NebulaInjector(1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
NebulaInjector(1).exe
Size 357KB
Sample261029-vrteps1z2m
SHA256 b23130fb567c71468b37eced9bce90e03b8b1b6a171641e61d223ca1048576f9
MD5 0cf05a6143e9e4b66b1b666aba671dee
SHA1 2820bf8074967afd35fd419393a33126ee2520a5
SHA512 b538f02b2193a9930930ba6dab89c655843ed7f3d05c6c729e019d696928f6f87efcba40d25ec6462dd8ab4e5d35bf7decccae5b01c0189183bbe1e7e3bef6ba
SSDEEP 6144:7FmL8FwvgfDW2up5vbNnqlkMLRq+Mh7rrbjewcGcoGMaeZIBQCQ:BvwvgfDW2c/9M9JyvnDcGcoBdZIV
TLSH
T1C0748D15EBD405FAE177C578CE678942EBB27C8A07B0AACB139049A61F276D04F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NebulaInjector(1).exe

File Explorer

NebulaInjector(1).exe

.exe 357KB

NebulaInjector(1).exe

IMPHASH 2037ec3e894c837dfcbfcd573baa59dd
SHA256 b23130fb567c71468b37eced9bce90e03b8b1b6a171641e61d223ca1048576f9
MD5 0cf05a6143e9e4b66b1b666aba671dee
SHA1 2820bf8074967afd35fd419393a33126ee2520a5
SHA512 b538f02b2193a9930930ba6dab89c655843ed7f3d05c6c729e019d696928f6f87efcba40d25ec6462dd8ab4e5d35bf7decccae5b01c0189183bbe1e7e3bef6ba
SSDEEP 6144:7FmL8FwvgfDW2up5vbNnqlkMLRq+Mh7rrbjewcGcoGMaeZIBQCQ:BvwvgfDW2c/9M9JyvnDcGcoBdZIV
TLSH
T1C0748D15EBD405FAE177C578CE678942EBB27C8A07B0AACB139049A61F276D04F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

89712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdiplusStartup GdiplusShutdown GdipCreateStringFormat GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipCloneImage GdipSetPenStartCap GdipAddPathEllipseI GdipDeleteBrush GdipAlloc GdipDeletePath GdipSetPathGradientCenterColor GdipCreatePathGradientFromPath GdipDisposeImage GdipSetSmoothingMode GdipCreateLineBrush GdipCreatePath GdipSetStringFormatLineAlign GdipCreateFont GdipCreateSolidFill GdipFillPath GdipDrawLine GdipClosePathFigure GdipFree GdipDrawPath GdipDrawString GdipCreateFromHDC GdipSetPenEndCap GdipSetTextRenderingHint GdipCloneBrush GdipGetImageGraphicsContext GdipGetPathGradientPointCount GdipFillRectangleI GdipAddPathArc GdipDeleteGraphics GdipDrawArc GdipDeleteStringFormat GdipDeleteFont GdipDeletePen GdipCreateBitmapFromScan0 GdipDrawImageI GdipCreatePen1 GdipSetStringFormatAlign GdipSetPathGradientSurroundColorsWithCount

user32

GetMessageW DefWindowProcW EndPaint CreateWindowExW SendMessageW GetSystemMetrics ShowWindow OpenClipboard DispatchMessageW SetWindowRgn SetTimer CloseClipboard RegisterClassW TrackMouseEvent EnumWindows TranslateMessage GetClipboardData LoadCursorW SetCursor PostQuitMessage UpdateWindow ReleaseCapture InvalidateRect BeginPaint GetWindowTextW

gdi32

CreateRoundRectRgn

advapi32

SetNamedSecurityInfoW GetNamedSecurityInfoW ConvertStringSidToSidW SetEntriesInAclW

ole32

CoCreateInstance CoUninitialize CoInitializeEx CoSetProxyBlanket

oleaut32

SysFreeString SysAllocString SysStringLen VariantClear VariantInit

kernel32

FindFirstFileExW ReadConsoleW ReadFile SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP GetFileType LCMapStringW CompareStringW LoadLibraryExW VirtualProtect HeapAlloc HeapFree GetTimeZoneInformation UnhandledExceptionFilter GetStdHandle TerminateProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary IsValidCodePage ExitThread CreateThread DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection SetEndOfFile EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable GetOEMCP GetACP GetCPInfo GetCommandLineA GetCommandLineW LoadLibraryW WriteConsoleW HeapReAlloc HeapSize FlushFileBuffers GetStringTypeW QueryPerformanceCounter CreateDirectoryW FindFirstFileW FindNextFileW GetCurrentProcess WriteFile RemoveDirectoryW GetModuleFileNameW GetEnvironmentVariableW GetTempPathW FindClose WaitForSingleObject CreateFileW GetFileAttributesW OpenProcess SetFileAttributesW Sleep DeleteFileW CloseHandle GetProcAddress GlobalLock LocalFree ExitProcess GetModuleHandleW WideCharToMultiByte GetTickCount GlobalUnlock IsDebuggerPresent CheckRemoteDebuggerPresent ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId GetLastError MultiByteToWideChar

ntdll

RtlCaptureContext RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry RtlVirtualUnwind

Name

.text

Size

254KB

Virtual Size

253KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

552B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

NebulaInjector(1).exe

gdiplus

user32

gdi32

advapi32

ole32

oleaut32

kernel32

ntdll

generic