injection.zip
- SHA256 9158596226ef1c26925b51a100d498097c30d458db53fafaafcf70f85c0a89a9
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Vape421Injector.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral2
Sample
Vape421Injector.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral3
Sample
Vape421Native.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
Vape421Native.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
General
- Target injection.zip
- Size 20.2MB
- Sample260809-zwxedace49
- SHA256 9158596226ef1c26925b51a100d498097c30d458db53fafaafcf70f85c0a89a9
- MD5 0faa122aa12347592fab97ae40d2674a
- SHA1 1b80d4eb4db42fb24a4b4f92761f7d5cff52341f
- SHA512 0e644915b5b7d194c27e80e89c7d9baecf16479091c875de7869925b01375f47d3541258ef894fae3da0a2b1a6b1d14a877ea7107f3950fefe8286ca1229e8b3
- SSDEEP 393216:D9K36bpYXNXNA87BrTYq4L6tZrS9U3enPXVMGylc+4k29Y:pK36bpYJu8trV4L6tc/CG+z29Y
- TLSH T1342733BC357A5C46A7EF779E5376F2931C128D2122B0CCDAA38440CAB3499D2057B76E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Vape421Injector.exe unpack001/Vape421Native.dll
File Explorer
-
injection.zip.zip 20.2MB
-
Vape421Injector.exe.exe 19KB
-
Vape421Native.dll.dll 21.2MB
Vape421Injector.exe
- IMPHASH 5b1555628e9e584768dddfb3474e9316
- SHA256 5c3783cd45e9d6f0b4e1a78f59497f581e92a15cc70e75f6b384126cd2e66dad
- MD5 9863da69732b0ee71e233d99c5cb711e
- SHA1 a287e9699ee7e086910635000ce00b48f9efa9b4
- SHA512 c8929ad71e2e90175a30a67abcba1dfe848f2e225a945c0c7e774e1b9d35d040e847c96ec82ca8ca720e910986985c0e76fa9632fd776173c61266defb24d1d5
- SSDEEP 384:/A/ECKdlD2yMHBax+MeUhWNGHb7trkUHwdfnz7e91Fz:/A/GdlavBk+MeUTJSnk1
- TLSH T1AD923A467BF524D9E1BBE6328C32B136E67178165B33868F0358801C0EB2B90AD79F47
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
8976
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetStdHandle
GetFileAttributesW
GetFullPathNameW
CloseHandle
GetLastError
WaitForSingleObject
Sleep
CreateRemoteThread
OpenProcess
GetTickCount64
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
IsWow64Process
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LocalFree
FormatMessageW
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Module32FirstW
Module32NextW
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlCaptureContext
user32
IsWindowVisible
GetWindowTextW
GetWindowTextLengthW
EnumWindows
GetWindowThreadProcessId
vcruntime140
memset
memcpy
__C_specific_handler
__current_exception
__current_exception_context
wcsrchr
api-ms-win-crt-string-l1-1-0
wcscpy
wcslen
wcsncpy
_wcsicmp
api-ms-win-crt-conio-l1-1-0
_getwch
api-ms-win-crt-stdio-l1-1-0
fflush
__p__commode
__acrt_iob_func
_set_fmode
_kbhit
__stdio_common_vfwprintf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
wcstoul
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_c_exit
_exit
_seh_filter_exe
exit
_initialize_onexit_table
_cexit
_crt_atexit
terminate
_set_app_type
_initterm_e
__p___wargv
_initterm
_get_initial_wide_environment
_configure_wide_argv
_register_onexit_function
__p___argc
_initialize_wide_environment
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
600B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35207,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=19, id=261, version=35207,
count=5, id=257, version=33145,
count=96, id=1, productName=Unmarked objects,
count=1, id=260, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
Vape421Native.dll
- IMPHASH 9b55a896b8e7b2854cb7692d5270dd76
- SHA256 02b0efeee7e8a8a2ac1b5356c3cc81eeb6346e0d09c95fd54aff46d199e6c232
- MD5 e13e46d923d237dd94531285dc494ed7
- SHA1 a5c6aa819f784a7490aae95e6c21b06f8d6da7ad
- SHA512 fc668129a864e95a7676b0965be165af89d92f3da680ae546cfd28d5d4f7261e8fbbd90fb23936ed3ce25f933599cfa244767daf05cc0eb582d8a19703741002
- SSDEEP 393216:dUarwZxfXr9Vn4F28rJaGX8s2MvsCA09v9LhJff1IBqVHz:dvrw79Vn8rgGss2MvFAIll11VH
- TLSH T170271293E8E8643EEABB613722940277BE3EA7C8E10750D414B975D298B7C8D4F5039D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
27876
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
user32
GetKeyNameTextA
GetAsyncKeyState
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
IsWindow
CallWindowProcW
DefWindowProcW
PostMessageW
PeekMessageW
DispatchMessageW
GetWindowThreadProcessId
GetClassNameW
EnumWindows
SetWindowLongPtrW
ScreenToClient
GetCursorPos
GetForegroundWindow
TranslateMessage
MapVirtualKeyA
ws2_32
connect
closesocket
htons
recv
WSACleanup
send
setsockopt
shutdown
socket
WSAStartup
htonl
kernel32
OpenFileMappingW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
GetProcessHeap
HeapFree
HeapAlloc
SetLastError
UnmapViewOfFile
MapViewOfFile
OpenEventW
SetEvent
InitOnceExecuteOnce
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SetEnvironmentVariableA
FindResourceW
SizeofResource
LockResource
CreateDirectoryW
CreateFileW
DeleteFileW
FlushFileBuffers
WriteFile
GetTempPathW
OutputDebugStringW
CloseHandle
GetLastError
Sleep
GetCurrentProcessId
CreateThread
GetLocalTime
DisableThreadLibraryCalls
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
LoadResource
vcruntime140
memchr
memset
__C_specific_handler
__std_type_info_destroy_list
memcpy
wcsrchr
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnwprintf_s
fputws
fclose
__stdio_common_vsnprintf_s
_wfopen_s
api-ms-win-crt-string-l1-1-0
strlen
wcscmp
strcpy_s
strcmp
wcslen
api-ms-win-crt-heap-l1-1-0
calloc
free
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_execute_onexit_table
_initialize_narrow_environment
_cexit
_configure_narrow_argv
_seh_filter_dll
_initterm
_initterm_e
JNI_OnLoad
JNI_OnUnload
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
21.2MB
Virtual Size
21.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
124B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35207,
count=4, id=259, version=35207,
count=8, id=260, version=35207,
count=12, id=261, version=35207,
count=7, id=257, version=33145,
count=118, id=1, productName=Unmarked objects,
count=3, id=260, version=35228,
count=1, id=256, version=35228,
count=1, id=255, version=35228,
count=1, id=151,
count=1, id=258, version=35228,