injection.7z
- SHA256 eddc6c5adddbebf10a6ae090194cd8b352706ec53c44963a142ecaf3c00204b4
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Vape421Injector.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral2
Sample
Vape421Injector.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
Behavioral task
behavioral3
Sample
Vape421Native.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
Vape421Native.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
General
- Target injection.7z
- Size 22.2MB
- Sample260815-1f26csvvev
- SHA256 eddc6c5adddbebf10a6ae090194cd8b352706ec53c44963a142ecaf3c00204b4
- MD5 3ac3cf95b67a6834bc070b0a75f9282b
- SHA1 e7ade98d5f6dcd6c5ff40911d991df097e08e9ef
- SHA512 18c621a02fcc10922a2f0e65c7ca8dada3da94a37870357dd3804f9b8a12f7cbb404c4b8ef07cb3c799d5efe64b3f4a0c94f2e37f61d2aacf54cc1c09cdafc63
- SSDEEP 393216:7UdM1V6HcQZZCanAclh1p/3jTFGUgkDBltx+kcDwLL/zmJixJrWQLbZuUo:WiVicQZn3h1p/3jTFGmn+kccLWJ0ZPvw
- TLSH T11E37339F7F0B6C4A908313A3305D92A2431FDDB3B1E063954EDCE4DDA2EF2BA1515869
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Vape421Injector.exe unpack001/Vape421Native.dll
File Explorer
-
injection.7z.7z 22.2MB
-
Vape421Injector.exe.exe 19KB
-
Vape421Native.dll.dll 23.3MB
-
vape421-native.log8KB
Vape421Injector.exe
- IMPHASH 52c0eaebbe48554d7678e56077f8b882
- SHA256 63a18f7ecc706f1a74d3208bed5091a5b70b348d5c63d3494f837a5aec1aa620
- MD5 a0c993658d9f87bd65a9f7bcb110166e
- SHA1 81902fcac89d11fd1412b50ad10694087a472bac
- SHA512 5530ef2d560d1ce30c491d6378c9b9559a19e87fda8cb79d95f49656ed3847fce34b5d27e5b0d682d5055967abc0b39ab81a4ffec6ea2567e3bd727fe72ad88e
- SSDEEP 384:n71trhY+ENTYhYc0c5Rb7trk3pB7we7gne:n73ydYhZdmzbse
- TLSH T1A8921A46FBFA14DAF57AD63689725136A6B1791B2B328ADF0354801C0D727D0EC34F46
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
9360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetStdHandle
GetFileAttributesW
GetFullPathNameW
CloseHandle
GetLastError
WaitForSingleObject
Sleep
CreateRemoteThread
OpenProcess
GetTickCount64
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
IsWow64Process
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LocalFree
FormatMessageW
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Module32FirstW
Module32NextW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
QueryPerformanceCounter
user32
IsWindowVisible
GetWindowTextW
GetWindowTextLengthW
EnumWindows
GetWindowThreadProcessId
vcruntime140
__C_specific_handler
memset
wcsrchr
__current_exception
__current_exception_context
memcpy
api-ms-win-crt-string-l1-1-0
_wcsicmp
wcscpy
wcslen
wcsncpy
api-ms-win-crt-conio-l1-1-0
_getwch
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_kbhit
__p__commode
_set_fmode
__stdio_common_vfwprintf
fflush
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
wcstoul
api-ms-win-crt-runtime-l1-1-0
_initterm_e
exit
_initterm
_get_initial_wide_environment
__p___argc
__p___wargv
_initialize_wide_environment
_c_exit
_register_thread_local_exe_atexit_callback
_configure_wide_argv
_set_app_type
_exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_seh_filter_exe
_cexit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
588B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35721,
count=4, id=259, version=35721,
count=10, id=260, version=35721,
count=19, id=261, version=35721,
count=5, id=257, version=33145,
count=88, id=1, productName=Unmarked objects,
count=1, id=260, version=36252,
count=1, id=255, version=36252,
count=1, id=258, version=36252,
Vape421Native.dll
- IMPHASH 2628d709222f2224fbbfed713eae5df5
- SHA256 4e91b0d326789c94f7399692f168a30143341c5ca2b7f7ef3ffb79272ba4dd46
- MD5 7f31918b3fd3e7359adeab269d6bee72
- SHA1 391f69ddad2cac3875daa548d6193838d2deea30
- SHA512 b5855b238089cea2ba96269eaef73e3df395a9898d31cf5f8b0a83951db90f0cbb179bbc990ecf22928e46e38bbff45328a193a5109ca7ad42d6659a042ca3d2
- SSDEEP 393216:YFh51DlSeJun7l7kd1JaGZJqryJg8ssMTlJAkbvKJf1B//nBqVHZ:Yv5hJulkd1gGZ79ssMTDACiND/UH
- TLSH T1BA372293E8E9643EEABB5136628402377E3E87D8E50748D414B87DD254B7C8E4F603AD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
29120
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
user32
DispatchMessageW
PeekMessageW
PostMessageW
DefWindowProcW
CallWindowProcW
IsWindow
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetAsyncKeyState
GetKeyNameTextA
GetWindowThreadProcessId
GetClassNameW
EnumWindows
SetWindowLongPtrW
ScreenToClient
GetCursorPos
GetForegroundWindow
MapVirtualKeyA
TranslateMessage
ws2_32
connect
htonl
htons
recv
send
closesocket
WSACleanup
WSAStartup
socket
shutdown
setsockopt
kernel32
InitOnceExecuteOnce
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
AcquireSRWLockShared
ReleaseSRWLockShared
GetProcessHeap
HeapFree
HeapAlloc
SetLastError
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
OpenEventW
SetEvent
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SetEnvironmentVariableA
FindResourceW
SizeofResource
LockResource
LoadResource
GetProcAddress
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameW
FreeLibraryAndExitThread
CreateDirectoryW
CreateFileW
DeleteFileW
FlushFileBuffers
WriteFile
GetTempPathW
OutputDebugStringW
CloseHandle
GetLastError
Sleep
GetCurrentProcessId
CreateThread
GetLocalTime
DisableThreadLibraryCalls
vcruntime140
__C_specific_handler
__std_type_info_destroy_list
memset
wcsrchr
memcpy
memchr
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnwprintf_s
fclose
__stdio_common_vsnprintf_s
fputws
_wfopen_s
api-ms-win-crt-string-l1-1-0
strlen
strncmp
strcpy_s
strcmp
wcslen
api-ms-win-crt-heap-l1-1-0
calloc
free
api-ms-win-crt-runtime-l1-1-0
_cexit
_initterm
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_initterm_e
JNI_OnLoad
JNI_OnUnload
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
23.2MB
Virtual Size
23.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35721,
count=4, id=259, version=35721,
count=8, id=260, version=35721,
count=12, id=261, version=35721,
count=7, id=257, version=33145,
count=113, id=1, productName=Unmarked objects,
count=3, id=260, version=36252,
count=1, id=256, version=36252,
count=1, id=255, version=36252,
count=1, id=151,
count=1, id=258, version=36252,
vape421-native.log
- SHA256 af770d90e77ccee4fe71d129208912f7c34e6120e9337d0eeaa9dd6f40a297c9
- MD5 7fe9039a7903308e82ce3bb030870ef7
- SHA1 24aa1aa68c52d121ad9fce5369208ac82f2fd835
- SHA512 e4d1f6f552f193c7e74a4b6c3632e899e5376f8ca1c88c32f7344c14069404546a45516d89f527e81d68cbdd4cb5107cc46e8f62105b8c0c27df50ebd51b33dc
- SSDEEP 192:rjVTPjhR+PAPjwoR88PBPjwoR88PY48+g:rj1bhw4bwo+8pbwo+8g48p
- TLSH T1BF02C04F454A34B35B5280F48276C395F2B3EAB0561B30E1D94A424C3991DEEDE8F1EA
- MD5 SHA1 SHA512 SSDEEP TLSH