breeze-launcher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

breeze-launcher.exe
Size

6.6MB
MD5

c6db8c6f1c23d3fa3e6b28b5e615ab7c
SHA1

470565800f664fcd4d599d4aef9812dd9ef8793a
SHA256

00d7e4eede49b583e1756fba6caae62f7c3d785e5ea2cf994f655fa7aacb4484
SHA512

8459576a208be6e6d9f597015c2f6eaf58e3b3b3e85e08ecf29d66c0761d3d88ee1fb4c61044d1f91b38e405c8087904b0a0adebd097683416eadee7c3e32e4e
SSDEEP

49152:3LBEOwHuyoZLZGpwGPFowAV2u9JQ5/HqNfqgBTjrIhmKT71PUGuucd+7YIYht5Ca:1cU9oeQsmDXnd6PWcXh7G6h4Z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
breeze-launcher.exe

Files

breeze-launcher.exe
.exe windows:6 windows x64

c8127727b53fc4ccdaf16483ded7e171

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

RtlLookupFunctionEntry
NtReadFile
RtlVirtualUnwind
RtlCaptureContext
NtCreateFile
RtlNtStatusToDosError
NtWriteFile
NtDeviceIoControlFile
NtCancelIoFileEx

shell32

SHGetKnownFolderPath

kernel32

SetHandleInformation
GetSystemInfo
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
CloseHandle
SetFileCompletionNotificationModes
ReadFile
GetOverlappedResult
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
lstrlenW
AcquireSRWLockShared
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FreeEnvironmentStringsW
ReleaseMutex
FindClose
CompareStringOrdinal
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
GetCurrentProcess
GetCurrentThread
GetProcAddress
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
IsProcessorFeaturePresent
GetCurrentProcessId
DuplicateHandle
SetFilePointerEx
GetStdHandle
WriteFileEx
SleepEx
WaitForSingleObject
GetExitCodeProcess
WakeAllConditionVariable
WakeConditionVariable
QueryPerformanceCounter
QueryPerformanceFrequency
HeapAlloc
GetProcessHeap
HeapFree
GetEnvironmentVariableW
HeapReAlloc
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetModuleHandleA
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
DeleteFileW
GetFinalPathNameByHandleW
CreateEventW
CancelIo
GetConsoleMode
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
GetFullPathNameW
CreateNamedPipeW
ReadFileEx
WaitForMultipleObjects
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
MultiByteToWideChar
WriteConsoleW
CreateThread
TlsGetValue
TlsSetValue
GetSystemTimeAsFileTime

ole32

CoTaskMemFree

advapi32

RegQueryValueExW
RegOpenKeyExW
SystemFunction036
RegCloseKey

secur32

AcquireCredentialsHandleA
DeleteSecurityContext
FreeCredentialsHandle
AcceptSecurityContext
InitializeSecurityContextW
FreeContextBuffer
DecryptMessage
EncryptMessage
ApplyControlToken
QueryContextAttributesW

crypt32

CertAddCertificateContextToStore
CertDuplicateCertificateChain
CertEnumCertificatesInStore
CertFreeCertificateChain
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
CertOpenStore
CertCloseStore
CertDuplicateStore
CertDuplicateCertificateContext

ws2_32

getsockname
connect
bind
WSASocketW
closesocket
getpeername
WSASend
WSAIoctl
getsockopt
setsockopt
ioctlsocket
WSAGetLastError
shutdown
freeaddrinfo
send
WSAStartup
getaddrinfo
WSACleanup
recv

bcrypt

BCryptGenRandom

user32

MessageBoxW

vcruntime140

__current_exception_context
__current_exception
__CxxFrameHandler3
memcpy
memset
memmove
memcmp
_CxxThrowException
__C_specific_handler

api-ms-win-crt-math-l1-1-0

pow
__setusermatherr

api-ms-win-crt-runtime-l1-1-0

_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_initterm
_initterm_e
exit
_exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
terminate
_crt_atexit
_seh_filter_exe
_get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 4.7MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 335KB - Virtual size: 335KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c8127727b53fc4ccdaf16483ded7e171

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

shell32

kernel32

ole32

advapi32

secur32

crypt32

ws2_32

bcrypt

user32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 4.7MB - Virtual size: 4.7MB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 12KB - Virtual size: 12KB

.pdata Size: 335KB - Virtual size: 335KB

.reloc Size: 26KB - Virtual size: 26KB

.text
Size: 4.7MB - Virtual size: 4.7MB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 12KB - Virtual size: 12KB

.pdata
Size: 335KB - Virtual size: 335KB

.reloc
Size: 26KB - Virtual size: 26KB