Sxe Bypass Injector[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Sxe Bypass Injector.exe
Size 170KB
Sample260814-wvtejsfm21
SHA256 6f62b612374470f3ce89cc6d34a938c1477b83f3a798c53ba6915de9d86703ab
MD5 a75723732e976b6de3aadbde756d763f
SHA1 720b8fce05395377e0a0fddf3eccb0aeb783797d
SHA512 c80c7009fad01b9c755ad14718730e24e464dba1ef6d1f21609ebec4f3e8c731af0330433227e597e95c3f6283ca746319400ca5bb71c2c360974a71c4748ba0
SSDEEP 3072:ITVBOrvye8P7gox9kYS706mtC+x4aMrDcUfvkcWfXo0zvOykfddmwr6T8wz:IT48P8w2706mtXOaMfao0zOyk3rOz
TLSH
T12C040262768304A2DD53E1F529BA2BB547BDEE61131543D3B7CDEA2C0BBC2E0B8B1445
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Sxe Bypass Injector.exe

File Explorer

Sxe Bypass Injector.exe

.exe 170KB

Sxe Bypass Injector.exe

IMPHASH ce60b113d4bcd7e58f786ba732763822
SHA256 6f62b612374470f3ce89cc6d34a938c1477b83f3a798c53ba6915de9d86703ab
MD5 a75723732e976b6de3aadbde756d763f
SHA1 720b8fce05395377e0a0fddf3eccb0aeb783797d
SHA512 c80c7009fad01b9c755ad14718730e24e464dba1ef6d1f21609ebec4f3e8c731af0330433227e597e95c3f6283ca746319400ca5bb71c2c360974a71c4748ba0
SSDEEP 3072:ITVBOrvye8P7gox9kYS706mtC+x4aMrDcUfvkcWfXo0zvOykfddmwr6T8wz:IT48P8w2706mtXOaMfao0zOyk3rOz
TLSH
T12C040262768304A2DD53E1F529BA2BB547BDEE61131543D3B7CDEA2C0BBC2E0B8B1445
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

Sxe Bypass Injector.exe

Minor OS version

Major OS version

Entry point

18094

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\albay\Belgeler\Github\Sxe-Bypass-Injector\Release\Sxe Bypass Injector.pdb

kernel32

Process32First WriteProcessMemory SetConsoleTextAttribute SetConsoleTitleA GetStdHandle Module32Next GetProcessId K32GetModuleFileNameExW Thread32Next GetFullPathNameA Thread32First SuspendThread ResumeThread OpenProcess CreateToolhelp32Snapshot Sleep LoadLibraryA Process32Next CloseHandle GetThreadContext VirtualAllocEx VirtualFreeEx SetThreadContext OpenThread GetExitCodeProcess SetUnhandledExceptionFilter GetModuleHandleW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent UnhandledExceptionFilter

user32

GetWindowThreadProcessId GetWindow IsWindowVisible GetWindowTextA SetWindowTextA GetTopWindow GetWindowTextLengthA

msvcp140

?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xout_of_range@std@@YAXPBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ?_Xlength_error@std@@YAXPBD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ??Bid@locale@std@@QAEIXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??0_Lockit@std@@QAE@H@Z ??1_Lockit@std@@QAE@XZ ?uncaught_exception@std@@YA_NXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ

vcruntime140

_except_handler4_common memset __current_exception_context __current_exception memcpy memchr _CxxThrowException __CxxFrameHandler3 __std_exception_destroy __std_exception_copy __std_terminate memmove

api-ms-win-crt-stdio-l1-1-0

_fseeki64 fputc __p__commode fsetpos ungetc setvbuf fgetpos fwrite _set_fmode fread _get_stream_buffer_pointers __stdio_common_vfprintf fgetc fclose fflush __acrt_iob_func fopen

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e exit _exit _configure_narrow_argv _get_initial_narrow_environment __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _initialize_narrow_environment _initialize_onexit_table _register_onexit_function __p___argc _crt_atexit system _controlfp_s terminate _invalid_parameter_noinfo_noreturn

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode _callnewh

api-ms-win-crt-string-l1-1-0

_stricmp

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

Sxe Bypass Injector.exe

kernel32

user32

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic