GH Injector SM - x64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
GH Injector SM - x64.exe
Size 43KB
Sample260709-b4c4psct5s
SHA256 27498dd23557d1d7e0090c6acc4deba0970dc805199d58ac58932563c2a083f6
MD5 f2f96c8dd68ff07644cf13d6a3be6e54
SHA1 e723aca4e748472643e745a07d9009a0abcdeb79
SHA512 9539d554c7d8bd2187271e5d940d3626ae2a8e096377485e0ebca34f7e6272ad59c3decf4eec5d15f4e3cf625dad105001ea5159f44b6a1ae69be47e47028bcb
SSDEEP 768:XmzeToRggozVGchZOZ2PlKswhJ/MttjX1crEJPxQ:XmzeT0oV6Z2b9TPxQ
TLSH
T169135A5B639A04E8E677A278E5939215C375B8410B61A3CF13E1C3920F237C1BEBA765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
GH Injector SM - x64.exe

File Explorer

GH Injector SM - x64.exe

.exe 43KB

GH Injector SM - x64.exe

IMPHASH 6eb757006a58677354186ba01d2bb7f5
SHA256 27498dd23557d1d7e0090c6acc4deba0970dc805199d58ac58932563c2a083f6
MD5 f2f96c8dd68ff07644cf13d6a3be6e54
SHA1 e723aca4e748472643e745a07d9009a0abcdeb79
SHA512 9539d554c7d8bd2187271e5d940d3626ae2a8e096377485e0ebca34f7e6272ad59c3decf4eec5d15f4e3cf625dad105001ea5159f44b6a1ae69be47e47028bcb
SSDEEP 768:XmzeToRggozVGchZOZ2PlKswhJ/MttjX1crEJPxQ:XmzeT0oV6Z2b9TPxQ
TLSH
T169135A5B639A04E8E677A278E5939215C375B8410B61A3CF13E1C3920F237C1BEBA765
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

3b:1e:f2:1d:97:ad:42:62:c9:5d:7e:55:04:40:70:e4:c6:07:70:0c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Guided Hacking

Chains

Feb 23, 2023

CN=Guided Hacking

Minor OS version

Major OS version

Entry point

19080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetModuleHandleW GetModuleFileNameW GetLastError DeleteFileW LoadLibraryW Sleep RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlCaptureContext

user32

GetWindowThreadProcessId IsWindowVisible GetWindowTextW EnumWindows SendMessageW GetClassNameW SetWindowsHookExW SetForegroundWindow UnhookWindowsHookEx

msvcp140

?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Xout_of_range@std@@YAXPEBD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??Bid@locale@std@@QEAA_KXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Xlength_error@std@@YAXPEBD@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy __std_terminate __std_exception_copy memchr memset __current_exception_context __current_exception _CxxThrowException __C_specific_handler __std_exception_destroy memmove

api-ms-win-crt-runtime-l1-1-0

_c_exit _set_app_type _cexit __p___wargv _exit _seh_filter_exe exit _initialize_onexit_table _register_onexit_function _crt_atexit terminate _invalid_parameter_noinfo_noreturn _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment __p___argc _configure_wide_argv _register_thread_local_exe_atexit_callback

api-ms-win-crt-convert-l1-1-0

strtoll strtol

api-ms-win-crt-stdio-l1-1-0

ungetc fgetc fread fwrite fgetpos _fseeki64 fsetpos setvbuf fflush fclose fputc __p__commode _set_fmode _get_stream_buffer_pointers

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free _callnewh

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale