetConsoleMode GetConsoleOutputCP GetFileType LCMapStringW CompareStringW LoadLibraryExW VirtualProtect HeapAlloc HeapFree GetTimeZoneInformation UnhandledExceptionFilter GetStdHandle TerminateProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread DeleteCriticalSection GetFileSizeEx LeaveCriticalSection EnterCriticalSection SetEndOfFile EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter QueryPerformanceCounter SleepConditionVariableSRW WakeAllConditionVariable ReadConsoleW SetFilePointerEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar InitializeCriticalSectionEx Sleep WriteConsoleW HeapReAlloc HeapSize GetStringTypeW AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateDirectoryW ReadFile SizeofResource FindFirstFileW WriteProcessMemory SetHandleInformation FindNextFileW GetCurrentProcess WriteFile RemoveDirectoryW GetModuleFileNameW CreatePipe SetErrorMode GetEnvironmentVariableW PeekNamedPipe GetTempPathW FindClose WaitForSingleObject CreateFileW GetFileAttributesW ResumeThread OpenProcess SetFileAttributesW CreateToolhelp32Snapshot GetExitCodeThread GetLastError Process32NextW LockResource DeleteFileW Process32FirstW CloseHandle LoadLibraryW LoadResource FindResourceW Module32FirstW GetProcAddress GlobalLock VirtualAllocEx LocalFree ExitProcess CreateProcessW GetModuleHandleW CreateRemoteThread Module32NextW VirtualFreeEx GetTickCount GlobalUnlock IsDebuggerPresent CheckRemoteDebuggerPresent FlushFileBuffers GetExitCodeProcess GetCurrentThreadId WideCharToMultiByte

ntdll

RtlCaptureContext RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry RtlVirtualUnwind

Name

.text

Size

260KB

Virtual Size

260KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

569KB

Virtual Size

568KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

NebulaInjector.exe

gdiplus

user32

gdi32

advapi32

ole32

oleaut32

kernel32

ntdll

generic