File name:

Injector Nova.exe

Full analysis: https://app.any.run/tasks/db96c276-a51b-400f-b8b1-690157e33139
Verdict: Malicious activity
Analysis date: October 29, 2023, 22:06:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

150D4DF3609CC0478D23D0E4088397F0

SHA1:

67EDBAD3159EBC8A382B424733BDAD24DD29FF69

SHA256:

E7CD16293C227159D514591C5519E4A5A18FBAE38BF27B73FB9C4117A1E3B6F7

SSDEEP:

98304:AL5/O63SLBhAfJ+rhVgCgxLOWNNVTVXDgH4tMqswIZh7/FYGNFnIhNwbKDdwzfDA:nRib8UpbrG8Nb8kgNpML

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • Injector Nova.exe (PID: 3036)

    • Drops the executable file immediately after the start

      • Injector Nova.exe (PID: 992)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • Injector Nova.exe (PID: 992)

    • The process drops C-runtime libraries

      • Injector Nova.exe (PID: 992)

    • Application launched itself

      • Injector Nova.exe (PID: 992)

    • Loads Python modules

      • Injector Nova.exe (PID: 3036)

  • INFO

    • Reads the computer name

      • Injector Nova.exe (PID: 992)

    • Checks supported languages

      • Injector Nova.exe (PID: 992)
      • Injector Nova.exe (PID: 3036)

    • Create files in a temporary directory

      • Injector Nova.exe (PID: 992)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2023:10:26 13:42:00+02:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.35
CodeSize: 171008
InitializedDataSize: 94720
UninitializedDataSize: -
EntryPoint: 0xc260
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 10.0.22621.1
ProductVersionNumber: 10.0.22621.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: NetBT Unattend Generic Command
FileVersion: 10.0.22621.1 (WinBuild.160101.0800)
InternalName: netbtugc.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: netbtugc.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.22621.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
32
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start injector nova.exe no specs injector nova.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
992"C:\Users\admin\AppData\Local\Temp\Injector Nova.exe" C:\Users\admin\AppData\Local\Temp\Injector Nova.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
NetBT Unattend Generic Command
Exit code:
0
Version:
10.0.22621.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\injector nova.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
3036"C:\Users\admin\AppData\Local\Temp\Injector Nova.exe" C:\Users\admin\AppData\Local\Temp\Injector Nova.exe—Injector Nova.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
NetBT Unattend Generic Command
Exit code:
0
Version:
10.0.22621.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\injector nova.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
Total events
13
Read events
13
Write events
0
Delete events
0

Modification events

No data
Executable files
18
Suspicious files
3
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
992Injector Nova.exeC:\Users\admin\AppData\Local\Temp\_MEI9922\_decimal.pydexecutable
MD5:E3FB8BF23D857B1EB860923CCC47BAA5
SHA256:7DA13DF1F416D3FFD32843C895948E460AF4DC02CF05C521909555061ED108E3
992Injector Nova.exeC:\Users\admin\AppData\Local\Temp\_MEI9922\_socket.pydexecutable
MD5:1A34253AA7C77F9534561DC66AC5CF49
SHA256:DC03D32F681634E682B02E9A60FDFCE420DB9F26754AEFB9A58654A064DC0F9F
992Injector Nova.exeC:\Users\admin\AppData\Local\Temp\_MEI9922\blank.aesbinary
MD5:19F48C8AF0326E86D5EF13429CBD3624
SHA256:84841289ABA9682C917E7B2C9CFA2080979DBF9282A49CEC84F311D3BDF12D7A
992Injector Nova.exeC:\Users\admin\AppData\Local\Temp\_MEI9922\bound.blankbinary
MD5:C50ECC5CCC2AEE99B9E5D289556456B7
SHA256:36238372690021888717B1DC0BF72AAAE9778A6391145A3B6A0D4E4C48BC813E
992Injector Nova.exeC:\Users\admin\AppData\Local\Temp\_MEI9922\_queue.pydexecutable
MD5:347D6A8C2D48003301032546C140C145
SHA256:E71803913B57C49F4CE3416EC15DC8A9E5C14F8675209624E76CD71B0319B192
992Injector Nova.exeC:\Users\admin\AppData\Local\Temp\_MEI9922\libssl-3.dllexecutable
MD5:BF4A722AE2EAE985BACC9D2117D90A6F
SHA256:827FDB184FDCDE9223D09274BE780FE4FE8518C15C8FC217748AD5FD5EA0F147
992Injector Nova.exeC:\Users\admin\AppData\Local\Temp\_MEI9922\_ctypes.pydexecutable
MD5:00F75DAAA7F8A897F2A330E00FAD78AC
SHA256:9FFADCB2C40AE6B67AB611ACC09E050BBE544672CF05E8402A7AA3936326DE1F
992Injector Nova.exeC:\Users\admin\AppData\Local\Temp\_MEI9922\_sqlite3.pydexecutable
MD5:1A8FDC36F7138EDCC84EE506C5EC9B92
SHA256:8E4B9DA9C95915E864C89856E2D7671CD888028578A623E761AEAC2FECA04882
992Injector Nova.exeC:\Users\admin\AppData\Local\Temp\_MEI9922\select.pydexecutable
MD5:45D5A749E3CD3C2DE26A855B582373F6
SHA256:2D15C2F311528440AA29934920FB0B015EAF8CBE3B3C9AD08A282A2D6BA68876
992Injector Nova.exeC:\Users\admin\AppData\Local\Temp\_MEI9922\libcrypto-3.dllexecutable
MD5:78EBD9CB6709D939E4E0F2A6BBB80DA9
SHA256:6A8C458E3D96F8DD3BF6D3CACC035E38EDF7F127EEE5563B51F8C8790CED0B3E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
7
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Injector Nova.exe