WaveInjector[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
WaveInjector.exe
Size 11.2MB
Sample260929-wnd2aa1bpc
SHA256 7492fc0677a6efe064917ab54f62118da875a5690ee324d796a8f48c1881ca6f
MD5 6b773d1427de2727105172c9e88e2f5f
SHA1 ac57cf012fbed8f43d1b7ba8758eba8818b06db8
SHA512 7e87ae39af8edda25700d7e1a29d3e708d68f62493188ce72ca73f60d45402f3274b1bec85fadf72dd9b609ee59e803fa253dbf69dedec8a7701cc2621dc4027
SSDEEP 196608:SCmWV5e61qbWIR+PUXG8xzZ10SZ/+4q0LiXLYcqyxWjsnntjO:BfVjqqIR+s2Q3dZ/I0vcE8ntj
TLSH
T1C1C612C578D5C2FCC845CA70E64529FDF0EE78898CBC952ABF8A88123571D55C8B9B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WaveInjector.exe

File Explorer

WaveInjector.exe

.exe 11.2MB

WaveInjector.exe

IMPHASH 46fb25a67806ac94a11bbf2e83f10905
SHA256 7492fc0677a6efe064917ab54f62118da875a5690ee324d796a8f48c1881ca6f
MD5 6b773d1427de2727105172c9e88e2f5f
SHA1 ac57cf012fbed8f43d1b7ba8758eba8818b06db8
SHA512 7e87ae39af8edda25700d7e1a29d3e708d68f62493188ce72ca73f60d45402f3274b1bec85fadf72dd9b609ee59e803fa253dbf69dedec8a7701cc2621dc4027
SSDEEP 196608:SCmWV5e61qbWIR+PUXG8xzZ10SZ/+4q0LiXLYcqyxWjsnntjO:BfVjqqIR+s2Q3dZ/I0vcE8ntj
TLSH
T1C1C612C578D5C2FCC845CA70E64529FDF0EE78898CBC952ABF8A88123571D55C8B9B32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18441444

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Sleep EnterCriticalSection LeaveCriticalSection GetProcAddress GetModuleHandleA ReadFile GetCurrentProcess RtlAddFunctionTable GetCurrentThreadId CreateFileA LoadLibraryA CloseHandle K32GetModuleInformation GetFileSize GetCurrentProcessId FlushInstructionCache GetSystemTimeAsFileTime QueryPerformanceCounter Module32Next Thread32Next Thread32First Module32First CreateToolhelp32Snapshot VirtualProtect InitializeCriticalSection SetUnhandledExceptionFilter InitializeSListHead GetStartupInfoW GetModuleHandleW

user32

FindWindowExA IsWindowVisible GetWindowThreadProcessId

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __current_exception_context memset _CxxThrowException __std_exception_destroy __current_exception memmove memcpy memcmp __std_exception_copy

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh free malloc

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-string-l1-1-0

strlen _wcsicmp

api-ms-win-crt-runtime-l1-1-0

_c_exit _cexit _exit _initialize_onexit_table _register_onexit_function _crt_atexit exit terminate _initterm_e _initterm _get_narrow_winmain_command_line _seh_filter_exe _register_thread_local_exe_atexit_callback _set_app_type _configure_narrow_argv _initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

ceilf __setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

Virtual Size

158KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

640B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

6.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.themida

Size

1024B

Virtual Size

720B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

11.2MB

Virtual Size

11.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

172B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

WaveInjector.exe

kernel32

user32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic