Injector[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Injector.exe
Size 33KB
Sample261027-xc5wasec64
SHA256 3c9d8196ad4e0728c68f521c3b0890e358b8c438383637906b2fc9cf4af8e18b
MD5 e85d3ab27b6fabdf61c018db8183e6ef
SHA1 95ff47de2e8db82f6c89b25172f97940fe180ba7
SHA512 4af165158edc602d6b7eb7c1e56c65418ad2b451cdf90668bf7eb293b75ff2e2a40be16991c1edf4effb9fe36d73be3b4f75094c120be662c5df4aa680c81936
SSDEEP 768:73fww/01aKSVZgC67cvUtksgNayV0RcnJyy+cR70:7PD01aKE3nctks8acej
TLSH
T168E2292379978972E59451B04878AFEBC6FFA9305F2222D3B7C49E7A09102D1BD7201E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Injector.exe

File Explorer

Injector.exe

.exe 33KB

Injector.exe

IMPHASH dd1aa81ddc00f6044b308ced01a5f6ea
SHA256 3c9d8196ad4e0728c68f521c3b0890e358b8c438383637906b2fc9cf4af8e18b
MD5 e85d3ab27b6fabdf61c018db8183e6ef
SHA1 95ff47de2e8db82f6c89b25172f97940fe180ba7
SHA512 4af165158edc602d6b7eb7c1e56c65418ad2b451cdf90668bf7eb293b75ff2e2a40be16991c1edf4effb9fe36d73be3b4f75094c120be662c5df4aa680c81936
SSDEEP 768:73fww/01aKSVZgC67cvUtksgNayV0RcnJyy+cR70:7PD01aKE3nctks8acej
TLSH
T168E2292379978972E59451B04878AFEBC6FFA9305F2222D3B7C49E7A09102D1BD7201E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Cs2En\OneDrive\Desktop\RobloxDumper-main\RobloxDumper-main\build\Release\Injector.pdb

kernel32

WriteProcessMemory GetModuleFileNameW WaitForSingleObject GetExitCodeThread LoadLibraryA CloseHandle VirtualAllocEx CreateRemoteThread VirtualFreeEx OpenProcess CreateToolhelp32Snapshot K32GetModuleFileNameExA Process32NextW Process32FirstW Module32FirstW Module32NextW CreateFileW GetLocaleInfoEx FormatMessageA LocalFree FindFirstFileW GetFileAttributesExW AreFileApisANSI GetLastError GetModuleHandleW GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte FindClose UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent

msvcp140

?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xout_of_range@std@@YAXPBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xlength_error@std@@YAXPBD@Z ?_Syserror_map@std@@YAPBDH@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?good@ios_base@std@@QBE_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z

vcruntime140

__CxxFrameHandler3 __std_exception_destroy __std_exception_copy memmove __std_terminate _CxxThrowException __current_exception_context memset _except_handler4_common memcpy __current_exception

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _controlfp_s _register_thread_local_exe_atexit_callback terminate _cexit __p___argv _initialize_onexit_table _invoke_watson _exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _register_onexit_function _set_app_type _seh_filter_exe exit _c_exit abort __p___argc

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode