injector[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
injector.exe
Size 32KB
Sample260710-cnspwsb19j
SHA256 c0740529d197d8f043e0e849daacf504b53b189214be801550816e02f4f2b588
MD5 4b67603126438397aca5f215c551f314
SHA1 8ad3f175b5cd41feec46b200b6620ee52d12684e
SHA512 52c90af9035ee55f3e86a20ee15e4acd0c5b9edecafe8f409399938fddad9b2154d51219ab2f2ec6c0abc0cdc64687bf24b73e54542bc8cabb0bfa25a1d23f67
SSDEEP 384:wxY5DN/F1HmFQ88nJV/niSq0likiID5qWqARVxmU+MLe7kAyx3UglMnD:9d1GB8nJV/nxq0lyocxAYUAk53Ue
TLSH
T11FE27205DA22C3B9D01AC3768E77122675F67C1E8372696B93D053311E71B60BB2AB8D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
injector.exe

File Explorer

injector.exe

.exe 32KB

injector.exe

IMPHASH b306602be5a64f8e462ab8fb902dbb33
SHA256 c0740529d197d8f043e0e849daacf504b53b189214be801550816e02f4f2b588
MD5 4b67603126438397aca5f215c551f314
SHA1 8ad3f175b5cd41feec46b200b6620ee52d12684e
SHA512 52c90af9035ee55f3e86a20ee15e4acd0c5b9edecafe8f409399938fddad9b2154d51219ab2f2ec6c0abc0cdc64687bf24b73e54542bc8cabb0bfa25a1d23f67
SSDEEP 384:wxY5DN/F1HmFQ88nJV/niSq0likiID5qWqARVxmU+MLe7kAyx3UglMnD:9d1GB8nJV/nxq0lyocxAYUAk53Ue
TLSH
T11FE27205DA22C3B9D01AC3768E77122675F67C1E8372696B93D053311E71B60BB2AB8D
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Fortn\Desktop\injector\Payson-Injector-main\x64\Release\payson1337.pdb

kernel32

DeviceIoControl CreateFileW CloseHandle ReadFile VirtualFree GetCurrentProcess VirtualAlloc GetModuleHandleA CreateToolhelp32Snapshot Process32NextW LoadLibraryA Process32FirstW K32GetModuleInformation GetFileSize Sleep SetConsoleTitleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetModuleHandleW QueryPerformanceCounter

user32

SetWinEventHook EnumWindows GetWindowThreadProcessId FindWindowA GetAsyncKeyState UnhookWinEvent

msvcp140

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?good@ios_base@std@@QEBA_NXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __std_exception_destroy _CxxThrowException memset __current_exception_context __current_exception __std_terminate __std_exception_copy memcpy

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode _set_fmode __stdio_common_vfprintf

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

__p___argc _initialize_onexit_table _exit _cexit _crt_atexit terminate exit _register_thread_local_exe_atexit_callback _initterm_e __p___argv _initialize_narrow_environment _configure_narrow_argv _c_exit _set_app_type _seh_filter_exe _initterm _register_onexit_function system _get_initial_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale