XNXXInjector[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
XNXXInjector.exe
Size 397KB
Sample261022-zd98hsbe37
SHA256 ad263d95f00b7810f9a7902b4ac7348b7f255b53b34b42699a98dacb63321e02
MD5 ff4466b514688e54bfec9fd396cc8a66
SHA1 6b02e0093739ceb3bd28652a40670a692651d1ba
SHA512 38e13add374e4e60635c341223fbd0ddd3ce58782cfd4dc4c27594f1655e83c42e8e8b84db3f4a35cefefd189781fc5ea516a519c948986d443b6ff186b9f2b1
SSDEEP 6144:K6s6BhXfjbeId+ePFJ5/+67vbsH1Ig9Fa5kZht09pnbMV6WYNlzOu:K6hXfjbeIdzWlVrseW9pnB3Ou
TLSH
T19A848D85F1A440EBD06BA074A1B7F60BF935388D475059CB77F848982FE36E07EBA611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XNXXInjector.exe

File Explorer

XNXXInjector.exe

.exe 397KB

XNXXInjector.exe

IMPHASH 4464edde88ee03d68f551ad171829b9c
SHA256 ad263d95f00b7810f9a7902b4ac7348b7f255b53b34b42699a98dacb63321e02
MD5 ff4466b514688e54bfec9fd396cc8a66
SHA1 6b02e0093739ceb3bd28652a40670a692651d1ba
SHA512 38e13add374e4e60635c341223fbd0ddd3ce58782cfd4dc4c27594f1655e83c42e8e8b84db3f4a35cefefd189781fc5ea516a519c948986d443b6ff186b9f2b1
SSDEEP 6144:K6s6BhXfjbeId+ePFJ5/+67vbsH1Ig9Fa5kZht09pnbMV6WYNlzOu:K6hXfjbeIdzWlVrseW9pnB3Ou
TLSH
T19A848D85F1A440EBD06BA074A1B7F60BF935388D475059CB77F848982FE36E07EBA611
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

311456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\Users\jona\Desktop\VAQM client\bin\x64\Release\XNXXInjector.pdb

d3d9

Direct3DCreate9

kernel32

GetTickCount GetTickCount64 MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency FreeLibrary OpenMutexA SetUnhandledExceptionFilter GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetModuleFileNameA CreateRemoteThread VirtualAllocEx GetProcAddress CloseHandle QueryPerformanceCounter VirtualFreeEx GetLastError CreateDirectoryA GetVolumeInformationA GetSystemDirectoryA WriteProcessMemory GetFullPathNameA GetStartupInfoW WaitForSingleObject GetModuleHandleA OpenProcess CreateToolhelp32Snapshot GetExitCodeThread Process32NextW Process32FirstW

user32

GetWindowThreadProcessId GetMessageExtraInfo ScreenToClient GetCapture TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCursor GetClientRect IsWindowUnicode SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData MessageBoxA DefWindowProcW GetWindowRect DestroyWindow SetWindowPos CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetKeyState DispatchMessageW ClientToScreen GetTopWindow GetWindowTextA GetWindow ReleaseCapture MessageBeep PostQuitMessage UpdateWindow GetActiveWindow PeekMessageW SetLayeredWindowAttributes TranslateMessage LoadCursorW SetCapture

gdi32

GetStockObject

comdlg32

GetOpenFileNameA

advapi32

RegDeleteKeyW RegCreateKeyExW RegSetValueExA RegOpenKeyExW RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

SHGetFolderPathA

msvcp140

?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

iphlpapi

GetAdaptersInfo

bcrypt

BCryptGetProperty BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptCreateHash BCryptHashData

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception _CxxThrowException __C_specific_handler __std_terminate __std_exception_destroy __std_exception_copy strstr memchr memcmp memcpy memmove memset __current_exception_context

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc _callnewh

api-ms-win-crt-string-l1-1-0

strcpy_s strcmp strlen strncmp strncpy wcslen _wcsicmp

api-ms-win-crt-stdio-l1-1-0

fputc __stdio_common_vsscanf fflush _wfopen fclose __stdio_common_vfprintf fseek _set_fmode __acrt_iob_func ftell __stdio_common_vsprintf _get_stream_buffer_pointers __p__commode _fseeki64 fread fsetpos ungetc setvbuf fgetpos fwrite fgetc

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-runtime-l1-1-0

_exit exit _initterm_e _initterm _get_narrow_winmain_command_line terminate _register_thread_local_exe_atexit_callback _set_app_type _c_exit _cexit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _seh_filter_exe

api-ms-win-crt-math-l1-1-0

fmodf __setusermatherr cosf powf acosf ceilf sqrtf sinf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale