AzKaBaN-Injector[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
AzKaBaN-Injector.exe
Size 812KB
Sample260801-pggehavbph
SHA256 e0bc541c1e7b10753eef8881f6a0a9af9ee28a3ea47302baad6768839c5c25fe
MD5 b908a83ab97c7172acb6ddd8c84a7c3e
SHA1 cdc8be207e3e0200494986473b76551df41ab7ed
SHA512 a302eeb7441584374661e16dee917073f14507b5a68049eff8a2bf1fa07fbe2dcc956a74a007502d204cc86323bb6f474936ef5ee8312e27356b5680f3751a77
SSDEEP 6144:5rGRhMw4YH+8nutjxSZ24Tfpvf9DqUZhOI9hilxn:oRhMpB8eIHyiQShil
TLSH
T16305B656DAA66595C07BC03CD542952EF92038AA833952FF76C16E813FA17E4EF3D380
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AzKaBaN-Injector.exe

File Explorer

AzKaBaN-Injector.exe

.exe 812KB

AzKaBaN-Injector.exe

IMPHASH 2be26c2a75fb311e29a0830fcd428776
SHA256 e0bc541c1e7b10753eef8881f6a0a9af9ee28a3ea47302baad6768839c5c25fe
MD5 b908a83ab97c7172acb6ddd8c84a7c3e
SHA1 cdc8be207e3e0200494986473b76551df41ab7ed
SHA512 a302eeb7441584374661e16dee917073f14507b5a68049eff8a2bf1fa07fbe2dcc956a74a007502d204cc86323bb6f474936ef5ee8312e27356b5680f3751a77
SSDEEP 6144:5rGRhMw4YH+8nutjxSZ24Tfpvf9DqUZhOI9hilxn:oRhMpB8eIHyiQShil
TLSH
T16305B656DAA66595C07BC03CD542952EF92038AA833952FF76C16E813FA17E4EF3D380
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

230986

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Kia\source\repos\ConsoleApplication2\x64\Debug\ConsoleApplication2.pdb

kernel32

CreateToolhelp32Snapshot SetConsoleTitleW Process32NextW FreeLibrary SetConsoleTextAttribute SetConsoleOutputCP GetTickCount64 GetCurrentProcess Sleep CloseHandle Process32FirstW GetStdHandle VirtualQuery GetProcessHeap HeapFree HeapAlloc GetLastError GetModuleHandleW GetStartupInfoW InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WideCharToMultiByte MultiByteToWideChar RaiseException IsDebuggerPresent GetCurrentThreadId GetProcAddress

advapi32

RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey GetTokenInformation OpenProcessToken RegSetValueExW

shell32

ShellExecuteW

ole32

CoUninitialize CoTaskMemFree CoInitialize CoCreateInstance

msvcp140d

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?wcin@std@@3V?$basic_istream@_WU?$char_traits@_W@std@@@1@A ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ ?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ?uncaught_exception@std@@YA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ??0_Lockit@std@@QEAA@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z

vcruntime140d

__vcrt_GetModuleHandleW __current_exception_context __current_exception __std_type_info_destroy_list __C_specific_handler_noexcept __C_specific_handler memset memcmp memchr _CxxThrowException __std_exception_destroy __std_exception_copy memmove memcpy __vcrt_LoadLibraryExW __vcrt_GetModuleFileNameW

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

_set_new_mode __p__commode _free_dbg strcpy_s strcat_s __stdio_common_vsprintf_s _seh_filter_dll _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit terminate _wmakepath_s _wsplitpath_s wcscpy_s _register_thread_local_exe_atexit_callback exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv __setusermatherr _set_app_type _seh_filter_exe _CrtDbgReportW malloc _callnewh _rotl _CrtDbgReport _wcsicmp wcslen _configthreadlocale _c_exit _cexit __p___argc _exit _invoke_watson _set_fmode __p___argv

Name

.textbss

Size

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

459KB

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1024B

Virtual Size

584B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

232KB

Virtual Size

232KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

AzKaBaN-Injector.exe

kernel32

advapi32

shell32

ole32

msvcp140d

vcruntime140d

vcruntime140_1d

ucrtbased

generic