injector[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
injector.exe
Size 230KB
Sample260730-sg2bfsbd74
SHA256 47f88cda21e94ddb93a26e8854b6c254bf444ce23f310774716d59091bd0809e
MD5 41f0573731fde404d30112c4981fd2c5
SHA1 4d025b7d6778982c9b243eaab2f9769f31c73f11
SHA512 c7bbea6769e6d3555be651155329385c90f951890d80bf1759f961dbceef3a32e7153ffce3018fadf986538a9aeb48dfe5bb52f8a6f2b188a968161bd2356c2a
SSDEEP 3072:hhhKF8OXZq4M1euQJpuDEW2KTVZEG0ZBA/Id2gTjvrqlwO9OQnt9/c1FGQ:hhwF8OXZq4M1XdgW3/YQSTqOK/cDGQ
TLSH
T1C3343A2129A9C8BFE77A6A30D5C26C0DDABBB8E04770E9CF13405DD648636D4FB35606
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
injector.exe

File Explorer

injector.exe

.exe 230KB

injector.exe

IMPHASH 167cffee0fd44d548acb0adaf434cd40
SHA256 47f88cda21e94ddb93a26e8854b6c254bf444ce23f310774716d59091bd0809e
MD5 41f0573731fde404d30112c4981fd2c5
SHA1 4d025b7d6778982c9b243eaab2f9769f31c73f11
SHA512 c7bbea6769e6d3555be651155329385c90f951890d80bf1759f961dbceef3a32e7153ffce3018fadf986538a9aeb48dfe5bb52f8a6f2b188a968161bd2356c2a
SSDEEP 3072:hhhKF8OXZq4M1euQJpuDEW2KTVZEG0ZBA/Id2gTjvrqlwO9OQnt9/c1FGQ:hhwF8OXZq4M1XdgW3/YQSTqOK/cDGQ
TLSH
T1C3343A2129A9C8BFE77A6A30D5C26C0DDABBB8E04770E9CF13405DD648636D4FB35606
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

46816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetProcAddress VirtualAllocEx GetCurrentProcessId IsWow64Process GetModuleFileNameA Sleep VirtualFreeEx CreateMutexA ReleaseMutex ReadProcessMemory VirtualQueryEx K32EnumProcessModulesEx MultiByteToWideChar K32GetModuleBaseNameA LocalFree GetCurrentProcess QueryPerformanceCounter VirtualProtectEx DuplicateHandle Thread32Next Thread32First SuspendThread ResumeThread VirtualQuery OpenThread CreateThread CloseHandle Process32FirstW Process32NextW CreateToolhelp32Snapshot OpenProcess GetModuleHandleA WaitForSingleObject GetModuleHandleW GetLastError AreFileApisANSI CreateFile2 GetFileAttributesExW FindFirstFileW FindClose GetCurrentDirectoryW WriteProcessMemory WideCharToMultiByte FormatMessageA GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetFileInformationByHandleEx

advapi32

OpenProcessToken GetTokenInformation

msvcp140

?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Xbad_alloc@std@@YAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xinvalid_argument@std@@YAXPEBD@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

ntdll

NtQueryInformationProcess NtUnmapViewOfSection NtQueryObject

bcrypt

BCryptGetProperty BCryptCreateHash BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider BCryptHashData

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy __std_exception_destroy __C_specific_handler memcpy memmove memset __current_exception __current_exception_context _CxxThrowException

api-ms-win-crt-string-l1-1-0

strlen strcmp _stricmp strncmp _wcsicmp

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc _callnewh

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode _get_stream_buffer_pointers _fseeki64 fread puts ungetc setvbuf fgetpos __stdio_common_vsprintf fwrite fgetc fclose fflush fputc __stdio_common_vsprintf_s fsetpos

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc _set_app_type _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _register_onexit_function _initialize_onexit_table _initialize_narrow_environment terminate _configure_narrow_argv abort _cexit __p___argv _crt_atexit _errno

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr