TF2Injector[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
TF2Injector.exe
Size 494KB
Sample260719-t3lcssht3v
SHA256 d386eb39d5e735507f7fcd44ce2bba4e95227f404e5d8f0c0c534a8074ffc8db
MD5 d91d89b8d07949ca591432ed7b91c665
SHA1 c76ce372e6ecac7d6d543e250ca101905c653f63
SHA512 1a30ba68a046c0bd56562c6603369cf50a793a2df7542cc739d5280745bda88e4db6d068907dcfb1cc5f32462c73c00224dfdb6306c768e0c494de74ef5b57d4
SSDEEP 6144:FXXrxBmUrAov3DfVOX2DuSnILSF9ACYJyLkQ0XqbAuiyKSGQH0e9y3yacWWF+/Bx:oeBww0HuJKS5H0OQyHw/BnnNe
TLSH
T160B47B45B2A402F9E16BC2B88E834906E772784A0761DBDF13E496B71F37AD45E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TF2Injector.exe

File Explorer

TF2Injector.exe

.exe 494KB

TF2Injector.exe

IMPHASH 5360ab6d7cde7eebdbfb7525008c4227
SHA256 d386eb39d5e735507f7fcd44ce2bba4e95227f404e5d8f0c0c534a8074ffc8db
MD5 d91d89b8d07949ca591432ed7b91c665
SHA1 c76ce372e6ecac7d6d543e250ca101905c653f63
SHA512 1a30ba68a046c0bd56562c6603369cf50a793a2df7542cc739d5280745bda88e4db6d068907dcfb1cc5f32462c73c00224dfdb6306c768e0c494de74ef5b57d4
SSDEEP 6144:FXXrxBmUrAov3DfVOX2DuSnILSF9ACYJyLkQ0XqbAuiyKSGQH0e9y3yacWWF+/Bx:oeBww0HuJKS5H0OQyHw/BnnNe
TLSH
T160B47B45B2A402F9E16BC2B88E834906E772784A0761DBDF13E496B71F37AD45E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

214336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\dxliv\Desktop\Xenos\build\x64\Release\TF2Injector.pdb

shell32

ShellExecuteW

kernel32

GetTickCount DeleteCriticalSection DecodePointer GetLastError Sleep InitializeCriticalSectionEx EnterCriticalSection GetCurrentProcess TerminateProcess LeaveCriticalSection InitializeCriticalSection ResumeThread CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle MultiByteToWideChar LocalFree GetModuleHandleW WideCharToMultiByte CreateActCtxW WriteFile GetTempPathW CreateFileW UnmapViewOfFile DeleteFileW GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetSystemTimeAsFileTime QueryPerformanceCounter Thread32Next Thread32First GetCurrentThreadId GetCurrentProcessId GetCurrentThread GetProcAddress CreateNamedPipeW TerminateThread GetNativeSystemInfo WaitForSingleObject DuplicateHandle ResetEvent GetExitCodeThread OpenProcess IsWow64Process GetEnvironmentVariableW GetWindowsDirectoryW WriteProcessMemory VirtualProtectEx GetThreadContext VirtualAllocEx ReadProcessMemory CreateRemoteThread VirtualFreeEx SetThreadContext VirtualQueryEx LoadLibraryW FreeLibrary GetModuleFileNameW DeviceIoControl SuspendThread GetThreadTimes OpenThread FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetFileInformationByHandleEx GetStringTypeW EncodePointer LCMapStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter ExitProcess GetModuleHandleExW GetStdHandle GetCommandLineA GetCommandLineW HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc IsValidCodePage GetACP GetOEMCP HeapSize GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx WriteConsoleW SetConsoleTitleW GetSystemInfo

user32

wsprintfW

ole32

CoCreateInstance CoUninitialize CoInitialize

shlwapi

SHDeleteKeyW

advapi32

OpenThreadToken RegOpenKeyExW RegQueryValueExW OpenProcessToken RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueW ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyW RegSetValueExW RegCreateKeyW

oleaut32

SysFreeString

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B