Trojan.Injector

By CagedTech in Trojans

Threat Scorecard

Popularity Rank:	3,022
Threat Level:	90 % (High)
Infected Computers:	7,167

First Seen:	July 24, 2009
Last Seen:	January 30, 2026
OS(es) Affected:	Windows

Table of Contents

Aliases

15 security vendors flagged this file as malicious.

Antivirus Vendor	Detection
AVG	Generic28.BQHZ
Fortinet	W32/Inject.EFNL!tr
Ikarus	Trojan-Ransom.Win32.Gimemo
Microsoft	Trojan:Win32/Matsnu
Sophos	Troj/Ransom-GV
AntiVir	TR/Matsnu.EB.23
BitDefender	Trojan.Generic.KDV.648534
Kaspersky	Trojan.Win32.Inject.efnl
ClamAV	Trojan.Injector-564
Avast	Win32:Ransom-JW [Trj]
Symantec	Trojan.Ransomlock.P
McAfee	Generic VB.iv
CAT-QuickHeal	Trojan.Inject.efnl
AVG	Dropper.Generic4.BTME
Fortinet	W32/Kryptik.AL!tr

File System Details

Trojan.Injector may create the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	file.exe	630c537a75505c775cab7ecb4331fd7f	2,894
Name: file.exe MD5: 630c537a75505c775cab7ecb4331fd7f Size: 11.03 MB (11033088 bytes) Detections: 2,894 Type: Executable File Path: C:\Users\<username>\AppData\Roaming\Microsoft\Windows\ucravihi Group: Malware file Last Updated: April 20, 2022
2.	ohydy.exe	97082e22d22d0233c3827aa800cd8081	212
Name: ohydy.exe MD5: 97082e22d22d0233c3827aa800cd8081 Size: 77.82 KB (77824 bytes) Detections: 212 Type: Executable File Path: %APPDATA% Group: Malware file Last Updated: September 16, 2010
3.	winmsngrn.exe	5ed32336399cfbb32b4ae39eadbe44f4	37
Name: winmsngrn.exe MD5: 5ed32336399cfbb32b4ae39eadbe44f4 Size: 139.26 KB (139264 bytes) Detections: 37 Type: Executable File Path: %APPDATA%\C-76947-8457-2745 Group: Malware file Last Updated: October 22, 2010
4.	server.exe	6a690d6ee9464b247247dc579acaf657	4
Name: server.exe MD5: 6a690d6ee9464b247247dc579acaf657 Size: 880.12 KB (880128 bytes) Detections: 4 Type: Executable File Path: %WINDIR%\system32\Cerberus Group: Malware file Last Updated: May 17, 2011
5.	osecilip.exe	4d069e7d39da2a991161d4ebcfe1665b	4
Name: osecilip.exe MD5: 4d069e7d39da2a991161d4ebcfe1665b Size: 428.66 KB (428666 bytes) Detections: 4 Type: Executable File Path: %WINDIR% Group: Malware file Last Updated: April 20, 2016
6.	csrss.exe	48f1c9ed58b7948b33886a05c726a3aa	3
Name: csrss.exe MD5: 48f1c9ed58b7948b33886a05c726a3aa Size: 17.76 MB (17767151 bytes) Detections: 3 Type: Executable File Path: %ALLUSERSPROFILE% (x86)\Windows Backup Settings\Restore\csrss Group: Malware file Last Updated: September 28, 2010
7.	$Recycle$.exe	8712debe5c53f26f0aa7fe272c5c9254	2
Name: $Recycle$.exe MD5: 8712debe5c53f26f0aa7fe272c5c9254 Size: 261.12 KB (261120 bytes) Detections: 2 Type: Executable File Path: C:\$Recycle$ Group: Malware file Last Updated: May 27, 2011
8.	mine.exe	4c235cb349b71e7c181bc422162eaeba	2
Name: mine.exe MD5: 4c235cb349b71e7c181bc422162eaeba Size: 356.86 KB (356864 bytes) Detections: 2 Type: Executable File Path: %APPDATA% Group: Malware file Last Updated: November 11, 2011
9.	winlogon.exe	4f18ad6462c0318733f3068d5d0072b9	1
Name: winlogon.exe MD5: 4f18ad6462c0318733f3068d5d0072b9 Size: 45.05 KB (45056 bytes) Detections: 1 Type: Executable File Path: %PROGRAMFILES% Group: Malware file Last Updated: October 27, 2010
10.	Windows Defender.exe	d7b90f52681ebf50a75bf71b54327f80	1
Name: Windows Defender.exe MD5: d7b90f52681ebf50a75bf71b54327f80 Size: 495.61 KB (495616 bytes) Detections: 1 Type: Executable File Path: %APPDATA%\WD Group: Malware file Last Updated: April 4, 2011
11.	System2.exe	0509c8e423ceca39fddb557d1d3b3195	0
Name: System2.exe MD5: 0509c8e423ceca39fddb557d1d3b3195 Size: 1.88 MB (1884160 bytes) Detections: 0 Type: Executable File Group: Malware file Last Updated: March 30, 2010
12.	msdrive32.exe	4fa0ebf903d127af2756a135372cb0f7	0
Name: msdrive32.exe MD5: 4fa0ebf903d127af2756a135372cb0f7 Size: 81.4 KB (81408 bytes) Detections: 0 Type: Executable File Group: Malware file Last Updated: April 1, 2010
13.	abuzamnet_enc.exe	c26250804673f00acf82ffc3ec7343f9	0
Name: abuzamnet_enc.exe MD5: c26250804673f00acf82ffc3ec7343f9 Size: 34.81 KB (34816 bytes) Detections: 0 Type: Executable File Group: Malware file Last Updated: April 1, 2010
14.	inecomm.exe	484304e2739fb533d104654f06956312	0
Name: inecomm.exe MD5: 484304e2739fb533d104654f06956312 Size: 327.68 KB (327680 bytes) Detections: 0 Type: Executable File Group: Malware file Last Updated: April 8, 2010
15.	svchost32.exe	13d994fe0816381cd863dbe9a07173a5	0
Name: svchost32.exe MD5: 13d994fe0816381cd863dbe9a07173a5 Size: 86.01 KB (86016 bytes) Detections: 0 Type: Executable File Group: Malware file Last Updated: April 20, 2010
16.	ms87273.exe	d5445977d745c8ee312336cbb9905a68	0
Name: ms87273.exe MD5: d5445977d745c8ee312336cbb9905a68 Size: 196.6 KB (196608 bytes) Detections: 0 Type: Executable File Group: Malware file Last Updated: April 20, 2010
17.	ndll.exe	9886448ba02b730241b50906c87c97a7	0
Name: ndll.exe MD5: 9886448ba02b730241b50906c87c97a7 Size: 86.01 KB (86016 bytes) Detections: 0 Type: Executable File Group: Malware file Last Updated: May 7, 2010
18.	java.exe	74837b73b89a529f7f4dc1eaa1859754	0
Name: java.exe MD5: 74837b73b89a529f7f4dc1eaa1859754 Size: 42.45 KB (42455 bytes) Detections: 0 Type: Executable File Group: Malware file Last Updated: May 7, 2010
19.	cidrive32.exe	2a4fc5debe6c89a772fc08d8f1bfc5de	0
Name: cidrive32.exe MD5: 2a4fc5debe6c89a772fc08d8f1bfc5de Size: 106.49 KB (106496 bytes) Detections: 0 Type: Executable File Group: Malware file Last Updated: May 7, 2010
20.	sysdiag32.exe	f11719cd4d4b54ca7058f5dc80ace01f	0
Name: sysdiag32.exe MD5: f11719cd4d4b54ca7058f5dc80ace01f Size: 118.78 KB (118784 bytes) Detections: 0 Type: Executable File Group: Malware file Last Updated: May 18, 2010
21.	jjdrive32.exe	f98711b816003449bdb6b3eb76d280e7	0
Name: jjdrive32.exe MD5: f98711b816003449bdb6b3eb76d280e7 Size: 106.49 KB (106496 bytes) Detections: 0 Type: Executable File Group: Malware file Last Updated: May 18, 2010
22.	730.exe	9ddb3edb042ce8fef5b96117bd4f8cfe	0
Name: 730.exe MD5: 9ddb3edb042ce8fef5b96117bd4f8cfe Size: 110.59 KB (110592 bytes) Detections: 0 Type: Executable File Group: Malware file Last Updated: May 18, 2010
23.	msvmcls64.exe	ca649a0b9242e7f88e4826851dc81728	0
Name: msvmcls64.exe MD5: ca649a0b9242e7f88e4826851dc81728 Size: 282.62 KB (282624 bytes) Detections: 0 Type: Executable File Group: Malware file Last Updated: May 18, 2010
24.	scvdll.exe	d8720b215ee1147b557538e9eb4208d4	0
Name: scvdll.exe MD5: d8720b215ee1147b557538e9eb4208d4 Size: 139.26 KB (139264 bytes) Detections: 0 Type: Executable File Group: Malware file Last Updated: June 3, 2010
25.	infocard.exe	3b84173a87de02b6089bf5d0097fa73e	0
Name: infocard.exe MD5: 3b84173a87de02b6089bf5d0097fa73e Size: 157.33 KB (157332 bytes) Detections: 0 Type: Executable File Group: Malware file Last Updated: June 29, 2010
26.	aca1e6.exe	59f0d4337ee5be50b12a046822f2ef75	0
Name: aca1e6.exe MD5: 59f0d4337ee5be50b12a046822f2ef75 Size: 54.27 KB (54272 bytes) Detections: 0 Type: Executable File Group: Malware file Last Updated: June 29, 2010
27.	winsvc32.exe	7bbba0f837f7039f560a5504d99f7c9b	0
Name: winsvc32.exe MD5: 7bbba0f837f7039f560a5504d99f7c9b Size: 57.34 KB (57345 bytes) Detections: 0 Type: Executable File Group: Malware file Last Updated: September 10, 2010

More files

Registry Details

Trojan.Injector may create the following registry entry or registry entries:

Regexp file mask

%APPDATA%\FUKDd.exe

Analysis Report

General information

Family Name:	Trojan.Injector
Signature status:	No Signature

Known Samples

MD5: efadae0e3b2815210f3083baee4a7dfd

SHA1: 0d5575069aa91463ba7d68a17708e6cbba5dd231

File Size: 5.68 MB, 5678030 bytes

MD5: deff64d13688820605fe51abeb0613e5

SHA1: 4543389340df1ff3c216fe641b77d8a82cea726f

SHA256: 38AB10F979749560F479AA529445975E69A26AD9B64F07BC41D05E7C7B3F38A0

File Size: 4.72 MB, 4718538 bytes

MD5: 0314b98220bc7f874e21eb4abbfe032a

SHA1: 40952f2868e7771c9945a97022a5728754e9e477

SHA256: 0E661198B199B879C2FA30F2F99D364639B1F9E455105DE82B91B83EF1E3B465

File Size: 5.96 MB, 5958027 bytes

MD5: 5aa15b80cc50ab074302c34e7087330c

SHA1: 36f37a7fc1dfd9f92240302d9b0f8a6af521ad47

SHA256: B934E10B7B0A0744B928D380B34908CFB5E3DC35D2284F517EDA7C6DFB8AC1FC

File Size: 5.68 MB, 5678236 bytes

MD5: 2cfd3da5537439a71f5fb6de3b8668fe

SHA1: 1350893b90506b387db3b5674a20dd31e53dfb8a

SHA256: 20959562EBCDCFCC1E4ABE5E7AA636A7964A01E2FA35FE1931AED3DF1AFEAC20

File Size: 4.75 MB, 4748603 bytes

MD5: 4abaf2e1e806bd09b8a770c143f71694

SHA1: f6c3c4fe9a39b3e1f4c8796541027c3c3cf92b83

SHA256: F6131485AF501832F7C1C367830130AEEEEC0CCFE20126302A0C76599BD4CD3E

File Size: 5.48 MB, 5476253 bytes

MD5: 8b3259f01428cba1806e61eb6fc810ec

SHA1: 4e93f24f2b4b16fde70fe392a5666c601d585599

SHA256: B6151A2F1DB9F2BF2553C6C8D8C214CE83685379947D8CAEFD93E882FC999F5A

File Size: 7.09 MB, 7085522 bytes

MD5: 1243153e52887c60d14ad5ae5827118b

SHA1: 51cb808c2d4151b9f9bd259ff8c1b41e94909820

SHA256: 610BC22C5F7D66C17B0B1E97D9EC77A8F9D9905E9C3FF2B84ACCA736145E475A

File Size: 4.70 MB, 4696709 bytes

MD5: 2005b783aa53c22e2d0ca5b30a20e6d0

SHA1: 7cbebe697308a39d6e6bcb42b3a368d2b77f04dc

SHA256: B6995DFF205F80448A0B5459314E37720D5D3FE500E58B6E6C744B39C88BBE74

File Size: 7.47 MB, 7468146 bytes

MD5: 75ae0bff32a534c29738253fdbef0176

SHA1: 436d33ce27c9544101c48cf7181609d5b4afbd09

SHA256: BC3938E53AC27FF862BA5DB2B4F1EB9E202DD91A925884DB7661FDD3FC8F658D

File Size: 5.24 MB, 5235414 bytes

MD5: 11026338b503a7d78949c64c8b3c6617

SHA1: a8b0b7959d17779bc7058cf99aa9ee0aa1e21a92

SHA256: 5B771657572AF8614C0B5DE180C1BD73974B369756C1834F1D864AA128EA4A46

File Size: 7.31 MB, 7312541 bytes

MD5: 65e0e7dc66ce18d77369ffec18b2b463

SHA1: 1110f4d934f23f68cfda1aad2ea4820038dda78c

SHA256: EC2559298CFE7F5F2271C2959C39B412185CC068B84AC8D5BC4948BCBB865730

File Size: 4.78 MB, 4781056 bytes

MD5: 78434f46e7648d413825af92ef22e5c8

SHA1: 0ba3ae1800017aaa3d682b507c45b1555367fe11

SHA256: 6FE819AFAAAE9C6C25593F8C5A1259DE3932FD09D01AAD1B82A3FAF4543B9971

File Size: 2.48 MB, 2475008 bytes

MD5: e1acee589edad429f21edebe87aaa62d

SHA1: aebc9e2e122fce67348ff83633fe8ca6e910ecdd

SHA256: 1F36E280019E1F462624D7D1B81CD78200398C298BC05471E9B6E7912826EABF

File Size: 5.31 MB, 5314048 bytes

Windows Portable Executable Attributes

File doesn't have "Rich" header
File doesn't have debug information
File doesn't have exports table
File doesn't have relocations information
File doesn't have resources
File doesn't have security information
File has exports table
File has TLS information
File is 32-bit executable
File is either console or GUI application

File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
File is Native application (NOT .NET application)
File is not packed
IMAGE_FILE_DLL is not set inside PE header (Executable)
IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Windows PE Version Information

Name	Value
Comments	This installation was built with Inno Setup.
Company Name	AOMEI Technology Co., Ltd.
File Description	Crusader Kings 3 Setup Disk Defrag Drug Dealer Simulator 2 Setup FOOTAGE REC Setup Intravenous 2 Setup Kvark Setup Lazaret Setup Monster Jam Showdown Setup Victoria 3 Setup
File Version	1.2.0 1.00
Internal Name	Defrager.exe TJprojMain
Legal Copyright	Copytight (C) AOMEI International Network Limited FitGirl
Original Filename	Defrager.exe TJprojMain.exe
Product Name	AOMEI Partition Assistant Crusader Kings 3 Drug Dealer Simulator 2 FOOTAGE REC Intravenous 2 Kvark Lazaret Monster Jam Showdown Project1 Victoria 3
Product Version	1.2.0 1.00

File Traits

2+ executable sections
dll
HighEntropy
imgui
No Version Info
ntdll
x86

Block Information

Total Blocks:	4,744
Potentially Malicious Blocks:	321
Whitelisted Blocks:	2,490
Unknown Blocks:	1,933

Visual Map

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 ? 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? 0 0 0 ? ? 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? ? ? ? ? 0 ? ? ? ? ? ? x 0 0 0 0 0 0 0 0 0 x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x 0 x 0 x 0 0 x x x 0 x 0 x x 0 x 0 0 x x x x ? x 0 ? ? x 0 x x x x 0 x 0 x 0 x x x x x 0 x x x x x x x x x x x x x x x x x x x x x x x x x x 0 x 0 x x 0 0 0 0 0 0 0 x 0 0 0 0 0 0 ? 0 ? ? ? ? 0 ? ? 0 0 ? ? ? 0 0 0 0 0 ? 0 ? ? 0 ? ? 0 ? 0 ? 0 0 ? ? 1 1 1 1 1 ? 0 ? ? x ? ? ? 0 ? ? ? ? ? 0 0 ? 0 ? ? 0 ? 1 x 0 0 ? 0 0 x 0 ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? 0 0 ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? 0 0 0 0 ? 0 ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? ? 0 ? ? ? ? ? 0 0 0 ? ? ? ? ? ? ? 0 0 ? 0 0 0 0 0 ? x 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 1 1 1 0 1 1 1 0 ? 1 1 0 0 ? ? 1 1 0 1 ? 0 ? 0 0 0 1 1 0 0 1 x 0 ? ? 0 ? ? ? ? ? 0 ? ? 0 x ? ? ? ? 0 ? ? ? ? ? 0 ? ? 0 ? ? x 0 0 ? ? ? 0 x ? ? ? ? 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? x ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? x 0 1 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? x 0 0 0 ? ? ? ? 0 ? ? ? x ? ? 0 0 0 0 ? ? ? ? ? ? ? 0 0 ? 0 0 ? ? ? ? ? ? ? ? ? 0 x ? 0 ? ? x 0 0 0 ? ? 0 ? 0 ? ? ? ? ? ? ? ? 0 ? ? ? 0 ? ? 0 ? ? ? ? ? 0 ? ? ? ? 0 ? ? ? ? ? 0 ? ? ? ? ? ? 0 ? ? ? ? ? 0 ? ? 0 0 ? ? ? ? ? 0 ? ? ? 0 ? ? 0 ? ? ? 0 0 ? 0 ? ? ? ? ? ? ? 0 0 x 0 0 0 ? 0 ? ? ? 0 ? ? ? ? ? ? 0 ? x 0 ? ? ? ? ? ? ? ? 0 ? ? ? ? 0 ? ? ? ? ? ? ? 0 ? ? 0 0 ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? 0 ? ? 0 0 ? ? ? ? ? 0 ? ? ? 0 ? ? 0 ? ? ? 0 0 ? 0 ? ? ? ? ? ? x ? ? ? ? ? ? ? 0 ? ? ? ? ? 0 ? ? ? ? ? ? ? 0 ? ? 0 ? ? ? ? ? ? 0 0 ? ? 0 ? ? 0 ? ? ? 0 ? ? 0 0 ? 0 ? ? ? ? x ? ? ? ? ? 0 0 ? 0 0 ? ? ? x 0 ? ? ? ? ? 0 0 0 ? ? ? ? ? x 0 0 ? 0 ? ? ? ? ? ? ? 0 ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? ? ? ? 0 ? ? ? ? ? ? ? 0 ? 0 0 0 ? ? ? ? ? ? ? x ? 0 ? 0 ? ? ? ? ? 0 ? ? x 0 0 ? ? ?

... Data truncated

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Files Modified

File	Attributes
c:\users\user\appdata\local\temp\is-14dm8.tmp\36f37a7fc1dfd9f92240302d9b0f8a6af521ad47_0005678236.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-19vho.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-19vho.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-19vho.tmp\idp.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-19vho.tmp\innocallback.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-19vho.tmp\isdone.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-5mh2f.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-5mh2f.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-5mh2f.tmp\idp.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-5mh2f.tmp\innocallback.dll	Generic Write,Read Attributes

c:\users\user\appdata\local\temp\is-5mh2f.tmp\isdone.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-6th1b.tmp\436d33ce27c9544101c48cf7181609d5b4afbd09_0005235414.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-brdpu.tmp\0d5575069aa91463ba7d68a17708e6cbba5dd231_0005678030.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-ensj7.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-ensj7.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-ensj7.tmp\idp.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-ensj7.tmp\innocallback.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-ensj7.tmp\isdone.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-f81vf.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-f81vf.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-f81vf.tmp\idp.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-f81vf.tmp\innocallback.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-f81vf.tmp\isdone.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-f9e2b.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-f9e2b.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-f9e2b.tmp\idp.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-f9e2b.tmp\innocallback.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-f9e2b.tmp\isdone.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-fpa27.tmp\a8b0b7959d17779bc7058cf99aa9ee0aa1e21a92_0007312541.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-h6f84.tmp\7cbebe697308a39d6e6bcb42b3a368d2b77f04dc_0007468146.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-hlon1.tmp\4e93f24f2b4b16fde70fe392a5666c601d585599_0007085522.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-hqev7.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-hqev7.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-hqev7.tmp\idp.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-hqev7.tmp\innocallback.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-hqev7.tmp\isdone.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-im92f.tmp\40952f2868e7771c9945a97022a5728754e9e477_0005958027.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-mkn18.tmp\51cb808c2d4151b9f9bd259ff8c1b41e94909820_0004696709.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-njvhg.tmp\1350893b90506b387db3b5674a20dd31e53dfb8a_0004748603.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-o4l4a.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-o4l4a.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-o4l4a.tmp\idp.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-o4l4a.tmp\innocallback.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-o4l4a.tmp\isdone.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-onksh.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-onksh.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-onksh.tmp\idp.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-onksh.tmp\innocallback.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-onksh.tmp\isdone.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-op2pa.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-op2pa.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-op2pa.tmp\idp.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-op2pa.tmp\innocallback.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-op2pa.tmp\isdone.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-qervo.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-qervo.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-qervo.tmp\idp.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-qervo.tmp\innocallback.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-qervo.tmp\isdone.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-tk54s.tmp\4543389340df1ff3c216fe641b77d8a82cea726f_0004718538.tmp	Generic Write,Read Attributes

Windows API Usage

Category	API
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess
User Data Access	GetUserObjectInformation
Other Suspicious	SetWindowsHookEx
Syscall Use	ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtClose ntdll.dll!NtCreateFile ntdll.dll!NtCreateSection ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenProcessToken ntdll.dll!NtQueryAttributesFile Show More ntdll.dll!NtQueryDebugFilterState ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationToken ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtReadFile ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationFile ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtWriteFile
Anti Debug	NtQuerySystemInformation

Shell Command Execution


							"C:\Users\Omsqyoqq\AppData\Local\Temp\is-BRDPU.tmp\0d5575069aa91463ba7d68a17708e6cbba5dd231_0005678030.tmp" /SL5="$40062,5105057,140800,c:\users\user\downloads\0d5575069aa91463ba7d68a17708e6cbba5dd231_0005678030"


							"C:\Users\Nriuaxzq\AppData\Local\Temp\is-TK54S.tmp\4543389340df1ff3c216fe641b77d8a82cea726f_0004718538.tmp" /SL5="$50054,4130382,140800,c:\users\user\downloads\4543389340df1ff3c216fe641b77d8a82cea726f_0004718538"


							"C:\Users\Fgrvbwni\AppData\Local\Temp\is-IM92F.tmp\40952f2868e7771c9945a97022a5728754e9e477_0005958027.tmp" /SL5="$10280,5356402,140800,c:\users\user\downloads\40952f2868e7771c9945a97022a5728754e9e477_0005958027"


							"C:\Users\Eqkfswiv\AppData\Local\Temp\is-14DM8.tmp\36f37a7fc1dfd9f92240302d9b0f8a6af521ad47_0005678236.tmp" /SL5="$1023E,5105107,140800,c:\users\user\downloads\36f37a7fc1dfd9f92240302d9b0f8a6af521ad47_0005678236"


							"C:\Users\Muqdafky\AppData\Local\Temp\is-NJVHG.tmp\1350893b90506b387db3b5674a20dd31e53dfb8a_0004748603.tmp" /SL5="$300B6,4134331,140800,c:\users\user\downloads\1350893b90506b387db3b5674a20dd31e53dfb8a_0004748603"


									"C:\Users\Kfscueur\AppData\Local\Temp\is-HLON1.tmp\4e93f24f2b4b16fde70fe392a5666c601d585599_0007085522.tmp" /SL5="$180348,6459521,140800,c:\users\user\downloads\4e93f24f2b4b16fde70fe392a5666c601d585599_0007085522"


									"C:\Users\Vbqkrhtk\AppData\Local\Temp\is-MKN18.tmp\51cb808c2d4151b9f9bd259ff8c1b41e94909820_0004696709.tmp" /SL5="$3023C,4121198,140800,c:\users\user\downloads\51cb808c2d4151b9f9bd259ff8c1b41e94909820_0004696709"


									"C:\Users\Unwonywh\AppData\Local\Temp\is-H6F84.tmp\7cbebe697308a39d6e6bcb42b3a368d2b77f04dc_0007468146.tmp" /SL5="$802B8,6907426,140800,c:\users\user\downloads\7cbebe697308a39d6e6bcb42b3a368d2b77f04dc_0007468146"


									"C:\Users\Necdjatx\AppData\Local\Temp\is-6TH1B.tmp\436d33ce27c9544101c48cf7181609d5b4afbd09_0005235414.tmp" /SL5="$602BA,4660375,140800,c:\users\user\downloads\436d33ce27c9544101c48cf7181609d5b4afbd09_0005235414"


									"C:\Users\Zqscjnub\AppData\Local\Temp\is-FPA27.tmp\a8b0b7959d17779bc7058cf99aa9ee0aa1e21a92_0007312541.tmp" /SL5="$80310,6686843,140800,c:\users\user\downloads\a8b0b7959d17779bc7058cf99aa9ee0aa1e21a92_0007312541"


									C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\0ba3ae1800017aaa3d682b507c45b1555367fe11_0002475008.,LiQMAxHB

Trojan.Injector

Threat Scorecard

EnigmaSoft Threat Scorecard

Aliases

File System Details

Registry Details

Analysis Report

General information

Known Samples

Known Samples

Windows Portable Executable Attributes

Windows Portable Executable Attributes

File Icons

File Icons

Windows PE Version Information

Windows PE Version Information

File Traits

Block Information

Block Information

Visual Map

Files Modified

Files Modified

Windows API Usage

Windows API Usage

Shell Command Execution

Shell Command Execution

Submit Comment

Related Posts

Trending

Most Viewed