Onix Launcher[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Onix Launcher.exe
Size

1.8MB
MD5

b05dc19989592ec3aea1a408d2bab0a0
SHA1

9d64f2db4a8e66736c9f10bbac1f47e533197465
SHA256

582dc7e5514965dabde42bc4c560a2ee62d268ffb138a770fdd4a55fc9b7da1b
SHA512

8c3a923a87f2d27006da71fef1ea5093a5c409a062f45cc3f5942da375d0b3dfed093657e5ca9f1b66fe8d117a569a36359ce157a800712e431c78dfd1d3ab07
SSDEEP

49152:dPzL3G65fuF8i50UStEz9CQ4QSKE75m4RMEvhq:dv3M9RfzkWs1vk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Onix Launcher.exe

Files

Onix Launcher.exe
.exe windows:6 windows x64 arch:x64

d984e2fce02f28a16c2809e4c638e8ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Onix\source\repos\OnixLauncher\x64\Release\OnixLauncher.pdb

Imports

dwrite

DWriteCreateFactory

d2d1

ord1

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
LoadLibraryExW
SizeofResource
FreeLibrary
LoadResource
GetModuleHandleA
GetProcAddress
GetModuleHandleW
FreeLibraryAndExitThread
GetModuleHandleExW
LockResource

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
WakeAllConditionVariable
Sleep

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

TlsGetValue
TlsSetValue
GetCurrentThreadId
CreateProcessW
CreateRemoteThread
GetExitCodeProcess
TerminateThread
TlsFree
GetCurrentProcessId
ExitThread
CreateThread
SetThreadPriority
GetCurrentThread
GetCurrentProcess
TerminateProcess
GetExitCodeThread
ExitProcess
TlsAlloc
GetStartupInfoW

api-ms-win-core-file-l1-1-0

GetFileInformationByHandle
GetFileAttributesExW
GetFullPathNameW
SetEndOfFile
SetFileInformationByHandle
DeleteFileW
FindNextFileW
GetFileType
FlushFileBuffers
SetFilePointerEx
GetDriveTypeW
FindFirstFileExW
ReadFile
CreateFileW
CreateDirectoryW
FindClose
WriteFile
GetFileSizeEx
CreateFileA
FindFirstFileW

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetTickCount
GetSystemTimeAsFileTime
GetSystemDirectoryA
GetWindowsDirectoryW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
IsDebuggerPresent

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoInitializeEx

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
FindResourceW
LoadLibraryA

api-ms-win-core-memory-l1-1-0

VirtualFreeEx
WriteProcessMemory
VirtualAllocEx

api-ms-win-core-psapi-l1-1-0

K32EnumProcesses
K32GetModuleBaseNameW
K32GetModuleFileNameExW
K32GetModuleInformation

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
WaitForSingleObjectEx
AcquireSRWLockExclusive
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
TryAcquireSRWLockExclusive
SleepEx
EnterCriticalSection
WaitForSingleObject

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-localization-l1-2-0

FormatMessageA
GetLocaleInfoEx
FormatMessageW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
LCMapStringEx
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-console-l2-1-0

SetConsoleTextAttribute

api-ms-win-core-console-l2-2-0

SetConsoleTitleA

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
GetCurrentDirectoryW
SetStdHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetCommandLineW
GetEnvironmentVariableA
SetCurrentDirectoryW
GetCommandLineA

api-ms-win-core-console-l1-2-0

FreeConsole

api-ms-win-core-console-l3-2-0

GetConsoleWindow

api-ms-win-core-console-l1-1-0

ReadConsoleW
GetConsoleOutputCP
AllocConsole
WriteConsoleW
GetConsoleMode

api-ms-win-appmodel-runtime-l1-1-0

GetPackagesByPackageFamily

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock
GlobalUnlock

api-ms-win-security-cryptoapi-l1-1-0

CryptGetHashParam
CryptImportKey
CryptCreateHash
CryptDestroyHash
CryptDestroyKey
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
CryptEncrypt
CryptHashData

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW

api-ms-win-core-string-l1-1-0

CompareStringW
GetStringTypeW
WideCharToMultiByte
MultiByteToWideChar

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW

api-ms-win-security-provider-l1-1-0

GetNamedSecurityInfoW
SetEntriesInAclW
SetNamedSecurityInfoW

kernel32

K32EnumProcessModules

user32

TranslateMessage
SetLayeredWindowAttributes
GetForegroundWindow
SetWindowTextA
ShowWindow
SendMessageW
GetClientRect
SetWindowPos
DispatchMessageA
AdjustWindowRectEx
PostQuitMessage
GetWindowTextW
FindWindowW
EnumWindows
LoadIconW
PeekMessageA
CreateWindowExW
LoadCursorW
GetWindowTextLengthW
GetMessageW
SetProcessDpiAwarenessContext
DeleteMenu
UnregisterClassW
CreatePopupMenu
RegisterClassExW
DispatchMessageW
MessageBoxA
SetForegroundWindow
SetCursor
AppendMenuW
DefWindowProcW
GetWindowRect
DestroyWindow
SetWindowLongPtrW
ScreenToClient
GetWindowLongPtrW
TrackPopupMenu
GetCursorPos
SendMessageA
GetWindowLongW

gdi32

DeleteObject
CreateSolidBrush

comdlg32

GetOpenFileNameW

shell32

Shell_NotifyIconW
SHGetFolderPathW
ShellExecuteW

ole32

CoInitialize
RegisterDragDrop
OleInitialize
ReleaseStgMedium

ws2_32

WSACloseEvent
WSACreateEvent
send
closesocket
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
gethostname
ioctlsocket
sendto
recvfrom
freeaddrinfo
getaddrinfo
listen
htonl
accept
select
__WSAFDIsSet
WSACleanup
WSAGetLastError
recv
WSAStartup
bind
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect

wldap32

ord143
ord217
ord46
ord211
ord60
ord45
ord50
ord41
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord22

crypt32

CryptDecodeObjectEx
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CryptStringToBinaryA
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
PFXImportCertStore
CertFreeCertificateContext

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-file-l2-1-0

MoveFileExW
GetFileInformationByHandleEx

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedPushEntrySList

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileExA

api-ms-win-core-namedpipe-l1-1-0

WaitNamedPipeW
PeekNamedPipe

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTimeZoneInformation

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap
HeapSize
HeapReAlloc

api-ms-win-core-fibers-l1-1-0

FlsAlloc
FlsGetValue
FlsSetValue
FlsFree

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

oleaut32

SysAllocString
SysStringLen
GetErrorInfo
SetErrorInfo
SysFreeString

Sections

.text
Size: 930KB - Virtual size: 929KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 220KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 585KB - Virtual size: 585KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d984e2fce02f28a16c2809e4c638e8ae

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

dwrite

d2d1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-memory-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-localization-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-core-console-l2-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-console-l1-2-0

api-ms-win-core-console-l3-2-0

api-ms-win-core-console-l1-1-0

api-ms-win-appmodel-runtime-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-provider-l1-1-0

kernel32

user32

gdi32

comdlg32

shell32

ole32

ws2_32

wldap32

crypt32

api-ms-win-core-file-l1-2-2

api-ms-win-core-file-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-datetime-l1-1-0

oleaut32

Sections

.text Size: 930KB - Virtual size: 929KB

.rdata Size: 220KB - Virtual size: 220KB

.data Size: 20KB - Virtual size: 247KB

.pdata Size: 39KB - Virtual size: 38KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 585KB - Virtual size: 585KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 930KB - Virtual size: 929KB

.rdata
Size: 220KB - Virtual size: 220KB

.data
Size: 20KB - Virtual size: 247KB

.pdata
Size: 39KB - Virtual size: 38KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 585KB - Virtual size: 585KB

.reloc
Size: 5KB - Virtual size: 4KB