injector[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
injector.exe
Size 186KB
Sample260814-v1devaxhjb
SHA256 bbf3820cd65fe12ed38e20d160d8d7f14eb14cba9d21608a4bc80f2849f4c641
MD5 e7d44f43b371d9ce941970b333600107
SHA1 9ee3c4730cee52f55edfab098a3b0164b87e2f8e
SHA512 e07b37046d3b8871ed03cb487bb37531c5122723593b0d918a40116ce48f33c244c1a194d145b5a8842a3dc4b2e592a946604d022f421f220773cf42d3e3e239
SSDEEP 3072:0eB25DD/nkotFqTYb5kDlb9yzBZj7YqB:BEnk5YbcqB
TLSH
T12214862932A900B1D1A6C079ED468757EDB07056133D65FF9281CAE9EF307ECAA3CE51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
injector.exe

File Explorer

injector.exe

.exe 186KB

injector.exe

IMPHASH 26a06f2958f6a194c7906a448d8f0c76
SHA256 bbf3820cd65fe12ed38e20d160d8d7f14eb14cba9d21608a4bc80f2849f4c641
MD5 e7d44f43b371d9ce941970b333600107
SHA1 9ee3c4730cee52f55edfab098a3b0164b87e2f8e
SHA512 e07b37046d3b8871ed03cb487bb37531c5122723593b0d918a40116ce48f33c244c1a194d145b5a8842a3dc4b2e592a946604d022f421f220773cf42d3e3e239
SSDEEP 3072:0eB25DD/nkotFqTYb5kDlb9yzBZj7YqB:BEnk5YbcqB
TLSH
T12214862932A900B1D1A6C079ED468757EDB07056133D65FF9281CAE9EF307ECAA3CE51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5521

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ktmw32

CommitTransaction CreateTransaction

user32

FindWindowA

kernel32

FreeLibrary VirtualQuery GetProcessHeap IsDebuggerPresent RaiseException GetStdHandle SetStdHandle CloseHandle Sleep ExitProcess AllocConsole GetConsoleMode SetConsoleMode WriteConsoleA SetConsoleTitleA OpenThread SuspendThread ResumeThread GetThreadId OpenProcess GetModuleHandleA CreateToolhelp32Snapshot Process32First Process32Next Thread32First Thread32Next CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetTempPathA GetTempFileNameA GetCurrentProcess VirtualProtectEx VirtualQueryEx GetProcAddress DeleteFileTransactedA CopyFileA DuplicateHandle VirtualAllocEx ReadProcessMemory WriteProcessMemory VirtualFreeEx MultiByteToWideChar WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW GetModuleHandleW GetLastError HeapAlloc HeapFree GetCurrentThreadId

msvcp140d

?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_alloc@std@@YAXXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??7ios_base@std@@QEBA_NXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ

vcruntime140d

__current_exception_context __current_exception __std_type_info_destroy_list __C_specific_handler_noexcept __vcrt_GetModuleFileNameW _CxxThrowException __std_exception_copy memset memmove memcpy __vcrt_GetModuleHandleW __C_specific_handler __vcrt_LoadLibraryExW __std_exception_destroy

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

_CrtDbgReportW _seh_filter_exe _set_app_type __setusermatherr _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _set_fmode __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _configthreadlocale _set_new_mode __p__commode _seh_filter_dll _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit malloc strcpy_s strcat_s __stdio_common_vsprintf_s terminate _wmakepath_s _wsplitpath_s wcscpy_s _callnewh _stricmp _CrtDbgReport _unlock_file _lock_file ungetc setvbuf fwrite _fseeki64 fsetpos fread fputc fgetpos fgetc fflush fclose _get_stream_buffer_pointers strlen _invoke_watson _malloc_dbg _free_dbg wcscmp _crt_at_quick_exit rand

Name

.text

Size

119KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

injector.exe

ktmw32

user32

kernel32

msvcp140d

vcruntime140d

vcruntime140_1d

ucrtbased

generic