LaunchU3[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

LaunchU3.exe
Size

1.3MB
MD5

2c875b03541ffa970679986b48dca943
SHA1

cccf6836fde3fd92419664dac10fb4fd92ede6d5
SHA256

87b21514dada50062cf803b6695b50072846bd9a6cca8d67da0fcc553bff7878
SHA512

f088cf1fb4c272d25bed4e8d8a93b9e1d352796dfc0123a887ac404cc0aac1d69e4de4e94301e7e7b2297aeebff88bb64bfe2cb4b13fe362425ad472d0c1d5c5
SSDEEP

24576:5qiKZdWPNKDGEeySdoU2QBTelNvvmYnRs2NmIGlWI9F2PtFhWVO4sTY7Bo4:ci8dWVySv/BTelNvvmYn30mtPUlsTn4

Score

1^/10

Malware Config

Signatures

Files

LaunchU3.exe
.exe windows:4 windows x86 arch:x86

0522436719d20ba23f4c31f0dcb05777

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

27:a6:c0:45:e6:9c:78:76:f2:ac:0f:3b:d4:bf:bf:7e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

27/07/2007, 00:00

Not After

26/07/2009, 23:59

Subject

CN=U3 LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=R&D,O=U3 LLC,L=Redwood City,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

PDB Paths

c:\temp\U3LanchPad_Build_23.9.21.52\U3_Vob\U3LauncherOptOut_Comp\binaries\Release\LaunchU3.pdb

Imports

hid

HidD_GetProductString
HidD_GetSerialNumberString
HidD_GetManufacturerString
HidD_GetHidGuid
HidD_GetAttributes
HidD_SetNumInputBuffers
HidD_GetPreparsedData
HidP_GetCaps
HidP_GetSpecificValueCaps
HidD_GetNumInputBuffers
HidD_FreePreparsedData

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winmm

mciSendCommandW

kernel32

InterlockedIncrement
InterlockedDecrement
lstrlenW
CloseHandle
GetProcAddress
LoadLibraryW
OpenProcess
GetTickCount
FreeConsole
VerLanguageNameW
GetLastError
EnumResourceLanguagesW
GetUserDefaultLangID
CreateMutexW
ReleaseMutex
WideCharToMultiByte
WaitForSingleObject
GetModuleFileNameW
GetLocalTime
GetCurrentProcessId
GetCurrentThreadId
WriteFile
SetEndOfFile
SetFilePointer
CopyFileW
GetFileSize
CreateFileW
OutputDebugStringW
GetModuleHandleW
GetFileAttributesW
DeleteFileW
GetTempPathW
MapViewOfFileEx
CreateFileMappingW
UnmapViewOfFile
TerminateProcess
TerminateThread
GetExitCodeProcess
CreateThread
CreateProcessW
RaiseException
InitializeCriticalSection
DeleteCriticalSection
OpenMutexW
GetDiskFreeSpaceExW
GetDriveTypeW
SetErrorMode
FlushFileBuffers
RemoveDirectoryW
SetEvent
ResetEvent
MoveFileW
CreateEventW
lstrcpynW
GetStartupInfoW
ExitProcess
OpenEventW
GetCommandLineW
ResumeThread
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
SetFileTime
LocalFileTimeToFileTime
FindResourceW
GetFileTime
lstrlenA
DeviceIoControl
GetPrivateProfileStringW
LocalFree
LocalAlloc
FormatMessageW
InterlockedExchangeAdd
GetStdHandle
GetLongPathNameW
GetSystemDirectoryW
Sleep
TryEnterCriticalSection
FreeLibrary
FreeResource
GlobalFree
GlobalAlloc
GetVolumeNameForVolumeMountPointW
SleepEx
ReadFileEx
GetLogicalDriveStringsW
GetWindowsDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetLocaleInfoW
SetStdHandle
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetOEMCP
IsBadCodePtr
ReadFile
CreateFileA
GetStringTypeW
GetStringTypeA
GetTimeZoneInformation
DebugBreak
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineA
HeapFree
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
IsBadWritePtr
VirtualFree
HeapCreate
LCMapStringW
LCMapStringA
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
SetUnhandledExceptionFilter
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
QueryPerformanceCounter
LoadResource
LockResource
SizeofResource
FindResourceExW
MultiByteToWideChar
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
CompareStringA
CompareStringW
SetEnvironmentVariableA
HeapAlloc
HeapDestroy
GetVersionExA
DosDateTimeToFileTime
GetCPInfo
DeleteFileA
GetModuleFileNameA
IsBadReadPtr
GetModuleHandleA
ExitThread
GetSystemTimeAsFileTime
RtlUnwind
HeapReAlloc
HeapSize
GetProcessHeap
LoadLibraryA

user32

GetWindowTextW
GetClassNameW
SetWinEventHook
SetForegroundWindow
BringWindowToTop
PostMessageW
UnhookWinEvent
GetWindowThreadProcessId
PeekMessageW
IsWindow
CreateDialogIndirectParamW
LoadStringW
RegisterWindowMessageW
SendNotifyMessageW
wsprintfW
BroadcastSystemMessageW
SendMessageTimeoutW
SetWindowLongW
LoadCursorW
RegisterClassExW
GetWindowLongW
DestroyWindow
SendMessageW
PostQuitMessage
PostThreadMessageW
FindWindowW
DialogBoxParamW
EndDialog
GetDlgItem
SetWindowTextW
RegisterClassW
CreateWindowExW
RegisterDeviceNotificationW
SetTimer
TranslateMessage
DispatchMessageW
GetMessageW
UnregisterDeviceNotification
DefWindowProcW
KillTimer
MessageBoxW
ShowWindow
GetForegroundWindow
AttachThreadInput
UnregisterClassW

gdi32

GetStockObject

advapi32

RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExW
RegEnumKeyExW
RegEnumValueW
CryptGenRandom
CryptAcquireContextA
CryptReleaseContext
RegDeleteKeyW

shell32

ShellExecuteW
SHChangeNotify
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoInitialize
CoCreateInstance
OleRun
CreateClassMoniker
GetRunningObjectTable
StringFromCLSID
CoTaskMemFree

oleaut32

SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
VariantInit
SysAllocString
SysFreeString
VariantClear
SysStringLen

shlwapi

PathFileExistsW
PathFindExtensionW
PathStripPathW
PathIsRootW
UrlEscapeW
PathRemoveFileSpecW

Sections

.text
Size: 984KB - Virtual size: 982KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 236KB - Virtual size: 233KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0522436719d20ba23f4c31f0dcb05777

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

27:a6:c0:45:e6:9c:78:76:f2:ac:0f:3b:d4:bf:bf:7eCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

PDB Paths

Imports

hid

version

winmm

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

Sections

.text Size: 984KB - Virtual size: 982KB

.rdata Size: 236KB - Virtual size: 233KB

.data Size: 32KB - Virtual size: 44KB

.rsrc Size: 44KB - Virtual size: 41KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

27:a6:c0:45:e6:9c:78:76:f2:ac:0f:3b:d4:bf:bf:7e
Certificate

.text
Size: 984KB - Virtual size: 982KB

.rdata
Size: 236KB - Virtual size: 233KB

.data
Size: 32KB - Virtual size: 44KB

.rsrc
Size: 44KB - Virtual size: 41KB