injector[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
injector.exe
Size 58KB
Sample261024-wy8zeabw21
SHA256 e5763d3fa07aa89a13a7d47bbb1d71038400c305f2c88ef6806fff0760cf68d7
MD5 c5ffcc4e73a494dd2379d65a9065b12e
SHA1 72b633fec59d1348dc31db5f2ed5df2d9a4bf78b
SHA512 4d04066988b765fcf93b080999438331bc7e2edaf450641fdbf88267d42128cb75d854296cb1259c9e12d90a9c1cb327501ef32a3668a8b00420bbc5163004cc
SSDEEP 768:iw+YhKGUU8uYGxrh6BYVYjNTohzSvd4cI7h1gDFoW44Tb1lHKHTE:+K8MtFVYjSzSlLt+Wxb1l+E
TLSH
T148432A2ADA5A50BBE3999978C5034C06DE72BC8687D1E6CF53801DE60D76AD0DF3E702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
injector.exe

File Explorer

injector.exe

.exe 58KB

injector.exe

IMPHASH 12ababd9ca047124cb2949bb26341614
SHA256 e5763d3fa07aa89a13a7d47bbb1d71038400c305f2c88ef6806fff0760cf68d7
MD5 c5ffcc4e73a494dd2379d65a9065b12e
SHA1 72b633fec59d1348dc31db5f2ed5df2d9a4bf78b
SHA512 4d04066988b765fcf93b080999438331bc7e2edaf450641fdbf88267d42128cb75d854296cb1259c9e12d90a9c1cb327501ef32a3668a8b00420bbc5163004cc
SSDEEP 768:iw+YhKGUU8uYGxrh6BYVYjNTohzSvd4cI7h1gDFoW44Tb1lHKHTE:+K8MtFVYjSzSlLt+Wxb1l+E
TLSH
T148432A2ADA5A50BBE3999978C5034C06DE72BC8687D1E6CF53801DE60D76AD0DF3E702
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\rrde\source\repos\injector\x64\Release\injector.pdb

kernel32

WriteProcessMemory WaitForSingleObject OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW Process32FirstW CloseHandle FreeConsole GetProcAddress VirtualAllocEx GetModuleHandleW CreateRemoteThread VirtualFreeEx GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateFileW GetCurrentDirectoryW GetLastError GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte LocalFree FormatMessageA GetLocaleInfoEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter GetCurrentProcessId AreFileApisANSI InitializeSListHead GetCurrentThreadId GetSystemTimeAsFileTime

user32

MessageBoxA

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?_Xout_of_range@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy __std_terminate _CxxThrowException __std_exception_destroy memcpy memset __current_exception __current_exception_context __C_specific_handler memmove

api-ms-win-crt-heap-l1-1-0

_callnewh malloc _set_new_mode free

api-ms-win-crt-string-l1-1-0

_wcsicmp

api-ms-win-crt-runtime-l1-1-0

_set_app_type _invalid_parameter_noinfo_noreturn abort terminate _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

ceilf __setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode