KFlauncher.rar
- SHA256 3d2f3b62bdc8d352154301076564c9c55cebb236e41f4f0098e9615c10e549f9
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cef1c2e41a626163f0dafa331bb814e0fc4eb6f9714c9f29c4d5bda80a95c2ed.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
cef1c2e41a626163f0dafa331bb814e0fc4eb6f9714c9f29c4d5bda80a95c2ed.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
f63ac140ab4aabfdb9da63f45f22e696ba17186e09aafb14a9ef9137a48bfe4b.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
General
- Target KFlauncher.rar
- Size 3.8MB
- Sample240602-m9klhsbc5s
- SHA256 3d2f3b62bdc8d352154301076564c9c55cebb236e41f4f0098e9615c10e549f9
- MD5 e5206f09813a188db09bb66b11d5540d
- SHA1 785e81c13788b1eac4967488a7f28eab980af2ea
- SHA512 0c79327fa0b295fe97e2c826192fdc61f68330d3a6c2e7debcd37a6bfe9eb28703b5922dc519a639a9354955becea716b012434e6d7dccb5b5a5bac1a2c4bb0d
- SSDEEP 98304:OY9TI3XM/rB0WcTgs9Yuktwjr6cB1sWQ6yB3Xl5hh2M0n0hQZixqmF1QUa:OY9TDeWcTgsKttwj+cB1vyFhR00+ZixE
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/f63ac140ab4aabfdb9da63f45f22e696ba17186e09aafb14a9ef9137a48bfe4b.exe.vir
File Explorer
-
KFlauncher.rar.rar 3.8MB
-
cef1c2e41a626163f0dafa331bb814e0fc4eb6f9714c9f29c4d5bda80a95c2ed.exe.vir.exe 3.5MB
-
f63ac140ab4aabfdb9da63f45f22e696ba17186e09aafb14a9ef9137a48bfe4b.exe.vir.exe 3.5MB
cef1c2e41a626163f0dafa331bb814e0fc4eb6f9714c9f29c4d5bda80a95c2ed.exe.vir
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 cef1c2e41a626163f0dafa331bb814e0fc4eb6f9714c9f29c4d5bda80a95c2ed
- MD5 35d17c62b2f8e47da31ac293d2c0f0e8
- SHA1 7faaf3fe14c7128a9debcd37940a6959ddff7a9f
- SHA512 6a9f28d942b63c06a32f9046e7d721aef5b06c12992bde49e753bc033ef485389208f9a37e7ccf661ed0ba9381f2b20984ff7c9f37011e96797d5ccd6a5edca3
- SSDEEP 49152:qwAJ+k5KTXxwMT+nN6CT2rZsJf4SD7tIN2mdIsAmFrx1YhuN5gdRd:qwAJD0wMT+nAC77edEmFr0W8v
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
1e:ac:99:65:72:55:ae:d9:44:ba:b5:9b:a5:f6:fb:69:7b:44:8f:ed:8e:02:42:aa:82:63:01:3d:f8:5c:20:05
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=MSI Thin GF63 12UC-1094X 15.6 (1920x1080) IPS 144
Chains
Jun 1, 2024
Subject
CN=MSI Thin GF63 12UC-1094X 15.6 (1920x1080) IPS 144
Serial Number
57:ce:7b:4a:6d:fd:78:87:4a:16:93:0e:2c:c8:b5:dd
Issuer
CN=MSI Thin GF63 12UC-1094X 15.6 (1920x1080) IPS 144
Timespan
May 31, 2024 - Jun 1, 2034
Subject
CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 3, 2023 - Aug 2, 2034
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
3492078
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
KFlauncher.pdb
mscoree
_CorExeMain
Name
.text
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
151KB
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f63ac140ab4aabfdb9da63f45f22e696ba17186e09aafb14a9ef9137a48bfe4b.exe.vir
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f63ac140ab4aabfdb9da63f45f22e696ba17186e09aafb14a9ef9137a48bfe4b
- MD5 5412cdf1d821b7a4a7ca323899641dd5
- SHA1 a493182a0a8221a9562c0c40f5445ca8e19c7326
- SHA512 4673535aec3d158e6747fbf7be1d902db7dae5e03b3659690b73d2f0c3b843b1a83e26752949f26951a567a7d4a0bc9234f05509f3b5cb1e0cc467b8fcf0f00d
- SSDEEP 49152:HwAJ+k5KTXxwMT+nN6CT2rZsJf4SD7tIN2mdIsAmFrx1YhuN5gdR:HwAJD0wMT+nAC77edEmFr0W8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3492078
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
KFlauncher.pdb
mscoree
_CorExeMain
Name
.text
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
151KB
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ