LaunchBFH[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
LaunchBFH.exe
Size 927KB
Sample240225-nryk4aaf65
SHA256 80441fcf20760b653d36c4bc78c58c9e05b190e811767c7ed523a904e53b0684
MD5 d3c1c1a07fc43292e7e29e57c752d4c5
SHA1 378c2bf9ece8f5db60f56fda569d24c413d64b55
SHA512 d16e8e1da988314de0a130d67fe9f8eacd4c49084ed8e122ad11b2a8e0401fc1e1d1bd48f1cacd9742a447719390d93b5c1d32ef366502553a162740f3978adb
SSDEEP 12288:SdPEXbCuPYDfFyTxAgY1jggLXKHeH82f3Mp6ot7amxgtxBR3Z2txznbQb0YNDSry:SlEXbCjFjgYlyFW3Mam6txBe91fPQ+Te
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

LaunchBFH.exe

.exe 927KB

LaunchBFH.exe

IMPHASH 2f3a7c5c46373967696674b9a526bbc2
SHA256 80441fcf20760b653d36c4bc78c58c9e05b190e811767c7ed523a904e53b0684
MD5 d3c1c1a07fc43292e7e29e57c752d4c5
SHA1 378c2bf9ece8f5db60f56fda569d24c413d64b55
SHA512 d16e8e1da988314de0a130d67fe9f8eacd4c49084ed8e122ad11b2a8e0401fc1e1d1bd48f1cacd9742a447719390d93b5c1d32ef366502553a162740f3978adb
SSDEEP 12288:SdPEXbCuPYDfFyTxAgY1jggLXKHeH82f3Mp6ot7amxgtxBR3Z2txznbQb0YNDSry:SlEXbCjFjgYlyFW3Mam6txBe91fPQ+Te
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

5a:8a:7d:7f:fb:d8:0e:62:1b:de:ee:e0:8e:14:49:e9:09:b4:5d:88:22:c3:9f:aa:21:c6:9b:d4:93:b9:55:f8

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Feb 10, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:1a:34:0f:78:d7:d0:00:e0:89:fd:ba:ad:65:22:df

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 3, 2023 - Nov 4, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

109221

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\7zsfxmm-cd920c2bb1fac536108acd5da87f93b5cd38e3fa\Output\Win32\7ZSfxMod.pdb

comctl32

ord17

kernel32

SetLastError Sleep CreateThread GetExitCodeThread GetLocalTime SystemTimeToFileTime GetEnvironmentVariableW ExpandEnvironmentStringsW SetCurrentDirectoryW GetCurrentDirectoryW CompareFileTime CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW RemoveDirectoryW GetTempPathW GetSystemTimeAsFileTime lstrcmpW lstrcmpiW lstrlenA MultiByteToWideChar WideCharToMultiByte GetLocaleInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GetSystemDefaultLCID GetCommandLineW SetEnvironmentVariableW CreateFileW GetDriveTypeW WriteFile GetTickCount GetModuleFileNameW GetModuleHandleW LoadLibraryA GetCurrentThreadId TerminateThread SuspendThread ResumeThread GetSystemDirectoryW LoadResource LockResource GetProcAddress MulDiv FormatMessageW lstrcpyW FindResourceA EnterCriticalSection LeaveCriticalSection DeleteCriticalSection VirtualAlloc VirtualFree GetFileSize ReadFile SetEndOfFile SetFilePointer SetFileTime GetFileInformationByHandle WaitForMultipleObjects InitializeCriticalSection SetEvent ResetEvent CreateEventW RtlUnwind RaiseException EncodePointer VirtualQuery InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetCurrentProcess InitializeSListHead GetCurrentProcessId QueryPerformanceCounter SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent SetFileAttributesW WaitForSingleObject GetLastError CloseHandle lstrlenW LocalFree TerminateProcess

user32

ReleaseDC GetClientRect MessageBeep ClientToScreen PtInRect GetWindowLongW SetWindowLongW GetWindow SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx GetWindowDC CallWindowProcW DrawIconEx SystemParametersInfoW SetFocus DefWindowProcW wvsprintfW MessageBoxA GetKeyState GetParent ScreenToClient GetDC DrawTextW EnableMenuItem GetSystemMenu GetSystemMetrics EnableWindow LoadIconW KillTimer SendMessageW EndDialog wsprintfW GetDlgItem DialogBoxIndirectParamW SetWindowPos ShowWindow LoadImageW IsWindow CharUpperW SetWindowTextW GetWindowTextW GetWindowTextLengthW SetTimer GetWindowRect

gdi32

DeleteObject GetDeviceCaps SelectObject GetObjectW CreateFontIndirectW

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetMalloc ShellExecuteW SHGetSpecialFolderPathW ShellExecuteExW SHGetFileInfoW

ole32

CoCreateInstance CoInitializeEx

oleaut32

SysAllocStringLen VariantClear

api-ms-win-crt-convert-l1-1-0

_wtol

api-ms-win-crt-string-l1-1-0

wcscmp strcpy_s _wcsnicmp wcsncpy wcsncmp strncpy

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table abort _crt_atexit _cexit _beginthreadex _set_app_type terminate _get_initial_narrow_environment _initterm _initterm_e exit _exit _set_new_handler __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _register_onexit_function _controlfp_s

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh free malloc calloc

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

LaunchBFH.exe

PE Signature issue

comctl32

kernel32

user32

gdi32

shell32

ole32

oleaut32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic