inj[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
inj.exe
Size 55KB
Sample260801-2mb37ayeph
SHA256 8072938a42757db90032185c4890b011123da399c2505a7667a596126ebe9a89
MD5 6e41e128fd91931933f0e24045e32d51
SHA1 22c0279ecec323e0833f1385541ddeba1b57e66c
SHA512 610040a1237aa867276b81e7c6e6d2a1ac0ce3af2db0d264c0722e76508f984e73056d60fed2b48ed8ac32c38500d61816ec25f9f8b30b4f9adc76244690cfde
SSDEEP 768:yXDwG2y1xWFnADrJW8X2zKGx/olP5aP3B0Gt7BHlRR5HPjYd3vEueE:yzwGPrJW86bx8PMPeGpZR5vTE
TLSH
T1E0434C53EB6804ECE07AD3BDD6A78B86EB72F406032157CF0750921A0F1B9D56D7EA11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
inj.exe

File Explorer

inj.exe

.exe 55KB

inj.exe

IMPHASH 992d30b804fd64e113fc1c4a02104386
SHA256 8072938a42757db90032185c4890b011123da399c2505a7667a596126ebe9a89
MD5 6e41e128fd91931933f0e24045e32d51
SHA1 22c0279ecec323e0833f1385541ddeba1b57e66c
SHA512 610040a1237aa867276b81e7c6e6d2a1ac0ce3af2db0d264c0722e76508f984e73056d60fed2b48ed8ac32c38500d61816ec25f9f8b30b4f9adc76244690cfde
SSDEEP 768:yXDwG2y1xWFnADrJW8X2zKGx/olP5aP3B0Gt7BHlRR5HPjYd3vEueE:yzwGPrJW86bx8PMPeGpZR5vTE
TLSH
T1E0434C53EB6804ECE07AD3BDD6A78B86EB72F406032157CF0750921A0F1B9D56D7EA11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33304

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\forlo\source\repos\EludornInjector\x64\Release\Injector.pdb

kernel32

WriteProcessMemory SetConsoleTitleA GetStdHandle WriteConsoleA SetConsoleMode WaitForSingleObject GetModuleHandleA Sleep GetConsoleMode LoadLibraryA CloseHandle SetStdHandle FlushConsoleInputBuffer GetProcAddress ReadProcessMemory AllocConsole GetFileAttributesExW FindFirstFileW GetLocaleInfoEx FormatMessageA LocalFree VirtualFreeEx VirtualAllocEx GetThreadId Process32Next OpenProcess Process32First OpenThread DuplicateHandle ResumeThread SuspendThread Thread32First Thread32Next VirtualQueryEx GetTempFileNameA VirtualProtectEx DeleteFileA CreateFileA CopyFileA GetTempPathA CreateToolhelp32Snapshot FindClose FindNextFileA DeleteFileTransactedA GetCurrentProcess FindFirstFileA AreFileApisANSI GetLastError GetModuleHandleW GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter CreateFile2

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Winerror_map@std@@YAHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Xtime_get_ticks ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ

ktmw32

CommitTransaction CreateTransaction

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __std_exception_destroy __std_exception_copy memset __current_exception_context __current_exception memmove __C_specific_handler memcpy

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-time-l1-1-0

strftime _localtime64_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s fputc fflush fclose __p__commode _set_fmode _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc fgetc setvbuf fgetpos fwrite

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-string-l1-1-0

strlen _stricmp

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e abort _seh_filter_exe exit _exit __p___argc __p___argv _set_app_type _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _get_initial_narrow_environment terminate _cexit _configure_narrow_argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

user32

FindWindowA