Onix Launcher[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Onix Launcher.exe
Size

1.2MB
MD5

5371014c83eb481bcdbeb60ad92225e8
SHA1

9d8911fb1f956ef0853a2ec4c2c40d2011158ad6
SHA256

2f09a48580a5172d7749ef68b15f40ef15eb20e090cfa18dd461977722348fbe
SHA512

f0ae49f2a8263dfa2a19c2ab887881fc43be1f7b910bce22b8534a067e6fc03de5024ad3c14b1a220cd0557bdb98dbd1f17432fb8b93514f2c101d2675327df4
SSDEEP

24576:nLi/sIHHtelKNfZyNnPGdGz+tRPUEvHecRqqDs:LiFHHtBZsNPMs4RMEveq

Score

N/A

Malware Config

Signatures

Files

Onix Launcher.exe
.exe windows x64

bdd4d109c6766039cb82b91b6e8c71d0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

dwrite

DWriteCreateFactory

d2d1

ord1

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetModuleFileNameA
LoadLibraryExW
FreeLibraryAndExitThread
GetModuleHandleExW
LoadResource
GetModuleHandleA
LockResource
SizeofResource
GetModuleHandleW
GetProcAddress
FreeLibrary

api-ms-win-core-synch-l1-2-0

WakeConditionVariable
WakeAllConditionVariable
Sleep
InitializeConditionVariable
SleepConditionVariableSRW

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TlsAlloc
GetStartupInfoW
GetExitCodeThread
CreateProcessW
GetExitCodeProcess
TerminateProcess
TlsGetValue
CreateProcessA
CreateThread
TlsSetValue
TlsFree
GetCurrentThreadId
GetCurrentProcess
ExitProcess
GetCurrentThread
SetThreadPriority
ExitThread
CreateRemoteThread

api-ms-win-core-file-l1-1-0

FlushFileBuffers
GetFileSizeEx
GetFileType
DeleteFileA
CreateDirectoryW
CreateFileW
FindFirstFileW
FindFirstFileExW
FindNextFileW
CreateFileA
GetFileAttributesExW
GetFullPathNameW
SetFileInformationByHandle
FindClose
SetEndOfFile
FindFirstFileA
SetFilePointerEx
ReadFile
WriteFile
GetDriveTypeW
GetFileInformationByHandle

api-ms-win-core-sysinfo-l1-1-0

GetWindowsDirectoryA
GetSystemTimeAsFileTime
GetLocalTime

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoCreateFreeThreadedMarshaler

api-ms-win-core-libraryloader-l1-2-1

FindResourceW
LoadLibraryA
LoadLibraryW

api-ms-win-core-memory-l1-1-0

VirtualAllocEx
WriteProcessMemory
VirtualFreeEx

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryA
GetStdHandle
SetStdHandle
SetCurrentDirectoryA
GetEnvironmentVariableA
GetCurrentDirectoryW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW

api-ms-win-core-synch-l1-1-0

ResetEvent
SetEvent
CreateEventW
InitializeSRWLock
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

api-ms-win-core-localization-l1-2-0

IsValidCodePage
FormatMessageW
EnumSystemLocalesW
GetACP
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetOEMCP
FormatMessageA
GetLocaleInfoEx
GetCPInfo
LCMapStringEx

api-ms-win-core-psapi-ansi-l1-1-0

K32GetModuleFileNameExA
K32GetModuleBaseNameA

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-psapi-l1-1-0

K32EnumProcesses
K32GetModuleFileNameExW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-console-l2-1-0

SetConsoleTextAttribute

api-ms-win-core-console-l2-2-0

SetConsoleTitleA

api-ms-win-core-console-l1-2-0

FreeConsole

api-ms-win-core-console-l3-2-0

GetConsoleWindow

api-ms-win-core-console-l1-1-0

GetConsoleMode
AllocConsole
WriteConsoleW
GetConsoleOutputCP
ReadConsoleW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock
GlobalUnlock

api-ms-win-security-cryptoapi-l1-1-0

CryptDestroyHash
CryptHashData
CryptGetHashParam
CryptAcquireContextA
CryptReleaseContext
CryptCreateHash

api-ms-win-security-sddl-ansi-l1-1-0

ConvertStringSidToSidA

api-ms-win-security-provider-ansi-l1-1-0

GetNamedSecurityInfoA
SetEntriesInAclA
SetNamedSecurityInfoA

api-ms-win-core-file-l1-2-2

AreFileApisANSI
GetTempPathA
GetTempFileNameA

kernel32

K32EnumProcessModules

user32

SetLayeredWindowAttributes
TranslateMessage
LoadIconW
AdjustWindowRectEx
GetClientRect
PeekMessageA
SetForegroundWindow
SendMessageA
DefWindowProcA
GetWindowLongPtrW
ScreenToClient
GetForegroundWindow
DestroyWindow
GetWindowRect
DefWindowProcW
SetCursor
LoadCursorW
MessageBoxA
DispatchMessageW
RegisterClassExW
UnregisterClassW
GetMessageW
ShowWindow
SetWindowLongPtrW
PostQuitMessage
SendMessageW
CreateWindowExW
SetWindowPos
DispatchMessageA
SetWindowTextA

gdi32

DeleteObject
CreateSolidBrush

comdlg32

GetOpenFileNameA

shell32

Shell_NotifyIconW

ole32

RegisterDragDrop
OleInitialize
ReleaseStgMedium
CoInitialize

urlmon

URLOpenBlockingStreamA
URLDownloadToFileA

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar
CompareStringW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-fibers-l1-1-0

FlsAlloc
FlsFree
FlsGetValue
FlsSetValue

api-ms-win-core-rtlsupport-l1-1-0

RtlPcToFileHeader
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlUnwind
RtlUnwindEx
RtlCaptureContext

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InitializeSListHead

api-ms-win-core-namedpipe-l1-1-0

WaitNamedPipeW
PeekNamedPipe

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegCloseKey
RegSetValueExW

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapReAlloc
HeapAlloc
HeapFree
HeapSize

oleaut32

SysStringLen
SysAllocString
SysFreeString
GetErrorInfo
SetErrorInfo

Sections

.text
Size: 499KB - Virtual size: 498KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 142KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 239KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 585KB - Virtual size: 584KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bdd4d109c6766039cb82b91b6e8c71d0

Headers

DLL Characteristics

File Characteristics

Imports

dwrite

d2d1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-memory-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-localization-l1-2-0

api-ms-win-core-psapi-ansi-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-core-console-l2-2-0

api-ms-win-core-console-l1-2-0

api-ms-win-core-console-l3-2-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-security-sddl-ansi-l1-1-0

api-ms-win-security-provider-ansi-l1-1-0

api-ms-win-core-file-l1-2-2

kernel32

user32

gdi32

comdlg32

shell32

ole32

urlmon

api-ms-win-core-file-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-heap-l1-1-0

oleaut32

Sections

.text Size: 499KB - Virtual size: 498KB

.rdata Size: 142KB - Virtual size: 141KB

.data Size: 18KB - Virtual size: 239KB

.pdata Size: 21KB - Virtual size: 20KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 585KB - Virtual size: 584KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 499KB - Virtual size: 498KB

.rdata
Size: 142KB - Virtual size: 141KB

.data
Size: 18KB - Virtual size: 239KB

.pdata
Size: 21KB - Virtual size: 20KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 585KB - Virtual size: 584KB

.reloc
Size: 4KB - Virtual size: 3KB