inject[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
inject.exe
Size 19KB
Sample260728-a5f2bavdnb
SHA256 7305d7a109b5e424cfe6c95b171ab98ab2aaf7d9f8b7603737bd1dc832d3960a
MD5 d29aa416e0d179aca5b17aa95780b428
SHA1 7d1fa8731f539956850b15860cbcea4e5d1926e4
SHA512 e6677914061d5bb5ae5aa77e4933d5bb212d43cc7fc1e6c25c6ac94c2c901ae0cf945ec97f2e4340cabd1c8de98fda428071c9fbfdf4a76bf3d5d8b4dc185e69
SSDEEP 384:gLLXFaju1/JHoC1dJ9M9EJdKiZCKeP33:+Aq1/JHoCjLJUt33
TLSH
T1E9927C87F71A04E9D226C27C89A75A18E172B44B07725BCF23A1C12D0FAA3C07D76E56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
inject.exe

File Explorer

inject.exe

.exe 19KB

inject.exe

IMPHASH 3f4af356f4291ae488101bc680b1598d
SHA256 7305d7a109b5e424cfe6c95b171ab98ab2aaf7d9f8b7603737bd1dc832d3960a
MD5 d29aa416e0d179aca5b17aa95780b428
SHA1 7d1fa8731f539956850b15860cbcea4e5d1926e4
SHA512 e6677914061d5bb5ae5aa77e4933d5bb212d43cc7fc1e6c25c6ac94c2c901ae0cf945ec97f2e4340cabd1c8de98fda428071c9fbfdf4a76bf3d5d8b4dc185e69
SSDEEP 384:gLLXFaju1/JHoC1dJ9M9EJdKiZCKeP33:+Aq1/JHoCjLJUt33
TLSH
T1E9927C87F71A04E9D226C27C89A75A18E172B44B07725BCF23A1C12D0FAA3C07D76E56
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\funny\source\repos\inject\x64\Release\inject.pdb

kernel32

OpenProcess CreateToolhelp32Snapshot GetExitCodeThread GetLastError Process32NextW GetModuleHandleA CloseHandle GetProcAddress VirtualAllocEx CreateRemoteThread VirtualFreeEx GetCurrentProcessId WaitForSingleObject GetCurrentProcess Process32FirstW WriteProcessMemory GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetModuleHandleW QueryPerformanceCounter

advapi32

LookupPrivilegeValueA OpenProcessToken AdjustTokenPrivileges

msvcp140

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?good@ios_base@std@@QEBA_NXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xlength_error@std@@YAXPEBD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy __current_exception_context __current_exception _CxxThrowException __std_terminate __std_exception_copy __std_exception_destroy memset __C_specific_handler

api-ms-win-crt-string-l1-1-0

_wcsicmp strlen

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback __p___argv __p___argc _exit _initialize_onexit_table _c_exit _crt_atexit terminate exit _initterm_e _initterm _register_onexit_function _get_initial_narrow_environment _cexit _configure_narrow_argv _initialize_narrow_environment _set_app_type _seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale