Injector (3)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Injector (3).exe
Size 70KB
Sample261003-lasbmswzhy
SHA256 7500d627aafa8cfc35b182a6f42afb2c4a3a0cfefee80211ae6498cec7411fd1
MD5 4d1ee647c80dedae545990e1d937952f
SHA1 585f57014a9eef21be020076f299292919fbff61
SHA512 b3fc44f9b42746b6de8ebd6e1e1a3147134fbf130330fec1629b5aeb0530767fa8388603a4526a2a763f54c0b3479f2d9678cb9440518769d698fb6f2fcc393c
SSDEEP 1536:wQrqhMlX7zDJ4l+0erc47t5JuL7uE2w5Vjk:wQrqhMtl4l+0sP/J+uEB5Vjk
TLSH
T1A1631A16DD29907FD35E89B9C9835D06DF72B88607A2A7CB53801DE70E369D85F3E202
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Injector (3).exe

File Explorer

Injector (3).exe

.exe 70KB

Injector (3).exe

IMPHASH cffd4ca367d17bc1c79ce2cd03a5b970
SHA256 7500d627aafa8cfc35b182a6f42afb2c4a3a0cfefee80211ae6498cec7411fd1
MD5 4d1ee647c80dedae545990e1d937952f
SHA1 585f57014a9eef21be020076f299292919fbff61
SHA512 b3fc44f9b42746b6de8ebd6e1e1a3147134fbf130330fec1629b5aeb0530767fa8388603a4526a2a763f54c0b3479f2d9678cb9440518769d698fb6f2fcc393c
SSDEEP 1536:wQrqhMlX7zDJ4l+0erc47t5JuL7uE2w5Vjk:wQrqhMtl4l+0sP/J+uEB5Vjk
TLSH
T1A1631A16DD29907FD35E89B9C9835D06DF72B88607A2A7CB53801DE70E369D85F3E202
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Process32FirstW CloseHandle CreateThread VirtualProtectEx GetProcAddress VirtualAllocEx ReadProcessMemory GetCurrentProcessId IsWow64Process Sleep GetCommandLineW SetConsoleTitleA VirtualQueryEx Process32NextW Process32First K32EnumProcessModulesEx MultiByteToWideChar Process32Next K32GetModuleBaseNameA LocalFree GetCurrentProcess DuplicateHandle Thread32Next Thread32First SuspendThread ResumeThread VirtualQuery OpenThread GetCurrentDirectoryW FindClose CreateToolhelp32Snapshot OpenProcess GetModuleHandleA WaitForMultipleObjects WriteProcessMemory FindFirstFileW GetFileAttributesExW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter GetLocaleInfoEx CreateFile2 AreFileApisANSI GetLastError GetModuleHandleW GetFileInformationByHandleEx WideCharToMultiByte FormatMessageA

user32

MessageBoxA

advapi32

OpenProcessToken GetTokenInformation

shell32

CommandLineToArgvW

msvcp140

?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xinvalid_argument@std@@YAXPEBD@Z

ntdll

NtQueryInformationProcess NtQueryObject NtUnmapViewOfSection

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy memset __current_exception __current_exception_context _CxxThrowException __std_exception_copy __C_specific_handler memmove __std_exception_destroy

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vsprintf_s __p__commode

api-ms-win-crt-convert-l1-1-0

wcstoul

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initterm _get_narrow_winmain_command_line _exit _set_app_type _seh_filter_exe terminate _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _errno exit _register_thread_local_exe_atexit_callback abort _c_exit

api-ms-win-crt-string-l1-1-0

strncmp _stricmp strlen wcslen strcmp

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr