Inject[.]exe | Triage™

General

Target
Inject.exe
Size 292KB
Sample260709-th324sc13q
SHA256 55987eeebd3c06d82c7cecf440447dc28dbea76d4ee2fe8186bb2d513ec4e701
MD5 b99d80b6f31d5b8a299bbc040338aeb2
SHA1 4ee203bb50fad861e0557b0bddffb3452064dd26
SHA512 8e0f09286df1d91f8400e7edb4fbf5b2bb70d13eac25cf1585d9ab8298b3f4691edbd7a5936dc05aaac1d687fe66626d46599a08e37327463dbb417844c239d9
SSDEEP 6144:j6Q8dn/NLTtvG+Zwk2iZlUI2WtGhwjJGmy:j6fLTIJclUIfGhw
TLSH
T1DA548E15F7A910F9EA77C17CC9524505EA72BC464761EACF13A00AA63F23BD09E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Inject.exe

File Explorer

Inject.exe

.exe 292KB

Inject.exe

IMPHASH 2a884125ea850f2e34243f0eb503243a
SHA256 55987eeebd3c06d82c7cecf440447dc28dbea76d4ee2fe8186bb2d513ec4e701
MD5 b99d80b6f31d5b8a299bbc040338aeb2
SHA1 4ee203bb50fad861e0557b0bddffb3452064dd26
SHA512 8e0f09286df1d91f8400e7edb4fbf5b2bb70d13eac25cf1585d9ab8298b3f4691edbd7a5936dc05aaac1d687fe66626d46599a08e37327463dbb417844c239d9
SSDEEP 6144:j6Q8dn/NLTtvG+Zwk2iZlUI2WtGhwjJGmy:j6fLTIJclUIfGhw
TLSH
T1DA548E15F7A910F9EA77C17CC9524505EA72BC464761EACF13A00AA63F23BD09E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

54896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyExA

kernel32

WriteProcessMemory GetConsoleScreenBufferInfo SetConsoleTitleA SetConsoleScreenBufferSize GetStdHandle SetConsoleMode SetCurrentConsoleFontEx WaitForSingleObject ResumeThread GetModuleHandleA Sleep GetConsoleMode GetLastError GetFileAttributesA GetSystemDirectoryA CloseHandle VirtualProtectEx GetThreadContext GetProcAddress VirtualAllocEx ReadProcessMemory CreateProcessW GetConsoleWindow CreateProcessA SetThreadContext AllocConsole GetExitCodeProcess SetEndOfFile WriteConsoleW HeapSize CreateFileW GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent WriteFile GetModuleFileNameW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc HeapFree VirtualProtect LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP ReadFile ReadConsoleW IsValidCodePage GetACP GetOEMCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW RtlUnwind

user32

MessageBoxW GetClientRect GetDesktopWindow MoveWindow MessageBoxA

shell32

ShellExecuteW

Name

.text

Size

190KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Inject.exe

advapi32

kernel32

user32

shell32

generic