Community Scans 6029970750f4790d27e468a2...

Community Scan Report

Flagged

6029970750f4790d27e468a2d62d9e77b3dafaaad554fedb9537c8817a150cad

Detection Ratio

1 / 109 rules matched

62 ms scan time

1 rule matched

Matches rule inject_thread from malware by x0r

↳Code injection with CreateRemoteThread in a remote process

1×

Author

x0r

Matched Strings

$c1

1×

Offset (hex)	Offset (dec)	Length	Matched Data
0x77F6	30710	11	OpenProcess

rule inject_thread
{ is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
*/


rule inject_thread {
    meta:
        author = "x0r"
        description = "Code injection with CreateRemoteThread in a remote process"
	version = "0.1"
    strings:
        $c1 = "OpenProcess"
        $c2 = "VirtualAllocEx"
        $c3 = "NtWriteVirtualMemory"
        $c4 = "WriteProc}

Hashes

SHA-256

6029970750f4790d27e468a2d62d9e77b3dafaaad554fedb9537c8817a150cad

SHA-1

94173036a1ffac2df4f9580c5054b9bdff169527

MD5

1c25c970772f569727c68dc46be0b0cd

SHA-512

1aff3c3e3d1be21a786e62307619c89d15db60a11a06b0d9394aa7a99d75af758b0efa23faf9a7be753d202950b5079df713e824f9d3e543d796a2df3a609c55

File Properties

Detected Type Windows Executable (PE)

Magic PE32 executable for MS Windows 4.00 (GUI), Intel i386, Nullsoft Installer self-extracting archive, 5 sections

Client MIME application/vnd.microsoft.portable-executable

Size 522.5 KB

Entropy 7.914 / 8.0

possibly packed

Times Analyzed 1

First Analyzed Aug 10, 2026 00:36

Last Analyzed Aug 10, 2026 00:36

Executable (PE) Details

Machine x86 (32-bit)

Bitness 32-bit (PE32)

Subsystem Windows GUI

Compiled 2023-07-02 02:09:48 UTC

Entry Point 0x3532

Type EXE

Imphash f4639a0b3116c2cfc71144b88a929cfd

Imported DLLs 7

Imported Functions 84

Digitally signed

Section	Virtual Size	Raw Size	Entropy
.text	26840	27136	6.48
.rdata	5220	5632	4.97
.data	174104	1536	4.17
.ndata	143360	0	—
.rsrc	23232	23552	5.07

Imported DLLs (7)

ADVAPI32.dll — 12 function(s)

SHELL32.dll — 5 function(s)

ole32.dll — 5 function(s)

COMCTL32.dll — 4 function(s)

USER32.dll — 25 function(s)

GDI32.dll — 8 function(s)

KERNEL32.dll — 25 function(s)

Extracted IOCs

7 indicator(s) found in file content

IP Address

1.0.0.0 6.0.0.0

Domain

Nullsoft.NSIS.exehead Microsoft.Windows.Common DR.Cx P.TB k.it

Static Strings

500 strings · printable ASCII ≥ 6 chars

Offset (hex)	Offset (dec)	String
0x4D	77	!This program cannot be run in DOS mode.
0x1F7	503	`.rdata
0x21F	543	@.data
0x248	584	.ndata
0x6A7	1703	s495,GC
0x1E68	7784	Y;=,GC
0x256A	9578	Instu`
0x2573	9587	softuW
0x257C	9596	NulluN
0x26A3	9891	j@Vh GC
0x2938	10552	UVWj _3
0x299B	10651	L$bf-S
0x2EBC	11964	D$ Pj(
0x2ED4	11988	D$(Ph0
0x2EE7	12007	D$,UPU
0x2F17	12055	Vj%UUU
0x31F4	12788	D$$+D$
0x31FF	12799	D$,+D$$P
0x43B6	17334	WWWWjn
0x5303	21251	\u f9O
0x58E0	22752	90u'AAf
0x5AD3	23251	l$(9l$(tr
0x5BAC	23468	+D$(PV
0x5F50	24400	HtVHtHH
0x70A8	28840	UXTHEME
0x70B0	28848	USERENV
0x70B8	28856	SETUPAPI
0x70C1	28865	APPHELP
0x70C9	28873	PROPSYS
0x70D1	28881	DWMAPI
0x70D8	28888	CRYPTBASE
0x70E2	28898	OLEACC
0x70E9	28905	CLBCATQ
0x70F1	28913	NTMARTA
0x7128	28968	RichEd32
0x7134	28980	RichEd20
0x7752	30546	RegEnumValueW
0x7762	30562	RegEnumKeyW
0x7770	30576	RegQueryValueExW
0x7784	30596	RegSetValueExW
0x7796	30614	RegCloseKey
0x77A4	30628	RegDeleteValueW
0x77B6	30646	RegDeleteKeyW
0x77C6	30662	AdjustTokenPrivileges
0x77DE	30686	LookupPrivilegeValueW
0x77F6	30710	OpenProcessToken
0x780A	30730	RegOpenKeyExW
0x781A	30746	RegCreateKeyExW
0x782A	30762	ADVAPI32.dll
0x783A	30778	SHFileOperationW
0x784E	30798	SHGetFileInfoW
0x7860	30816	SHBrowseForFolderW
0x7876	30838	SHGetPathFromIDListW
0x788E	30862	ShellExecuteExW
0x789E	30878	SHELL32.dll
0x78AC	30892	CoTaskMemFree
0x78BC	30908	IIDFromString
0x78CC	30924	CoCreateInstance
0x78E0	30944	OleUninitialize
0x78F2	30962	OleInitialize
0x7900	30976	ole32.dll
0x790C	30988	ImageList_Destroy
0x7920	31008	ImageList_AddMasked
0x7936	31030	ImageList_Create
0x7948	31048	COMCTL32.dll
0x7958	31064	EndPaint
0x7964	31076	DrawTextW
0x7970	31088	FillRect
0x797C	31100	GetClientRect
0x798C	31116	BeginPaint
0x799A	31130	DefWindowProcW
0x79AC	31148	SendMessageW
0x79BC	31164	InvalidateRect
0x79CE	31182	EnableWindow
0x79DE	31198	ReleaseDC
0x79F2	31218	LoadImageW
0x7A00	31232	SetWindowLongW
0x7A12	31250	GetDlgItem
0x7A20	31264	IsWindow
0x7A2C	31276	FindWindowExW
0x7A3C	31292	SendMessageTimeoutW
0x7A52	31314	wsprintfW
0x7A5E	31326	ShowWindow
0x7A6C	31340	SetForegroundWindow
0x7A82	31362	PostQuitMessage
0x7A94	31380	SetWindowTextW
0x7AA6	31398	SetTimer
0x7AB2	31410	CreateDialogParamW
0x7AC8	31432	DestroyWindow
0x7AD8	31448	ExitWindowsEx
0x7AE8	31464	CharNextW
0x7AF4	31476	DialogBoxParamW
0x7B06	31494	GetClassInfoW
0x7B16	31510	CreateWindowExW
0x7B28	31528	SystemParametersInfoW
0x7B40	31552	RegisterClassW
0x7B52	31570	EndDialog
0x7B5E	31582	ScreenToClient
0x7B70	31600	GetWindowRect
0x7B80	31616	EnableMenuItem
0x7B92	31634	GetSystemMenu
0x7BA2	31650	SetClassLongW
0x7BB2	31666	IsWindowEnabled
0x7BC4	31684	GetWindowLongW
0x7BD6	31702	SetWindowPos
0x7BE6	31718	GetSysColor
0x7BF4	31732	SetCursor
0x7C00	31744	LoadCursorW
0x7C0E	31758	CheckDlgButton
0x7C20	31776	GetMessagePos
0x7C30	31792	CallWindowProcW
0x7C42	31810	IsWindowVisible
0x7C54	31828	CloseClipboard
0x7C66	31846	SetClipboardData
0x7C7A	31866	EmptyClipboard
0x7C8C	31884	OpenClipboard
0x7C9C	31900	TrackPopupMenu
0x7CAE	31918	AppendMenuW
0x7CBC	31932	CreatePopupMenu
0x7CCE	31950	GetSystemMetrics
0x7CE2	31970	SetDlgItemTextW
0x7CF4	31988	GetDlgItemTextW
0x7D06	32006	MessageBoxIndirectW
0x7D1C	32028	CharPrevW
0x7D28	32040	CharNextA
0x7D34	32052	wsprintfA
0x7D40	32064	DispatchMessageW
0x7D54	32084	PeekMessageW
0x7D62	32098	USER32.dll
0x7D70	32112	SelectObject
0x7D80	32128	SetTextColor
0x7D90	32144	SetBkMode
0x7D9C	32156	CreateFontIndirectW
0x7DB2	32178	CreateBrushIndirect
0x7DC8	32200	DeleteObject
0x7DD8	32216	GetDeviceCaps
0x7DE8	32232	SetBkColor
0x7DF4	32244	GDI32.dll
0x7E00	32256	MulDiv
0x7E0A	32266	DeleteFileW
0x7E18	32280	FindFirstFileW
0x7E2A	32298	FindNextFileW
0x7E3A	32314	FindClose
0x7E46	32326	SetFilePointer
0x7E58	32344	ReadFile
0x7E64	32356	MultiByteToWideChar
0x7E7A	32378	lstrlenA
0x7E86	32390	GetPrivateProfileStringW
0x7EA2	32418	WritePrivateProfileStringW
0x7EC0	32448	FreeLibrary
0x7ECE	32462	LoadLibraryExW
0x7EE0	32480	GetModuleHandleW
0x7EF4	32500	GlobalAlloc
0x7F02	32514	GlobalFree
0x7F10	32528	ExpandEnvironmentStringsW
0x7F2C	32556	lstrcmpW
0x7F38	32568	lstrcmpiW
0x7F44	32580	CloseHandle
0x7F52	32594	SetFileTime
0x7F60	32608	CompareFileTime
0x7F72	32626	SearchPathW
0x7F80	32640	GetShortPathNameW
0x7F94	32660	GetFullPathNameW
0x7FA8	32680	MoveFileW
0x7FB4	32692	SetCurrentDirectoryW
0x7FCC	32716	GetFileAttributesW
0x7FE2	32738	SetFileAttributesW
0x8000	32768	GetTickCount
0x8010	32784	GetFileSize
0x801E	32798	GetModuleFileNameW
0x8034	32820	GetCurrentProcess
0x8048	32840	ExitProcess
0x8056	32854	CopyFileW
0x8062	32866	SetEnvironmentVariableW
0x807C	32892	GetWindowsDirectoryW
0x8094	32916	GetTempPathW
0x80A4	32932	GetCommandLineW
0x80B6	32950	GetVersionExW
0x80C6	32966	SetErrorMode
0x80D6	32982	lstrlenW
0x80E2	32994	lstrcpynW
0x80EE	33006	WideCharToMultiByte
0x8104	33028	GetDiskFreeSpaceW
0x8118	33048	GlobalUnlock
0x8128	33064	GlobalLock
0x8136	33078	CreateThread
0x8146	33094	GetLastError
0x8156	33110	CreateDirectoryW
0x816A	33130	CreateProcessW
0x817C	33148	RemoveDirectoryW
0x8190	33168	lstrcmpiA
0x819C	33180	CreateFileW
0x81AA	33194	GetTempFileNameW
0x81BE	33214	WriteFile
0x81CA	33226	lstrcpyA
0x81D6	33238	MoveFileExW
0x81E4	33252	lstrcatW
0x81F0	33264	GetSystemDirectoryW
0x8206	33286	GetProcAddress
0x8218	33304	GetModuleHandleA
0x822C	33324	GetExitCodeProcess
0x8242	33346	WaitForSingleObject
0x8256	33366	KERNEL32.dll
0x8848	34888	VerQueryValueW
0x8858	34904	GetFileVersionInfoW
0x886C	34924	GetFileVersionInfoSizeW
0x8884	34948	VERSION
0x888C	34956	SHGetFolderPathW
0x88A0	34976	SHFOLDER
0x88AC	34988	SHAutoComplete
0x88BC	35004	SHLWAPI
0x88C4	35012	SHGetKnownFolderPath
0x88DC	35036	SHELL32
0x88E4	35044	InitiateShutdownW
0x88F8	35064	RegDeleteKeyExW
0x8908	35080	ADVAPI32
0x8914	35092	GetUserDefaultUILanguage
0x8930	35120	GetDiskFreeSpaceExW
0x8944	35140	SetDefaultDllDirectories
0x8960	35168	KERNEL32
0x8984	35204	[Rename]
0x8990	35216	%ls=%ls
0x8D03	36099	)QIDATx
0x8DDD	36317	]X:Qt9
0x8EBE	36542	x#p)NJ/
0x8FFF	36863	K+>K44:
0x936E	37742	!FU#pA
0x9808	38920	P;q,Uua
0x993B	39227	LYz>Jk
0x9B8C	39820	QU[CU]
0x9C01	39937	2bO}j_
0xA4F5	42229	~L*M_G7
0xA710	42768	_6a,uS
0xA7F7	42999	,y-+6\
0xAB56	43862	(v)D!Yk
0xAE49	44617	Rf]}1c
0xAFF0	45040	de !*E?
0xB000	45056	]*!DAtqJ
0xB222	45602	V-XK4\|
0xE090	57488	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="*" name="Null
0xE608	58888	NullsoftInst
0xE639	58937	#}`)4M!
0xE9B0	59824	#2O+'fU
0xEA87	60039	Sx>~/*
0xEE00	60928	W+q!m[
0xF0F4	61684	)ZD'Q1
0xF23A	62010	9DmR"x
0xF254	62036	t;?}~K
0xF352	62290	In:?Cd
0xF35D	62301	9qV9*ju
0xF7FC	63484	)YgZ0yg*
0xF8E1	63713	NKe1Zb
0xF9DF	63967	lEJrFj\|
0xFD9F	64927	Q'&}8O
0xFE33	65075	y-C\|ft]
0xFEE5	65253	hG+/k7V
0x101A7	65959	"wB%[d^+M
0x10313	66323	Qvr)fRB
0x1036E	66414	t8Eu]a
0x104DD	66781	Wnq}1B
0x104EE	66798	r!5y%Mj,
0x106D9	67289	ERy.M.C4
0x10994	67988	T\GF\=
0x10F3F	69439	T]g1Y"
0x112C4	70340	}/w()h
0x11316	70422	!}j7]Q
0x11769	71529	z0?pY=
0x11AC1	72385	>N2 =J
0x11B92	72594	JW6qO\|F
0x11C22	72738	ro-.Bo
0x11C59	72793	?^]Z7&Z
0x11C7E	72830	"-wPVf
0x11C88	72840	5PQfXN
0x11D24	72996	!7]C$>
0x123C0	74688	V&\b>C
0x123D7	74711	cgD]5k
0x1260E	75278	\#l&qL
0x1288C	75916	^Mgk+!IF
0x12927	76071	WggG'!
0x12A1C	76316	>f7,HY0q
0x12AA7	76455	dnIQIYIU
0x12FD2	77778	<'4?H6
0x13159	78169	<"ni^]
0x1317C	78204	,d7Z=C
0x13238	78392	Gi!Dvf
0x1339B	78747	2}n^l9
0x13C7B	81019	!>x{xH
0x13CC4	81092	x}6E:W
0x13CE3	81123	gH>~EQb
0x13F22	81698	j>Y\r=
0x142E9	82665	F\V!@Cqu
0x143ED	82925	PHue d[0"
0x14405	82949	uPr_sY^,
0x144E0	83168	8]c&RK`
0x14574	83316	Xps*TD&k
0x14D7C	85372	G!r$RH
0x14F34	85812	'tW@dd
0x150E2	86242	nD'ai['
0x15213	86547	\h3Ie&
0x159C9	88521	SYR]vu{
0x166CE	91854	GoDx5p
0x16821	92193	HR{L8_@4
0x1697D	92541	I^Gt~Z
0x16988	92552	~DR.Cx'
0x169A4	92580	ysSp~9
0x16E97	93847	',9,\L
0x16F23	93987	?c2eTQ
0x16F7F	94079	[rnhlp
0x1765C	95836	ea(umBsL
0x176A4	95908	o}P=1V
0x17903	96515	2S\}G6
0x17B88	97160	} Vao#
0x17CF5	97525	g{(7{+<>
0x17F1D	98077	QbuG>0^
0x182F9	99065	gOY"+?G.
0x1841E	99358	[l1N6r
0x188BB	100539	\fy[G2
0x18993	100755	Oh{~/.
0x189D8	100824	sJJ{ogM
0x18EC5	102085	ae8Tb
0x19004	102404	pi%0\k
0x1908B	102539	b+b$Tl
0x19129	102697	Z#m`@4f
0x19759	104281	Y]Y~NK)
0x198DD	104669	K1]i:]
0x19B58	105304	E[./N,
0x19C6F	105583	[Sj)TlJP0#
0x19E58	106072	/*G&=m
0x1A1BB	106939	\|uwJo%
0x1A3BA	107450	P0:.&B
0x1A53F	107839	bJK'4G
0x1A644	108100	<~j\|naU
0x1A83E	108606	7`6k\|)
0x1AAEA	109290	NoKneu3
0x1AE18	110104	/hpGo-u{
0x1B066	110694	P(rXxZgr
0x1B13F	110911	+7bWp-l
0x1B1E8	111080	9#0%-I
0x1B47A	111738	Xhmaprb
0x1B948	112968	68!/sda
0x1B950	112976	P.TB.:
0x1B99B	113051	5~?_\|\
0x1B9D5	113109	-k^a.h-x
0x1BA7F	113279	u=J[lu
0x1BAE4	113380	%g*zTP
0x1BC92	113810	L9_#}<
0x1BCC8	113864	m&2Jb'
0x1BD87	114055	Z"{/yb
0x1BDA4	114084	PWt,(8P%
0x1BFAB	114603	/Hn<*{
0x1C40F	115727	N0H<-K-
0x1C8BD	116925	wFs'9-
0x1CD1E	118046	N*q\|Yj
0x1CD89	118153	+YUcJ-
0x1D015	118805	EA#@Iv
0x1D332	119602	`Bl:.O
0x1D45A	119898	i1V;"6
0x1D555	120149	Z_^n]ql
0x1D9ED	121325	~+X7NG
0x1DC5C	121948	lC99QZ
0x1DD7D	122237	^'oH:Mx
0x1DDD0	122320	5:[AOexu
0x1DFBE	122814	[hI<fu
0x1E2D5	123605	sR(>F&
0x1E464	124004	:e5juAm
0x1E5BE	124350	jD+T!P
0x1E82A	124970	UQj)RT
0x1E893	125075	d([CuJ
0x1E89B	125083	j({(Y6
0x1EB9D	125853	nlpb4K<}FN
0x1EC9D	126109	j2~ze6
0x1ED3B	126267	T^lnJZ
0x1F88A	129162	(GWWP5D
0x1F8EB	129259	?N4Pin
0x1FBF4	130036	6k@OFt
0x1FD0E	130318	a%OwDu
0x20766	132966	'io@33
0x207F0	133104	/k{36%
0x20AF6	133878	E1X1<g
0x20C59	134233	fnDQIb
0x20F51	134993	0;ner_
0x20F9C	135068	o/RXMCP
0x21061	135265	g 2Al6
0x21698	136856	j"m97p
0x21760	137056	j<Q;@/,
0x219C9	137673	aZ7.`3
0x21EDA	138970	6aS+t,
0x21FF1	139249	CaFfD'v
0x22352	140114	fZ1#1}
0x224C6	140486	U,rqZ&
0x22708	141064	:t3'Oc
0x22722	141090	\|AGVvVE
0x22A77	141943	TT6FW"$
0x22B3B	142139	#N.y&I
0x22D95	142741	h=(,\|C
0x22F43	143171	\|[tU..#
0x22F78	143224	M%7$1f
0x23230	143920	>"6)s^G
0x2355F	144735	N*mRm%
0x23AC6	146118	#;0g/:
0x23C6E	146542	u5>TfS
0x23D10	146704	l k.it
0x240C6	147654	pDic'u
0x240CD	147661	Gphg;r
0x24364	148324	]m[ymm
0x248D0	149712	mc0*@6K
0x24C40	150592	Ky:F!{]
0x24D84	150916	gxtFeG
0x2578D	153485	s</4t7
0x258A6	153766	$^cAN.
0x2598A	153994	K,C;@]
0x25B97	154519	=c<q&*
0x25D3D	154941	%_1vQc
0x263BE	156606	JkxFTmT<P
0x26464	156772	adwrL(J
0x26694	157332	ltM&OE#
0x2681A	157722	Fhz7wp1
0x269EC	158188	J!IXY'J
0x26D9D	159133	^X"jz@
0x26E02	159234	Mb!5rb
0x26F8C	159628	u&hvg[
0x27259	160345	j{92(R
0x277C4	161732	q#ZWVcw
0x27911	162065	)OV>4@'[7y
0x27B71	162673	^KMWF619`7
0x27BE4	162788	(mQ*?8
0x27D61	163169	BGpswS7v
0x27DCE	163278	:_?ey=G
0x288A9	166057	5LE#c&
0x28954	166228	u`%]HA
0x28B5B	166747	0H"+qv^4<?
0x28D1E	167198	Wm2"&3
0x290ED	168173	N1;"4C
0x29F18	171800	&ub8u
0x29F7D	171901	8KZjK}ql[
0x2A2CB	172747	Pb$dlx
0x2A59E	173470	j:[sIg
0x2A7FF	174079	S"T7j-.
0x2A93D	174397	+Fag."
0x2ADF0	175600	GRf8Qs
0x2AE69	175721	sF]{\u
0x2AEF7	175863	mW-_#n
0x2B118	176408	+*7+.A
0x2B165	176485	ud/O% =e
0x2B47B	177275	%`C*EaH
0x2B5ED	177645	u(CoaA
0x2B6B3	177843	eU?EU#
0x2B84B	178251	@.QfKW
0x2B89E	178334	~\V2`M:
0x2BCDB	179419	my:"zQ
0x2BEB9	179897	.3DLzW
0x2BFAE	180142	d$BkUt
0x2C2E0	180960	K\|OoF?R
0x2C8D7	182487	<uDa&,d
0x2CBC6	183238	i_m",8
0x2CBDD	183261	yBb->^
0x2CBF0	183280	3lbUM<s
0x2CF67	184167	8)(M\|W
0x2DA9A	187034	Wg< 'B
0x2DBF3	187379	gL:.`{
0x2E673	190067	`0${uL
0x2E846	190534	!jv*6[6
0x2EC72	191602	)<2=y/L
0x2F3E4	193508	y}:orD
0x2FB10	195344	[6(N}
0x2FC2D	195629	Im\| ~?
0x2FF89	196489	=~Pm/!
0x30276	197238	94nK-q
0x304E9	197865	lYJKE)
0x30534	197940	^ql<q!`B
0x30E47	200263	,@'NUY
0x3104D	200781	+`gK}L
0x316A0	202400	uUMXo
0x316AD	202413	>"rNi/
0x31857	202839	!{OaO!
0x31C0C	203788	uu>P\|o=
0x31D62	204130	r:i`/~
0x32062	204898	2~~!Z<
0x320C0	204992	>fOZuflN
0x3223C	205372	j<X:6S
0x32612	206354	1G]_Y2
0x33B80	211840	t@O5^\|
0x344D7	214231	F)\|gL`}
0x34628	214568	*()[:"
0x34854	215124	-.)r.-
0x34C60	216160	bxZH<\|
0x34CB0	216240	=vt^B~
0x35341	217921	q>Hcy~
0x35405	218117	l\|\|x,XR
0x354C7	218311	%JiPmH(
0x35944	219460	2Z ~[\|
0x359B9	219577	:WBzs
0x35A36	219702	M,3P}c
0x35BC6	220102	'wQ^(w
0x35C7F	220287	EA_F%X}
0x35D1E	220446	FpK1[Dj1
0x35D81	220545	#`em7AeO
0x35F07	220935	f=wMDX
0x35FDA	221146	hD:\&n
0x3603C	221244	,K 9mZ