fastflag_injector_patched[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
fastflag_injector_patched.exe
Size 306KB
Sample261024-sdtgfavwbs
SHA256 ec83f835bd0c5cfa16240ac2933bfe0949a11ce182b061d6e7ccf0d8fe922551
MD5 bc2df896686cc5e91cfe5763bb73c9d0
SHA1 9f78da51e5a9d938efce8433bf810b0eac93a99d
SHA512 8678f01bd6a0cc0150f9323c56db84a3783dccb185ebd37fc5628e499d045b7e63704203ad197287f653587c58503b1feaf651b908753d696ef9bdcff7135477
SSDEEP 3072:LNHfQKQ/ohz9I8ezuDfA7J/uPOMGdl+Geyml1gjyEKZGfzcCWVneEDYlTtzqTAah:3Q/ohz9I8uOGrml1gvlTtzqyMVZ5
TLSH
T18F64B51FEAA650E1D5BAC078D192713FFCB070A64330A7D797815A4B1B62BE4E83E750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fastflag_injector_patched.exe

File Explorer

fastflag_injector_patched.exe

.exe 306KB

fastflag_injector_patched.exe

IMPHASH 46b09396960aaea47284b81851a88042
SHA256 ec83f835bd0c5cfa16240ac2933bfe0949a11ce182b061d6e7ccf0d8fe922551
MD5 bc2df896686cc5e91cfe5763bb73c9d0
SHA1 9f78da51e5a9d938efce8433bf810b0eac93a99d
SHA512 8678f01bd6a0cc0150f9323c56db84a3783dccb185ebd37fc5628e499d045b7e63704203ad197287f653587c58503b1feaf651b908753d696ef9bdcff7135477
SSDEEP 3072:LNHfQKQ/ohz9I8ezuDfA7J/uPOMGdl+Geyml1gjyEKZGfzcCWVneEDYlTtzqTAah:3Q/ohz9I8uOGrml1gvlTtzqyMVZ5
TLSH
T18F64B51FEAA650E1D5BAC078D192713FFCB070A64330A7D797815A4B1B62BE4E83E750
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

237600

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

InitCommonControlsEx

shell32

Shell_NotifyIconW SHGetFolderPathA ShellExecuteA

user32

LoadCursorA EnumChildWindows SetWindowLongA GetWindowLongA FillRect GetSysColor MessageBoxA GetClientRect GetWindowTextLengthA GetWindowTextA SetWindowTextA InvalidateRect LoadIconA SetForegroundWindow UpdateWindow EnableWindow SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW CreateWindowExA RegisterClassW PostQuitMessage DefWindowProcA SendMessageW SendMessageA DispatchMessageA TranslateMessage GetMessageA GetDC

gdi32

SetTextColor SetBkColor SelectObject GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateSolidBrush CreateFontA CreateCompatibleDC CreateCompatibleBitmap

comdlg32

GetOpenFileNameA GetSaveFileNameA

advapi32

RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey

msimg32

AlphaBlend

gdiplus

GdiplusStartup GdiplusShutdown

msvcp140

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Xbad_alloc@std@@YAXXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A

kernel32

GetModuleFileNameA WriteProcessMemory ReadProcessMemory VirtualQueryEx VirtualProtectEx GetTickCount GetModuleHandleA OpenProcess CreateThread Sleep CloseHandle FindNextFileA FindFirstFileA FindClose MulDiv MultiByteToWideChar WideCharToMultiByte K32EnumProcessModules K32GetModuleInformation CreateToolhelp32Snapshot Process32First Process32Next ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetModuleHandleW GetLocalTime CreateDirectoryA

vcruntime140

__current_exception_context __current_exception _purecall memchr memcmp memcpy memmove memset strchr strrchr strstr __std_exception_copy __std_exception_destroy _CxxThrowException __std_terminate __C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

tolower strcpy strncpy isspace isdigit wcscpy_s strlen _stricmp

api-ms-win-crt-runtime-l1-1-0

_c_exit _exit exit _register_thread_local_exe_atexit_callback terminate _initterm _get_narrow_winmain_command_line _errno _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _initterm_e _wassert

api-ms-win-crt-heap-l1-1-0

_callnewh realloc malloc _set_new_mode free

api-ms-win-crt-convert-l1-1-0

strtol strtoul strtoull atoi

api-ms-win-crt-math-l1-1-0

ceilf __setusermatherr

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsprintf_s __p__commode ungetc setvbuf fwrite ftell _fseeki64 fseek fsetpos fread fputs fputc fgetpos fgetc fflush fclose fopen_s _set_fmode _get_stream_buffer_pointers

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale