dmcLauncher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

dmcLauncher.exe
Size

1.1MB
MD5

4bcec81971d7d717061faa369c5df742
SHA1

1d34df4b391b3b8c698e31c416d1e7e272c8ed3b
SHA256

b38c768050a38118634530f8875a34db716e7b0f8cd9b6e21f22607aa5a9eeec
SHA512

a075ae130fa46fe356640328e73e945e6da755baa9c50539cfc62cb1c18fcfc424bce98653d5b29e69277c9ca98d31f1e13c630886e02570c4d6a82b25aba414
SSDEEP

6144:bPMl/Ivi4M7Lh3runbiDlOIZdFIqgJnzTjbT2ouCTB0Yiylgj245yEnXl:bPMl/Ivi44jIIZdVgJnnywTWYiK45VV

Score

1^/10

Malware Config

Signatures

Files

dmcLauncher.exe
.exe windows x64

61ca9235eb3f4ba4c00680f9405370a1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

54:02:9f:41:f6:3a:52:88:34:d3:60:39:87:19:92:95
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

25/04/2017, 00:00

Not After

03/05/2018, 23:59

Subject

CN=CAPCOM Co.\,Ltd.,OU=R&D Asset Management Section,O=CAPCOM Co.\,Ltd.,L=Osaka,ST=Osaka,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9f:ce:d3:1d:79:61:2a:d8:c3:d1:8f:c8:78:ac:63:e7:9e:11:ce:55:91:44:c4:21:dc:03:c3:eb:b9:fa:c5:79
Signer

Actual PE Digest

9f:ce:d3:1d:79:61:2a:d8:c3:d1:8f:c8:78:ac:63:e7:9e:11:ce:55:91:44:c4:21:dc:03:c3:eb:b9:fa:c5:79

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=CAPCOM Co.\,Ltd.,OU=R&D Asset Management Section,O=CAPCOM Co.\,Ltd.,L=Osaka,ST=Osaka,C=JP

31/01/2018, 04:34
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d3d11

D3D11CreateDeviceAndSwapChain

xinput9_1_0

XInputGetState

dinput8

DirectInput8Create

fmod64

?setVolume@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
FMOD_Memory_Initialize
?unlockDSP@System@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?lockDSP@System@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?getMasterChannelGroup@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVChannelGroup@2@@Z

fmodstudio64

?unload@Bank@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?create@System@Studio@FMOD@@SA?AW4FMOD_RESULT@@PEAPEAV123@I@Z
?release@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?start@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?getDescription@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAVEventDescription@23@@Z
?stop@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_STUDIO_STOP_MODE@@@Z
?getPath@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEADHPEAH@Z
?createInstance@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAVEventInstance@23@@Z
?loadSampleData@EventDescription@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?unloadSampleData@EventDescription@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?releaseAllInstances@EventDescription@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?loadBankFile@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDIPEAPEAVBank@23@@Z
?initialize@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@HIIPEAX@Z
?release@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?update@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?getLowLevelSystem@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAV13@@Z
?getEvent@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBDPEAPEAVEventDescription@23@@Z

steam_api64

SteamAPI_GetHSteamPipe
SteamAPI_GetHSteamUser
SteamInternal_CreateInterface
SteamAPI_RestartAppIfNecessary
SteamAPI_Init
SteamAPI_Shutdown
SteamInternal_ContextInit

mfplat

MFTEnum
MFllMulDiv
MFStartup
MFCreateSample
MFCreateMediaType
MFCreateMemoryBuffer
MFShutdown

mfreadwrite

MFCreateSourceReaderFromURL

imm32

ImmDisableIME

kernel32

GetCommandLineW
LocalFree
GetFileSize
CreateFileA
FindClose
SetFilePointer
RtlCaptureContext
FindFirstFileA
GetFileInformationByHandleEx
GetModuleHandleW
GetCurrentThreadId
VirtualAlloc
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
lstrcmpW
IsDebuggerPresent
GetProcAddress
CreateEventW
DeleteCriticalSection
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
QueryPerformanceCounter
VerifyVersionInfoW
VerSetConditionMask
SwitchToThread
CreateThread
QueryPerformanceFrequency
SetEvent
MultiByteToWideChar
GetStartupInfoW
CreateFileW
GetModuleFileNameA
CreateDirectoryW
GetModuleFileNameW
WaitForSingleObject
GetLastError
OutputDebugStringW
CloseHandle
CreateProcessW
ReadFile
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateEventExW

user32

CallNextHookEx
GetFocus
GetCursorPos
UpdateWindow
PostQuitMessage
GetClientRect
SetWindowLongW
SetWindowsHookExW
LoadCursorW
TranslateMessage
UnhookWindowsHookEx
MapWindowPoints
PeekMessageW
GetMonitorInfoW
DispatchMessageW
ShowWindow
RegisterClassExW
UnregisterClassW
GetSystemMetrics
CreateWindowExW
MonitorFromWindow
SetWindowPos
PostMessageW
GetKeyState
DefWindowProcW
GetWindowLongW
FindWindowW
GetKeyboardLayoutNameW
MapVirtualKeyW
EnumDisplaySettingsW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

ole32

CoCreateInstance
CoTaskMemFree

oleaut32

VariantClear
SysAllocString
SysFreeString

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ

vcruntime140

__C_specific_handler
memcmp
memcpy
strchr
wcsstr
__CxxFrameHandler3
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memset
_purecall
strrchr
memmove
__std_terminate
__vcrt_InitializeCriticalSectionEx

api-ms-win-crt-heap-l1-1-0

_aligned_malloc
_set_new_mode
malloc
free
realloc
calloc
_aligned_free
_callnewh

api-ms-win-crt-stdio-l1-1-0

fgets
__stdio_common_vsprintf
fseek
_wfopen_s
ftell
__stdio_common_vsnwprintf_s
fread
__stdio_common_vsprintf_s
__p__commode
fopen
__acrt_iob_func
__stdio_common_vfprintf
fgetws
_wfopen
fclose
__stdio_common_vswprintf
putc
_set_fmode

api-ms-win-crt-runtime-l1-1-0

_wassert
_register_thread_local_exe_atexit_callback
_c_exit
_exit
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_invalid_parameter_noinfo_noreturn
_set_app_type
_seh_filter_exe
terminate
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv

api-ms-win-crt-string-l1-1-0

_strdup
strncpy
_stricmp
wcstok
_strupr
strcmp
_wcsicmp

api-ms-win-crt-convert-l1-1-0

_wtoi
mbstowcs
wcstombs

api-ms-win-crt-utility-l1-1-0

qsort
bsearch

api-ms-win-crt-math-l1-1-0

pow
sin
fmodf
sinf
__setusermatherr
floorf
cosf
cos

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 231KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 711KB - Virtual size: 711KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 109KB - Virtual size: 34.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

61ca9235eb3f4ba4c00680f9405370a1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

54:02:9f:41:f6:3a:52:88:34:d3:60:39:87:19:92:95Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

9f:ce:d3:1d:79:61:2a:d8:c3:d1:8f:c8:78:ac:63:e7:9e:11:ce:55:91:44:c4:21:dc:03:c3:eb:b9:fa:c5:79Signer

Signature Validations

Verification

31/01/2018, 04:34 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

d3d11

xinput9_1_0

dinput8

fmod64

fmodstudio64

steam_api64

mfplat

mfreadwrite

imm32

kernel32

user32

shell32

ole32

oleaut32

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 231KB - Virtual size: 231KB

.rdata Size: 711KB - Virtual size: 711KB

.data Size: 109KB - Virtual size: 34.0MB

.pdata Size: 13KB - Virtual size: 13KB

.gfids Size: 512B - Virtual size: 80B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 3KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

54:02:9f:41:f6:3a:52:88:34:d3:60:39:87:19:92:95
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

9f:ce:d3:1d:79:61:2a:d8:c3:d1:8f:c8:78:ac:63:e7:9e:11:ce:55:91:44:c4:21:dc:03:c3:eb:b9:fa:c5:79
Signer

31/01/2018, 04:34
Valid: false

.text
Size: 231KB - Virtual size: 231KB

.rdata
Size: 711KB - Virtual size: 711KB

.data
Size: 109KB - Virtual size: 34.0MB

.pdata
Size: 13KB - Virtual size: 13KB

.gfids
Size: 512B - Virtual size: 80B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 3KB