General

Malware Config

Signatures

Files

• KLSetup.exe

  .exe windows x86

  419f23b42ac3d55478772c564ee31be2

  
  

  Code Sign

  01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

  Certificate

  Issuer

  CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

  Not Before

  19-09-2018 00:00

  Not After

  28-01-2028 12:00

  Subject

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Not Before

  28-07-2020 00:00

  Not After

  18-03-2029 00:00

  Subject

  CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

  Certificate

  Issuer

  CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

  Not Before

  28-07-2020 00:00

  Not After

  28-07-2030 00:00

  Subject

  CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  73:62:0a:f2:f1:58:00:bb:34:b1:40:fd

  Certificate

  Issuer

  CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

  Not Before

  29-11-2022 12:56

  Not After

  30-08-2023 11:15

  Subject

  SERIALNUMBER=1207100009841,CN=KLAUNCHER LLC,O=KLAUNCHER LLC,STREET=Zavodskaya st.\, 2A\, apt 75,L=Donskoy,ST=Tulskaya oblast,C=RU,1.3.6.1.4.1.311.60.2.1.2=#130f54756c736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a

  Certificate

  Issuer

  CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

  Not Before

  06-04-2022 07:45

  Not After

  08-05-2033 07:45

  Subject

  CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

  Not Before

  20-06-2018 00:00

  Not After

  10-12-2034 00:00

  Subject

  CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

  Not Before

  10-12-2014 00:00

  Not After

  10-12-2034 00:00

  Subject

  CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  5b:a0:51:77:96:c9:e8:5e:c7:89:4c:b4:b4:6c:56:2c:cd:04:26:52:b5:e4:73:e0:5f:ad:28:05:d3:62:9f:ca

  Signer

  Actual PE Digest

  5b:a0:51:77:96:c9:e8:5e:c7:89:4c:b4:b4:6c:56:2c:cd:04:26:52:b5:e4:73:e0:5f:ad:28:05:d3:62:9f:ca

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  SERIALNUMBER=1207100009841,CN=KLAUNCHER LLC,O=KLAUNCHER LLC,STREET=Zavodskaya st.\, 2A\, apt 75,L=Donskoy,ST=Tulskaya oblast,C=RU,1.3.6.1.4.1.311.60.2.1.2=#130f54756c736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  02-03-2023 15:59

  Valid: true

  Chain 1

  SERIALNUMBER=1207100009841,CN=KLAUNCHER LLC,O=KLAUNCHER LLC,STREET=Zavodskaya st.\, 2A\, apt 75,L=Donskoy,ST=Tulskaya oblast,C=RU,1.3.6.1.4.1.311.60.2.1.2=#130f54756c736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

  CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Chain 2

  SERIALNUMBER=1207100009841,CN=KLAUNCHER LLC,O=KLAUNCHER LLC,STREET=Zavodskaya st.\, 2A\, apt 75,L=Donskoy,ST=Tulskaya oblast,C=RU,1.3.6.1.4.1.311.60.2.1.2=#130f54756c736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

  CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  advapi32

  RegCloseKey

  RegConnectRegistryW

  RegCreateKeyExW

  RegDeleteKeyW

  RegDeleteValueW

  RegEnumKeyExW

  RegEnumValueW

  RegFlushKey

  RegLoadKeyW

  RegOpenKeyExW

  RegQueryInfoKeyW

  RegQueryValueExW

  RegReplaceKeyW

  RegRestoreKeyW

  RegSaveKeyW

  RegSetValueExW

  RegUnLoadKeyW

  kernel32

  CloseHandle

  CompareStringW

  CreateDirectoryW

  CreateEventW

  CreateFileA

  CreateFileMappingW

  CreateFileW

  CreateProcessW

  CreateThread

  DeleteCriticalSection

  DeleteFileA

  DeleteFileW

  EnterCriticalSection

  EnumCalendarInfoW

  EnumResourceNamesW

  EnumSystemLocalesW

  ExitProcess

  ExitThread

  FileTimeToDosDateTime

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  FindClose

  FindFirstFileW

  FindNextFileW

  FindResourceW

  FormatMessageW

  FreeLibrary

  FreeResource

  GetACP

  GetCPInfo

  GetCPInfoExW

  GetCommandLineA

  GetCommandLineW

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThread

  GetCurrentThreadId

  GetDateFormatW

  GetDiskFreeSpaceW

  GetDriveTypeW

  GetEnvironmentStrings

  GetExitCodeThread

  GetFileAttributesA

  GetFileAttributesExW

  GetFileAttributesW

  GetFileSize

  GetFileType

  GetFullPathNameW

  GetLastError

  GetLocalTime

  GetLocaleInfoA

  GetLocaleInfoW

  GetLogicalDriveStringsW

  GetLogicalDrives

  GetModuleFileNameA

  GetModuleFileNameW

  GetModuleHandleA

  GetModuleHandleW

  GetOEMCP

  GetProcAddress

  GetProcessHeap

  GetStartupInfoA

  GetStartupInfoW

  GetStdHandle

  GetStringTypeA

  GetStringTypeW

  GetSystemDefaultLangID

  GetSystemDefaultUILanguage

  GetSystemInfo

  GetTempPathW

  GetThreadLocale

  GetThreadPriority

  GetTickCount

  GetTimeZoneInformation

  GetUserDefaultLCID

  GetUserDefaultUILanguage

  GetVersion

  GetVersionExA

  GetVersionExW

  GetVolumeInformationW

  GlobalAddAtomW

  GlobalAlloc

  GlobalDeleteAtom

  GlobalFindAtomW

  GlobalFree

  GlobalLock

  GlobalUnlock

  HeapAlloc

  HeapCreate

  HeapDestroy

  HeapFree

  InitializeCriticalSection

  IsDBCSLeadByteEx

  IsDebuggerPresent

  IsValidLocale

  LCMapStringA

  LCMapStringW

  LeaveCriticalSection

  LoadLibraryA

  LoadLibraryExW

  LoadLibraryW

  LoadResource

  LocalAlloc

  LocalFree

  LockResource

  MapViewOfFile

  MulDiv

  MultiByteToWideChar

  QueryDosDeviceW

  QueryPerformanceCounter

  QueryPerformanceFrequency

  RaiseException

  ReadFile

  RemoveDirectoryW

  ResetEvent

  ResumeThread

  RtlUnwind

  SetConsoleCtrlHandler

  SetEndOfFile

  SetErrorMode

  SetEvent

  SetFileAttributesW

  SetFilePointer

  SetFileTime

  SetHandleCount

  SetLastError

  SetThreadLocale

  SetThreadPriority

  SizeofResource

  Sleep

  SuspendThread

  SwitchToThread

  SystemTimeToFileTime

  SystemTimeToTzSpecificLocalTime

  TerminateThread

  TlsAlloc

  TlsFree

  TlsGetValue

  TlsSetValue

  TryEnterCriticalSection

  TzSpecificLocalTimeToSystemTime

  UnhandledExceptionFilter

  UnmapViewOfFile

  VerSetConditionMask

  VerifyVersionInfoW

  VirtualAlloc

  VirtualFree

  VirtualProtect

  VirtualQuery

  VirtualQueryEx

  WaitForMultipleObjectsEx

  WaitForSingleObject

  WideCharToMultiByte

  WriteFile

  lstrcmpW

  lstrlenW

  netapi32

  NetApiBufferFree

  NetWkstaGetInfo

  version

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueW

  winspool.drv

  ClosePrinter

  DocumentPropertiesW

  EnumPrintersW

  ord203

  OpenPrinterW

  comctl32

  FlatSB_GetScrollInfo

  FlatSB_GetScrollPos

  FlatSB_SetScrollInfo

  FlatSB_SetScrollPos

  FlatSB_SetScrollProp

  ImageList_Add

  ImageList_BeginDrag

  ImageList_Copy

  ImageList_Create

  ImageList_Destroy

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_DragMove

  ImageList_DragShowNolock

  ImageList_Draw

  ImageList_DrawEx

  ImageList_DrawIndirect

  ImageList_EndDrag

  ImageList_GetBkColor

  ImageList_GetDragImage

  ImageList_GetIcon

  ImageList_GetIconSize

  ImageList_GetImageCount

  ImageList_GetImageInfo

  ImageList_LoadImageW

  ImageList_Read

  ImageList_Remove

  ImageList_Replace

  ImageList_ReplaceIcon

  ImageList_SetBkColor

  ImageList_SetIconSize

  ImageList_SetImageCount

  ImageList_SetOverlayImage

  ImageList_Write

  ord17

  InitializeFlatSB

  _TrackMouseEvent

  comdlg32

  FindTextW

  gdi32

  AbortDoc

  AddFontMemResourceEx

  AngleArc

  Arc

  ArcTo

  BitBlt

  Chord

  CombineRgn

  CopyEnhMetaFileW

  CreateBitmap

  CreateBrushIndirect

  CreateCompatibleBitmap

  CreateCompatibleDC

  CreateDCW

  CreateDIBSection

  CreateDIBitmap

  CreateFontIndirectW

  CreateHalftonePalette

  CreateICW

  CreatePalette

  CreatePenIndirect

  CreateRectRgn

  CreateSolidBrush

  DeleteDC

  DeleteEnhMetaFile

  DeleteObject

  Ellipse

  EndDoc

  EndPage

  EnumFontFamiliesExW

  EnumFontsW

  ExcludeClipRect

  ExtFloodFill

  ExtTextOutW

  FrameRgn

  GdiFlush

  GetBitmapBits

  GetBrushOrgEx

  GetClipBox

  GetCurrentPositionEx

  GetDIBColorTable

  GetDIBits

  GetDeviceCaps

  GetEnhMetaFileBits

  GetEnhMetaFileDescriptionW

  GetEnhMetaFileHeader

  GetEnhMetaFilePaletteEntries

  GetNearestPaletteIndex

  GetObjectW

  GetPaletteEntries

  GetPixel

  GetRgnBox

  GetStockObject

  GetStretchBltMode

  GetSystemPaletteEntries

  GetTextExtentPoint32W

  GetTextExtentPointW

  GetTextMetricsW

  GetWinMetaFileBits

  GetWindowOrgEx

  IntersectClipRect

  LineTo

  MaskBlt

  MoveToEx

  PatBlt

  Pie

  PlayEnhMetaFile

  PolyBezier

  PolyBezierTo

  Polygon

  Polyline

  RealizePalette

  RectVisible

  Rectangle

  ResizePalette

  RestoreDC

  RoundRect

  SaveDC

  SelectClipRgn

  SelectObject

  SelectPalette

  SetAbortProc

  SetBkColor

  SetBkMode

  SetBrushOrgEx

  SetDIBColorTable

  SetDIBits

  SetEnhMetaFileBits

  SetMapMode

  SetPixel

  SetROP2

  SetRectRgn

  SetStretchBltMode

  SetTextColor

  SetViewportOrgEx

  SetWinMetaFileBits

  SetWindowOrgEx

  StartDocW

  StartPage

  StretchBlt

  StretchDIBits

  UnrealizeObject

  shell32

  ShellExecuteW

  Shell_NotifyIconW

  SHGetKnownFolderPath

  user32

  ActivateKeyboardLayout

  AdjustWindowRectEx

  BeginPaint

  BringWindowToTop

  CallNextHookEx

  CallWindowProcW

  CharLowerBuffW

  CharLowerW

  CharNextW

  CharUpperBuffW

  CharUpperW

  CheckMenuItem

  ChildWindowFromPoint

  ClientToScreen

  CloseClipboard

  CopyIcon

  CopyImage

  CreateAcceleratorTableW

  CreateIcon

  CreateIconIndirect

  CreateMenu

  CreatePopupMenu

  CreateWindowExW

  DefFrameProcW

  DefMDIChildProcW

  DefWindowProcW

  DeleteMenu

  DestroyCursor

  DestroyIcon

  DestroyMenu

  DestroyWindow

  DispatchMessageA

  DispatchMessageW

  DrawEdge

  DrawFocusRect

  DrawFrameControl

  DrawIcon

  DrawIconEx

  DrawMenuBar

  DrawTextExW

  DrawTextW

  EmptyClipboard

  EnableMenuItem

  EnableScrollBar

  EnableWindow

  EndMenu

  EndPaint

  EnumChildWindows

  EnumDisplayMonitors

  EnumThreadWindows

  EnumWindows

  FillRect

  FindWindowExW

  FindWindowW

  FrameRect

  GetActiveWindow

  GetCapture

  GetClassInfoW

  GetClassLongW

  GetClassNameW

  GetClientRect

  GetClipboardData

  GetCursor

  GetCursorPos

  GetDC

  GetDCEx

  GetDesktopWindow

  GetDlgCtrlID

  GetFocus

  GetForegroundWindow

  GetIconInfo

  GetKeyNameTextW

  GetKeyState

  GetKeyboardLayout

  GetKeyboardLayoutList

  GetKeyboardLayoutNameW

  GetKeyboardState

  GetLastActivePopup

  GetMenu

  GetMenuItemCount

  GetMenuItemID

  GetMenuItemInfoW

  GetMenuState

  GetMenuStringW

  GetMessageExtraInfo

  GetMessagePos

  GetMonitorInfoW

  GetParent

  GetPropW

  GetScrollBarInfo

  GetScrollInfo

  GetScrollPos

  GetScrollRange

  GetSubMenu

  GetSysColor

  GetSysColorBrush

  GetSystemMenu

  GetSystemMetrics

  GetTopWindow

  GetUpdateRect

  GetWindow

  GetWindowDC

  GetWindowLongW

  GetWindowPlacement

  GetWindowRect

  GetWindowTextW

  GetWindowThreadProcessId

  HideCaret

  InsertMenuItemW

  InsertMenuW

  InvalidateRect

  IsChild

  IsDialogMessageA

  IsDialogMessageW

  IsIconic

  IsWindow

  IsWindowEnabled

  IsWindowUnicode

  IsWindowVisible

  IsZoomed

  KillTimer

  LoadBitmapW

  LoadCursorW

  LoadIconW

  LoadKeyboardLayoutW

  LoadStringW

  LockWindowUpdate

  MapVirtualKeyW

  MapWindowPoints

  MessageBeep

  MessageBoxW

  MonitorFromPoint

  MonitorFromRect

  MonitorFromWindow

  MoveWindow

  MsgWaitForMultipleObjects

  MsgWaitForMultipleObjectsEx

  OpenClipboard

  PeekMessageA

  PeekMessageW

  PostMessageW

  PostQuitMessage

  RedrawWindow

  RegisterClassW

  RegisterClipboardFormatW

  RegisterWindowMessageW

  ReleaseCapture

  ReleaseDC

  RemoveMenu

  RemovePropW

  ScreenToClient

  ScrollWindow

  SendMessageA

  SendMessageW

  SetActiveWindow

  SetCapture

  SetClassLongW

  SetClipboardData

  SetCursor

  SetCursorPos

  SetFocus

  SetForegroundWindow

  SetMenu

  SetMenuItemInfoW

  SetParent

  SetPropW

  SetRect

  SetScrollInfo

  SetScrollPos

  SetScrollRange

  SetTimer

  SetWindowLongW

  SetWindowPlacement

  SetWindowPos

  SetWindowRgn

  SetWindowTextW

  SetWindowsHookExW

  ShowCaret

  ShowOwnedPopups

  ShowScrollBar

  ShowWindow

  SystemParametersInfoW

  TrackPopupMenu

  TranslateMDISysAccel

  TranslateMessage

  UnhookWindowsHookEx

  UnregisterClassW

  UpdateWindow

  WaitMessage

  WindowFromPoint

  wsprintfA

  ole32

  CoCreateInstance

  CoInitialize

  CoTaskMemAlloc

  CoTaskMemFree

  CoUninitialize

  IsEqualGUID

  OleInitialize

  OleUninitialize

  oleaut32

  GetErrorInfo

  SafeArrayCreate

  SafeArrayGetLBound

  SafeArrayGetUBound

  SafeArrayPtrOfIndex

  SysAllocStringLen

  SysFreeString

  SysReAllocStringLen

  VariantChangeType

  VariantClear

  VariantCopy

  VariantInit

  winhttp

  WinHttpAddRequestHeaders

  WinHttpCloseHandle

  WinHttpConnect

  WinHttpGetIEProxyConfigForCurrentUser

  WinHttpGetProxyForUrl

  WinHttpOpen

  WinHttpOpenRequest

  WinHttpQueryAuthSchemes

  WinHttpQueryDataAvailable

  WinHttpQueryHeaders

  WinHttpQueryOption

  WinHttpReadData

  WinHttpReceiveResponse

  WinHttpSendRequest

  WinHttpSetCredentials

  WinHttpSetOption

  WinHttpSetStatusCallback

  WinHttpSetTimeouts

  WinHttpWriteData

  Exports

  Exports

  @$xp$13ProcessThread

  @$xp$6TForm1

  @@Unit1@Finalize

  @@Unit1@Initialize

  TMethodImplementationIntercept

  _Form1

  ___CPPdebugHook

  __dbk_fcall_wrapper

  dbkFCallWrapperAddr

  Sections

  .text

  Size: 3.6MB - Virtual size: 3.6MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 68KB - Virtual size: 132KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 1024B - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 15KB - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .didata

  Size: 3KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 4.4MB - Virtual size: 4.4MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 306KB - Virtual size: 308KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ