Static task
static1
Behavioral task
behavioral1
Sample
Fallout4Launcher.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Fallout4Launcher.exe
Resource
win10v2004-20230220-en
General
-
Target
Fallout4Launcher.exe
-
Size
4.3MB
-
MD5
36949fcb40475170a296a0bd467db598
-
SHA1
5b218057d21f0f607101a9925af080ed37327178
-
SHA256
5e457259dca72c8d1217e2f08a981b630ffd5fe0d30bf28269c8b7898491c6ae
-
SHA512
fc9146d0ba65d9d01baac2c133d179402f8030ad9cfe688e5f99dc06ee304bc2a321e99448a93b4c5f4372151ad3d6a24bbb073b2be89930cbdaf91bc0d81c93
-
SSDEEP
24576:I7OgORJe3tYxUEjiHAqVjoPvgmcwgSsn/mkh350:EOgOstYyEjiHAqegmcwgS8mkt50
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Fallout4Launcher.exe
Files
-
Fallout4Launcher.exe.exe windows x64
a4c5473061ecda6c84b2dc326fe01104
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
steam_api64
SteamUGC
SteamAPI_Init
SteamAPI_UnregisterCallback
SteamApps
SteamAPI_RunCallbacks
SteamAPI_Shutdown
SteamAPI_UnregisterCallResult
SteamAPI_RegisterCallResult
kernel32
GetPrivateProfileStringW
CopyFileW
GetFileAttributesW
WritePrivateProfileStringW
GetPrivateProfileIntW
SetFileAttributesW
FindFirstFileW
CompareFileTime
MultiByteToWideChar
lstrlenW
FindClose
FindNextFileW
OutputDebugStringW
CreateMutexW
CreateDirectoryW
GetModuleHandleW
GetModuleFileNameW
GetCurrentDirectoryW
CloseHandle
IsDebuggerPresent
DecodePointer
EncodePointer
GetProcAddress
LoadLibraryW
FreeLibrary
GetLastError
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
GetFileAttributesExW
GetCurrentProcessId
user32
SendMessageW
UpdateWindow
GetDC
ReleaseDC
LoadStringW
SetTimer
MessageBoxA
CheckDlgButton
EnableWindow
KillTimer
ChildWindowFromPointEx
GetClientRect
InvalidateRect
GetDesktopWindow
GetSysColor
EnumDisplayDevicesW
PeekMessageW
GetSystemMetrics
GetMessageW
PostQuitMessage
LoadCursorW
TranslateMessage
RegisterClassExW
LoadIconW
DefWindowProcW
DispatchMessageW
LoadImageW
ShowWindow
wsprintfW
CreateDialogParamW
MessageBoxW
SetWindowTextA
DestroyWindow
ScreenToClient
GetWindowRect
GetWindowInfo
GetDlgItem
SetWindowLongW
EndDialog
SetWindowPos
SetWindowTextW
gdi32
SetTextColor
GetTextExtentPoint32W
SetBkColor
SetBkMode
GetStockObject
advapi32
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegDeleteKeyW
RegQueryValueExW
shell32
ShellExecuteExW
SHGetFolderPathW
ShellExecuteW
ole32
CoInitialize
CoUninitialize
msvcp110
?_Getcat@?$codecvt@_WDH@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?endl@std@@YAAEAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@AEAV21@@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Add_vtordisp1@?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Add_vtordisp2@?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Add_vtordisp2@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?unshift@?$codecvt@_WDH@std@@QEBAHAEAHPEAD1AEAPEAD@Z
?out@?$codecvt@_WDH@std@@QEBAHAEAHPEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??Bid@locale@std@@QEAA_KXZ
?_Orphan_all@_Container_base0@std@@QEAAXXZ
?id@?$ctype@_W@std@@2V0locale@2@A
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
?in@?$codecvt@_WDH@std@@QEBAHAEAHPEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@M@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Add_vtordisp1@?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?getline@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEA_W_J_W@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?_Winerror_map@std@@YAPEBDH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_BADOFF@std@@3_JB
?id@?$codecvt@_WDH@std@@2V0locale@2@A
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
comctl32
PropertySheetW
msvcr110
memset
fwrite
fclose
strncmp
wcsstr
swscanf_s
_waccess
exit
sprintf_s
vsprintf_s
strcpy_s
strrchr
vswprintf_s
tolower
_wchdir
_lock
_unlock
_calloc_crt
__dllonexit
__C_specific_handler
_onexit
_XcptFilter
__crtGetShowWindowMode
_amsg_exit
__getmainargs
__set_app_type
_exit
_cexit
_ismbblead
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_acmdln
_fmode
_commode
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCapturePreviousContext
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crtSetUnhandledExceptionFilter
_stricmp
_CxxThrowException
__CxxFrameHandler3
floorf
fmodf
memcpy
_wtof
memmove
_itow_s
_purecall
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
??1bad_cast@std@@UEAA@XZ
??0bad_cast@std@@QEAA@PEBD@Z
??0bad_cast@std@@QEAA@AEBV01@@Z
??0exception@std@@QEAA@AEBV01@@Z
fputwc
_unlock_file
ungetwc
ungetc
fgetpos
_fseeki64
fflush
fgetc
fsetpos
setvbuf
_lock_file
fgetwc
memcpy_s
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
dsound
ord11
Sections
.text Size: 129KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4.1MB - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ