OnixLauncher[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

OnixLauncher.exe
Size

1.7MB
MD5

0d28c69fd502921b83124ea96880f868
SHA1

ca477af30879dff72f5c2dcca7396bc57450cfe8
SHA256

fc3c1ffcf22b8991200941e818a2866d823949918e86e27a5e6d3baa1af4c898
SHA512

0398b27c060bbdc8707f81825de35e750ede37515c5e35d7cf18398b89f991b19b394b3a010bde5d26ffce08f7156acc304184584efd9957969bbee9508ca66f
SSDEEP

24576:DsCZ+YHqK1FRH1tOqdmgrics/V4+TKt9FlJVR8vTf18h+tRPUEvHecRqqDs:gCE6qWFRVtIZV4+2Fld4fi4RMEveq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OnixLauncher.exe

Files

OnixLauncher.exe
.exe windows:6 windows x64 arch:x64

1cf9f83a730656831fb733aff6a28986

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

dwrite

DWriteCreateFactory

d2d1

ord1

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
LockResource
GetModuleHandleA
GetModuleHandleW
GetModuleFileNameW
SizeofResource
LoadResource
FreeLibrary
GetModuleHandleExW
FreeLibraryAndExitThread
LoadLibraryExW
GetProcAddress

api-ms-win-core-synch-l1-2-0

InitializeConditionVariable
SleepConditionVariableSRW
WakeConditionVariable
WakeAllConditionVariable
Sleep

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

ExitThread
CreateProcessA
ExitProcess
GetExitCodeProcess
CreateThread
GetStartupInfoW
GetCurrentThreadId
GetExitCodeThread
TerminateProcess
CreateProcessW
CreateRemoteThread
TerminateThread
GetCurrentProcess
TlsAlloc
GetCurrentThread
SetThreadPriority
TlsGetValue
GetCurrentProcessId
TlsFree
TlsSetValue

api-ms-win-core-file-l1-1-0

GetDriveTypeW
DeleteFileA
SetFilePointerEx
SetFileInformationByHandle
GetFullPathNameW
FlushFileBuffers
GetFileType
FindClose
FindFirstFileA
CreateDirectoryW
ReadFile
CreateFileA
CreateFileW
FindFirstFileW
FindFirstFileExW
FindNextFileW
WriteFile
DeleteFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFileSizeEx
SetEndOfFile

api-ms-win-core-sysinfo-l1-1-0

GetWindowsDirectoryA
GetSystemTimeAsFileTime
GetSystemDirectoryA
GetTickCount
GetLocalTime

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoCreateFreeThreadedMarshaler

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
FindResourceW
LoadLibraryA

api-ms-win-core-memory-l1-1-0

WriteProcessMemory
VirtualAllocEx
VirtualFreeEx

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW
GetEnvironmentVariableA
GetStdHandle
GetEnvironmentStringsW
SetStdHandle
GetCommandLineW
GetCommandLineA
SetCurrentDirectoryA
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetCurrentDirectoryA

api-ms-win-core-synch-l1-1-0

InitializeSRWLock
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
WaitForSingleObject
TryAcquireSRWLockExclusive
SleepEx
DeleteCriticalSection
WaitForSingleObjectEx

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetOEMCP
LCMapStringW
GetLocaleInfoW
FormatMessageA
GetLocaleInfoEx
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetCPInfo
LCMapStringEx

api-ms-win-core-psapi-ansi-l1-1-0

K32GetModuleBaseNameA
K32GetModuleFileNameExA

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW
K32EnumProcesses

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-console-l2-1-0

SetConsoleTextAttribute

api-ms-win-core-console-l2-2-0

SetConsoleTitleA

api-ms-win-core-console-l1-2-0

FreeConsole

api-ms-win-core-console-l3-2-0

GetConsoleWindow

api-ms-win-core-console-l1-1-0

GetConsoleMode
GetConsoleOutputCP
AllocConsole
ReadConsoleW
WriteConsoleW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

api-ms-win-security-cryptoapi-l1-1-0

CryptAcquireContextA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptCreateHash
CryptGenRandom
CryptReleaseContext

api-ms-win-security-sddl-ansi-l1-1-0

ConvertStringSidToSidA

api-ms-win-security-provider-ansi-l1-1-0

SetEntriesInAclA
SetNamedSecurityInfoA
GetNamedSecurityInfoA

api-ms-win-core-file-l1-2-2

AreFileApisANSI
GetTempFileNameA
GetTempPathA

kernel32

K32EnumProcessModules

user32

UnregisterClassW
RegisterClassExW
DispatchMessageW
MessageBoxA
SetProcessDpiAwarenessContext
SetCursor
DefWindowProcW
GetWindowRect
DestroyWindow
LoadCursorW
ScreenToClient
GetWindowLongPtrW
DefWindowProcA
SendMessageA
FindWindowA
PostQuitMessage
AdjustWindowRectEx
DispatchMessageA
SetWindowPos
CreateWindowExW
SendMessageW
ShowWindow
SetWindowTextA
GetForegroundWindow
SetLayeredWindowAttributes
TranslateMessage
LoadIconW
GetClientRect
PeekMessageA
SetForegroundWindow
GetMessageW
SetWindowLongPtrW

gdi32

CreateSolidBrush
DeleteObject

comdlg32

GetOpenFileNameA

shell32

Shell_NotifyIconW

ole32

CoInitialize
RegisterDragDrop
OleInitialize
ReleaseStgMedium

ws2_32

htons
getsockopt
getsockname
getpeername
connect
bind
recv
setsockopt
closesocket
WSAWaitForMultipleEvents
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
socket
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
listen
WSAResetEvent
ntohs
getaddrinfo
freeaddrinfo
recvfrom
sendto
ioctlsocket
gethostname
WSAGetLastError

wldap32

ord143
ord35
ord79
ord32
ord30
ord200
ord301
ord27
ord26
ord22
ord217
ord41
ord50
ord45
ord60
ord211
ord46
ord33

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CertOpenStore
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CryptStringToBinaryA

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW
WideCharToMultiByte
GetStringTypeW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-fibers-l1-1-0

FlsSetValue
FlsGetValue
FlsAlloc
FlsFree

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlPcToFileHeader
RtlUnwindEx

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InitializeSListHead

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileExA

api-ms-win-core-namedpipe-l1-1-0

WaitNamedPipeW
PeekNamedPipe

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegCreateKeyExW
RegCloseKey

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
HeapSize

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

oleaut32

SysStringLen
SysAllocString
SysFreeString
GetErrorInfo
SetErrorInfo

Sections

.text
Size: 874KB - Virtual size: 873KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 585KB - Virtual size: 584KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1cf9f83a730656831fb733aff6a28986

Headers

DLL Characteristics

File Characteristics

Imports

dwrite

d2d1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-memory-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-localization-l1-2-0

api-ms-win-core-psapi-ansi-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-core-console-l2-2-0

api-ms-win-core-console-l1-2-0

api-ms-win-core-console-l3-2-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-security-sddl-ansi-l1-1-0

api-ms-win-security-provider-ansi-l1-1-0

api-ms-win-core-file-l1-2-2

kernel32

user32

gdi32

comdlg32

shell32

ole32

ws2_32

wldap32

crypt32

api-ms-win-core-file-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-datetime-l1-1-0

oleaut32

Sections

.text Size: 874KB - Virtual size: 873KB

.rdata Size: 221KB - Virtual size: 221KB

.data Size: 19KB - Virtual size: 241KB

.pdata Size: 36KB - Virtual size: 36KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 585KB - Virtual size: 584KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 874KB - Virtual size: 873KB

.rdata
Size: 221KB - Virtual size: 221KB

.data
Size: 19KB - Virtual size: 241KB

.pdata
Size: 36KB - Virtual size: 36KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 585KB - Virtual size: 584KB

.reloc
Size: 5KB - Virtual size: 4KB