CMLauncher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

CMLauncher.exe
Size

14.2MB
MD5

fc4e2bc90f0db7720a7007a8924256f0
SHA1

6cd41fd666b2b3be778f62a68c84f26f0f716d53
SHA256

8cc5b96e33669e31c0edf6008047c90f8a0127bb3a12c8c54443acc36285e03c
SHA512

1c7b329902dd6c75fc6abcc6ee7dd49c5180e96528c2a60b45ab8bf71ddb032e1226b9b25e62dfe04da5a67966b9c96838aeebb47b3dbea1995ae49dad8d5383
SSDEEP

393216:zgg5Yq5VGMhvIpgRmz0sBGbXjY2rM4ZKYxNwfBvTq6:zR5VGMhwpgRmz0sBGbzY23xeF

Score

1^/10

Malware Config

Signatures

Files

CMLauncher.exe
.exe windows x86

e0fae953d8718e7a37e2e627c1586690

Code Sign

5e:fa:e9:0f:a7:79:89:8a:4f:5c:b1:d8:31:54:7b:28
Certificate

Issuer

CN=ClientModGame

Not Before

31/12/1999, 15:00

Not After

31/12/2035, 15:00

Subject

CN=ClientModGame

Extended Key Usages

ExtKeyUsageCodeSigning

1f:24:01:53:98:54:9b:42:dc:6e:e7:8b:cf:4d:ef:bd:f8:bd:2a:f5:68:f1:1a:8e:02:49:43:54:e5:6b:b2:80
Signer

Actual PE Digest

1f:24:01:53:98:54:9b:42:dc:6e:e7:8b:cf:4d:ef:bd:f8:bd:2a:f5:68:f1:1a:8e:02:49:43:54:e5:6b:b2:80

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFindExtensionA
StrFormatKBSizeA
PathFindFileNameA
PathIsUNCA
PathStripToRootA
PathRemoveFileSpecW

imagehlp

StackWalk

ntdll

RtlUnwind
VerSetConditionMask

winmm

PlaySoundA
timeBeginPeriod

kernel32

SetConsoleCtrlHandler
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetModuleHandleA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
GetProcessId
GetCurrentProcessId
TlsGetValue
QueryPerformanceCounter
GetUserDefaultUILanguage
SetThreadPriority
GetLocaleInfoA
Sleep
GetCurrentThread
GetModuleFileNameA
GetCurrentProcess
TerminateProcess
GetCommandLineA
CloseHandle
GetExitCodeProcess
WritePrivateProfileStringA
GetPrivateProfileStringA
GetSystemInfo
SetThreadAffinityMask
SetProcessAffinityMask
GetProcessAffinityMask
DuplicateHandle
FormatMessageW
LocalFree
SystemTimeToFileTime
GetSystemTime
FormatMessageA
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
GetLastError
CreateFileA
OpenThread
InitializeCriticalSectionEx
SizeofResource
HeapFree
LockResource
HeapReAlloc
RaiseException
LoadResource
FindResourceW
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
SetLastError
GetFileAttributesA
SetFileAttributesA
FreeLibrary
TlsSetValue
CreateMutexA
WaitForSingleObject
ReleaseMutex
SetSearchPathMode
VerifyVersionInfoW
Process32First
GetModuleFileNameW
K32GetProcessImageFileNameA
OpenProcess
Process32Next
GetModuleHandleW
TlsAlloc
TlsFree
VirtualFree
VirtualAlloc
VirtualQuery
HeapCreate
VirtualProtect
GetThreadContext
FlushInstructionCache
SetThreadContext
EnterCriticalSection
WaitForMultipleObjects
LeaveCriticalSection
PostQueuedCompletionStatus
SetEvent
TerminateThread
QueueUserAPC
GetLocalTime
OutputDebugStringA
LCMapStringA
K32GetMappedFileNameA
GetFileAttributesW
K32EmptyWorkingSet
SetFileAttributesW
GetStringTypeExA
K32GetProcessMemoryInfo
GetUserDefaultLCID
FreeConsole
GetConsoleWindow
CreateProcessA
AllocConsole
IsWow64Process
GlobalSize
MulDiv
CopyFileA
InitializeCriticalSectionAndSpinCount
LoadLibraryW
lstrcmpA
GlobalGetAtomNameA
FileTimeToSystemTime
InitializeCriticalSection
GlobalReAlloc
GlobalHandle
LocalAlloc
LocalReAlloc
CompareStringA
GlobalFlags
CreateEventA
GlobalAddAtomA
FindClose
FindFirstFileA
FlushFileBuffers
GetFileSize
GetFullPathNameA
LockFile
ReadFile
SetEndOfFile
SetFilePointer
UnlockFile
SetStdHandle
GetVolumeInformationA
LoadLibraryExA
lstrcmpiA
EncodePointer
GetSystemDirectoryW
LoadLibraryExW
GlobalDeleteAtom
lstrcmpW
FindResourceA
GlobalFindAtomA
GetVersionExA
FileTimeToLocalFileTime
GetFileAttributesExA
GetFileSizeEx
GetFileTime
SystemTimeToTzSpecificLocalTime
GetLocaleInfoW
GetOEMCP
GetCPInfo
GetCurrentDirectoryA
GetACP
lstrcpyA
FindResourceExW
GetWindowsDirectoryA
VerifyVersionInfoA
GetTempPathA
GetTickCount
GetProfileIntA
SearchPathA
GetTempFileNameA
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
ReleaseSRWLockExclusive
FreeEnvironmentStringsW
ReleaseSRWLockShared
SwitchToThread
AcquireSRWLockExclusive
RtlCaptureContext
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCommandLineW
SetFilePointerEx
CreateDirectoryW
GetStdHandle
SleepEx
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
AcquireSRWLockShared
FindNextFileW
CreateFileW
GetFileInformationByHandle
FindFirstFileW
DeleteFileW
MoveFileExW
GetConsoleOutputCP
DeviceIoControl
CreateHardLinkW
GetFinalPathNameByHandleW
CancelIo
GetConsoleMode
GetFileType
SetCurrentDirectoryW
ExitProcess
GetFullPathNameW
CreateProcessW
WriteConsoleW
ReadConsoleW
CreateThread
InitOnceBeginInitialize
InitOnceComplete
GetDiskFreeSpaceExW
GetFileAttributesExW
CreateDirectoryExW
CopyFileW
AreFileApisANSI
WaitForMultipleObjectsEx
OpenEventA
SetWaitableTimer
CreateWaitableTimerA
GetSystemDirectoryA
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
SetConsoleMode
ReadConsoleA
MoveFileExA
CompareFileTime
GetEnvironmentVariableA
PeekNamedPipe
InitializeConditionVariable
SleepConditionVariableCS
CreateIoCompletionPort
GetQueuedCompletionStatus
GetDateFormatW
GetDriveTypeW
FreeLibraryAndExitThread
ExitThread
OutputDebugStringW
GetTimeFormatW
CompareStringW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
IsValidCodePage
CreatePipe
WriteFile
RemoveDirectoryW
InitializeSRWLock
TryEnterCriticalSection
GetExitCodeThread
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
FindFirstFileExW
GetStringTypeW
LCMapStringEx
CompareStringEx
GetLocaleInfoEx

dbghelp

MiniDumpWriteDump

oleaut32

VariantCopy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysAllocStringByteLen
SysAllocStringLen
VariantInit
SysFreeString
SysAllocString
VarBstrFromDate
VariantChangeType
VariantClear
LoadTypeLi

msimg32

AlphaBlend
TransparentBlt

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

shell32

SHAppBarMessage
SHBrowseForFolderA
DragFinish
DragQueryFileA
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetFolderPathW
SHGetFileInfoA
ShellExecuteA

uxtheme

OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
DrawThemeParentBackground
GetThemePartSize
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
GetWindowTheme
IsAppThemed
DrawThemeText
GetCurrentThemeName

wininet

InternetCanonicalizeUrlA

mswsock

AcceptEx
GetAcceptExSockaddrs

gdiplus

GdipDrawImageRectI
GdipFree
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipGetImageHeight
GdiplusStartup
GdipGetImagePalette
GdipAlloc
GdiplusShutdown
GdipBitmapUnlockBits
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipGetImagePixelFormat
GdipDisposeImage
GdipCloneImage
GdipDeleteGraphics
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipSetInterpolationMode
GdipCreateBitmapFromScan0
GdipBitmapLockBits

oleacc

LresultFromObject
CreateStdAccessibleObject
AccessibleObjectFromWindow

crypt32

CertGetIntendedKeyUsage
CertOpenStore
CertCloseStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertOpenSystemStoreA
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetCertificateContextProperty
CertFreeCertificateContext

iphlpapi

CancelMibChangeNotify2
NotifyUnicastIpAddressChange

Exports

Exports

AmdPowerXpressRequestHighPerformance
GetInterface
NvOptimusEnablement

Sections

.text
Size: 9.7MB - Virtual size: 9.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.5MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cdata
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 202KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 470KB - Virtual size: 469KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e0fae953d8718e7a37e2e627c1586690

Code Sign

5e:fa:e9:0f:a7:79:89:8a:4f:5c:b1:d8:31:54:7b:28Certificate

Extended Key Usages

1f:24:01:53:98:54:9b:42:dc:6e:e7:8b:cf:4d:ef:bd:f8:bd:2a:f5:68:f1:1a:8e:02:49:43:54:e5:6b:b2:80Signer

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

imagehlp

ntdll

winmm

kernel32

dbghelp

oleaut32

msimg32

winspool.drv

shell32

uxtheme

wininet

mswsock

gdiplus

oleacc

crypt32

iphlpapi

Exports

Exports

Sections

.text Size: 9.7MB - Virtual size: 9.7MB

.rdata Size: 2.4MB - Virtual size: 2.4MB

.data Size: 1.5MB - Virtual size: 1.6MB

.cdata Size: 1024B - Virtual size: 516B

_RDATA Size: 10KB - Virtual size: 9KB

.rsrc Size: 202KB - Virtual size: 201KB

.reloc Size: 470KB - Virtual size: 469KB

5e:fa:e9:0f:a7:79:89:8a:4f:5c:b1:d8:31:54:7b:28
Certificate

1f:24:01:53:98:54:9b:42:dc:6e:e7:8b:cf:4d:ef:bd:f8:bd:2a:f5:68:f1:1a:8e:02:49:43:54:e5:6b:b2:80
Signer

.text
Size: 9.7MB - Virtual size: 9.7MB

.rdata
Size: 2.4MB - Virtual size: 2.4MB

.data
Size: 1.5MB - Virtual size: 1.6MB

.cdata
Size: 1024B - Virtual size: 516B

_RDATA
Size: 10KB - Virtual size: 9KB

.rsrc
Size: 202KB - Virtual size: 201KB

.reloc
Size: 470KB - Virtual size: 469KB