AerialInjector[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
AerialInjector.exe
Size 493KB
Sample260809-ts814shr31
SHA256 4b83aa524d01ebd8b2d2bff05969057d9a9b4b8e593a78160a382dce96db6a53
MD5 7651532c7d8ea53eabb1cbd0f52d5ef1
SHA1 a73187dd1ce7da56ed140d1a44ff774b4bcc5545
SHA512 76dbf6041911b28bf8114aa85155b54ce743e5f0e4bd50db96ed96e0b0b21491679741a3b96b2da09e0937fd77702089a238026e05604c0a8e2d0108b0b45b8c
SSDEEP 6144:rMuigtNmh1E+eIFqehdS5Idv+hZ5fKUMmfph0lhSMXlBXBWfOxVxA:RsMeAwv+hbKUMmfph0lhSMXl+MA
TLSH
T186B4AF95B3E443F9E16BC178C9524A45EB727C864791A7CF03A44AB62F236D24E3F702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AerialInjector.exe

File Explorer

AerialInjector.exe

.exe 493KB

AerialInjector.exe

IMPHASH 0208fbcef0437ca2125b429c7f2d31ce
SHA256 4b83aa524d01ebd8b2d2bff05969057d9a9b4b8e593a78160a382dce96db6a53
MD5 7651532c7d8ea53eabb1cbd0f52d5ef1
SHA1 a73187dd1ce7da56ed140d1a44ff774b4bcc5545
SHA512 76dbf6041911b28bf8114aa85155b54ce743e5f0e4bd50db96ed96e0b0b21491679741a3b96b2da09e0937fd77702089a238026e05604c0a8e2d0108b0b45b8c
SSDEEP 6144:rMuigtNmh1E+eIFqehdS5Idv+hZ5fKUMmfph0lhSMXlBXBWfOxVxA:RsMeAwv+hbKUMmfph0lhSMXl+MA
TLSH
T186B4AF95B3E443F9E16BC178C9524A45EB727C864791A7CF03A44AB62F236D24E3F702
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

121276

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW SetEntriesInAclW GetNamedSecurityInfoW SetNamedSecurityInfoW ConvertStringSidToSidW OpenProcessToken

winhttp

WinHttpOpenRequest WinHttpCrackUrl WinHttpQueryHeaders WinHttpReceiveResponse WinHttpOpen WinHttpSendRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

kernel32

SetEndOfFile WriteConsoleW HeapSize GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcess CreateRemoteThread GetExitCodeThread OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleFileNameW GetModuleHandleW GetProcAddress LocalFree CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW ReadConsoleW FormatMessageA GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW GetTempPathW AreFileApisANSI GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx RtlUnwind

Name

.text

Size

254KB

Virtual Size

254KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

215KB

Virtual Size

214KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

664B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

AerialInjector.exe

advapi32

winhttp

shell32

ole32

kernel32

generic