injector[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
injector.exe
Size 8.8MB
Sample260912-py6eysca79
SHA256 1a8b3d72d895d03b171c138ce4f22000e5c2efefd1c73073dac932c687739ce3
MD5 546f97c0ada80edf878b735b739892f0
SHA1 abdcdd3de2bd979dd8dae03304565800d29a9c5b
SHA512 75d2097f83cf5249d4597bd8f6fd124f27b364096717f10dbc3e74167b8ff689f3f98649a7cad2718b37026b7d04117960bf2557e50fae671acca4ebc9302aaa
SSDEEP 98304:ggOzuoNdBkhzrCpwvzHbbWVOJ3/O20xS7pgTPS3kEPq6ClCZnDgwBJ74MAl+x5lg:tM9KDqObkEPq6ClCZgWyMAl
TLSH
T100965C217B5B94BCC156C874C30B4A225E6570CB0B35B9FB74CC41393FAAAF81B39669
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
injector.exe

File Explorer

injector.exe

.exe 8.8MB

injector.exe

IMPHASH b85bb6c4894ad3aaedc81d9359f513e0
SHA256 1a8b3d72d895d03b171c138ce4f22000e5c2efefd1c73073dac932c687739ce3
MD5 546f97c0ada80edf878b735b739892f0
SHA1 abdcdd3de2bd979dd8dae03304565800d29a9c5b
SHA512 75d2097f83cf5249d4597bd8f6fd124f27b364096717f10dbc3e74167b8ff689f3f98649a7cad2718b37026b7d04117960bf2557e50fae671acca4ebc9302aaa
SSDEEP 98304:ggOzuoNdBkhzrCpwvzHbbWVOJ3/O20xS7pgTPS3kEPq6ClCZnDgwBJ74MAl+x5lg:tM9KDqObkEPq6ClCZgWyMAl
TLSH
T100965C217B5B94BCC156C874C30B4A225E6570CB0B35B9FB74CC41393FAAAF81B39669
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27056

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetConsoleTitleA GetCurrentProcess WriteFile GetModuleHandleExW TerminateProcess RemoveDirectoryW GetModuleFileNameW SetEnvironmentVariableW GetProcessId GetEnvironmentVariableW GetTempPathW WaitForSingleObject CreateFileW GetFileAttributesW GetSystemDirectoryW OpenProcess CreateToolhelp32Snapshot GetExitCodeThread Sleep GetTickCount64 CopyFileA GetLastError GetFileAttributesA LockResource SetLastError CloseHandle LoadResource FindResourceW Module32FirstW VirtualProtectEx GetProcAddress SetFilePointerEx VirtualAllocEx LocalFree MoveFileExW CreateProcessW GetModuleHandleW FreeLibrary FlushInstructionCache CreateRemoteThread Module32NextW QueryFullProcessImageNameW VirtualFreeEx LoadLibraryExW FlushFileBuffers GetExitCodeProcess SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId WriteProcessMemory GetFileSizeEx GetFileInformationByHandleEx SizeofResource GetModuleFileNameA ReadFile DeleteFileW CreateDirectoryW QueryPerformanceCounter IsProcessorFeaturePresent GetCurrentThreadId

user32

FindWindowA GetWindowThreadProcessId

advapi32

GetSidSubAuthority IsValidSid OpenProcessToken ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation GetSidSubAuthorityCount

shell32

ShellExecuteW

msvcp140

_Query_perf_counter ?_Xlength_error@std@@YAXPBD@Z _Query_perf_frequency

bcrypt

BCryptGenRandom

ws2_32

ioctlsocket WSAGetLastError WSACleanup closesocket select socket connect htons htonl WSAStartup getsockopt

vcruntime140

__std_exception_copy wcsrchr __std_exception_destroy __CxxFrameHandler3 memcpy memmove memset _CxxThrowException __current_exception __current_exception_context _except_handler4_common strrchr

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh free malloc

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfwprintf __p__commode _set_fmode puts __stdio_common_vfprintf

api-ms-win-crt-string-l1-1-0

wcscat_s _wcsicmp strcpy_s

api-ms-win-crt-runtime-l1-1-0

__p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback exit _initterm_e _initterm __p___argc _register_onexit_function _crt_atexit _controlfp_s terminate _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _initialize_onexit_table _exit _seh_filter_exe _set_app_type

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale