fastflag_injector_gui_enhanced[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
fastflag_injector_gui_enhanced.exe
Size 294KB
Sample261024-czrxqsfs71
SHA256 a28b5df1dd5a0dc7e17421cd41bc198d0b0fa6d1d347c7924d3edee09ff88b37
MD5 7e7a8d677ba2465e703a9367fe5847ec
SHA1 e5bec7567061dfb25e2888b84fca9376128a6cf3
SHA512 4b4fe1ffb0680b0fefdb01bd6fc167ea29c6ed11fbc6b8bfb2a6ee2bc642fff32ba1f9f3a8a3d5e6da70a5c7c2f96d77210b9b2b0e351e50b808fa9c7160ed13
SSDEEP 3072:vIQaVQ4eHr1mBs0IoyUlyiYBK4mAbJB3fSN1/3A2+qGl1g7NzUWVMk9PaxrtUEVk:vUesq0IXU3G4O2jGl1gZthDCuHtFdAc
TLSH
T1D654A41FEAA650E1D4BAC0389193713FFCB170A68331A7D79B815A471B61BE4E93E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fastflag_injector_gui_enhanced.exe

File Explorer

fastflag_injector_gui_enhanced.exe

.exe 294KB

fastflag_injector_gui_enhanced.exe

IMPHASH 527072ea887e9d34eca7216e6f910a8c
SHA256 a28b5df1dd5a0dc7e17421cd41bc198d0b0fa6d1d347c7924d3edee09ff88b37
MD5 7e7a8d677ba2465e703a9367fe5847ec
SHA1 e5bec7567061dfb25e2888b84fca9376128a6cf3
SHA512 4b4fe1ffb0680b0fefdb01bd6fc167ea29c6ed11fbc6b8bfb2a6ee2bc642fff32ba1f9f3a8a3d5e6da70a5c7c2f96d77210b9b2b0e351e50b808fa9c7160ed13
SSDEEP 3072:vIQaVQ4eHr1mBs0IoyUlyiYBK4mAbJB3fSN1/3A2+qGl1g7NzUWVMk9PaxrtUEVk:vUesq0IXU3G4O2jGl1gZthDCuHtFdAc
TLSH
T1D654A41FEAA650E1D4BAC0389193713FFCB170A68331A7D79B815A471B61BE4E93E740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

227744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

InitCommonControlsEx

shell32

Shell_NotifyIconW SHGetFolderPathA ShellExecuteA

user32

LoadCursorA EnumChildWindows SetWindowLongA GetWindowLongA FillRect GetSysColor MessageBoxA GetClientRect GetWindowTextLengthA GetWindowTextA SetWindowTextA InvalidateRect LoadIconA SetForegroundWindow UpdateWindow EnableWindow SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW CreateWindowExA RegisterClassW PostQuitMessage DefWindowProcA SendMessageW SendMessageA DispatchMessageA TranslateMessage GetMessageA GetDC

gdi32

SetTextColor SetBkColor SelectObject GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateSolidBrush CreateFontA CreateCompatibleDC CreateCompatibleBitmap

comdlg32

GetOpenFileNameA GetSaveFileNameA

advapi32

RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey

msimg32

AlphaBlend

gdiplus

GdiplusStartup GdiplusShutdown

msvcp140

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Xbad_alloc@std@@YAXXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A

kernel32

GetModuleFileNameA WriteProcessMemory ReadProcessMemory VirtualQueryEx VirtualProtectEx GetTickCount GetModuleHandleA OpenProcess CreateThread Sleep CloseHandle FindNextFileA FindFirstFileA FindClose MulDiv MultiByteToWideChar WideCharToMultiByte K32EnumProcessModules K32GetModuleInformation CreateToolhelp32Snapshot Process32First Process32Next ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetModuleHandleW GetLocalTime CreateDirectoryA

vcruntime140

__current_exception_context __current_exception _purecall memchr memcmp memcpy memmove memset strchr strrchr strstr __std_exception_copy __std_exception_destroy _CxxThrowException __C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

tolower strcpy strncpy isspace isdigit wcscpy_s strlen _stricmp

api-ms-win-crt-runtime-l1-1-0

_c_exit _exit exit _register_thread_local_exe_atexit_callback terminate _initterm _get_narrow_winmain_command_line _errno _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _initterm_e _wassert

api-ms-win-crt-heap-l1-1-0

_callnewh realloc malloc _set_new_mode free

api-ms-win-crt-convert-l1-1-0

strtol strtoul strtoull atoi

api-ms-win-crt-math-l1-1-0

ceilf __setusermatherr

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsprintf_s __p__commode ungetc setvbuf fwrite ftell _fseeki64 fseek fsetpos fread fputs fputc fgetpos fgetc fflush fclose fopen_s _set_fmode _get_stream_buffer_pointers

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale