Launcher[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Launcher.zip
Size

416KB
MD5

f97db939a68e7157fa5277091ece2104
SHA1

23523b68a68eb0cf5d51b5f36199ab3d6bc68e1b
SHA256

f8373c448fd5ff00793bbf6bbd24612c38f05b89c6cad404884c12621a7443ac
SHA512

21245623b99d0b328ad3628970f1284cc0095b4d9d83417fcfb9877dc34fe7a218f8e0d25244dd9967751ec07f4ccea11fa2731fb306dd9332f0415176dcda38
SSDEEP

6144:QenfFKNPv6PSTnLteTsHMVeo8d3h9uEEDQR1dtZzwIyURsjoic0Xzwt1sI35HWC1:QefFKFCAL8Veo8duk1dtppDvUwtqIph

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Launcher/Speed_Loader.exe

Files

Launcher.zip
.zip
Launcher/SegoeUI.ttf
Launcher/Speed_Loader.exe
.exe windows:6 windows x64 arch:x64

2ad7d55f58d616bc88072015a529bbff

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\elila\Downloads\KeyAuth-IMGUI-LoginExample-master\KeyAuth-IMGUI-LoginExample-master\Release\KeyAuthLoginExample.pdb

Imports

d3d9

Direct3DCreate9

kernel32

GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
InitializeSListHead
RtlVirtualUnwind
OutputDebugStringW
GetCurrentThreadId
HeapFree
HeapSize
GetLastError
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetFileSizeEx
CreateFileA
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
GetTickCount
AllocConsole
GetModuleHandleW
Sleep
LoadLibraryA
GetProcAddress
QueryPerformanceFrequency
QueryPerformanceCounter
VerSetConditionMask
WideCharToMultiByte
MultiByteToWideChar
GlobalFree
GlobalLock
HeapReAlloc
HeapAlloc
HeapDestroy
DeleteCriticalSection
GetProcessHeap
GetCurrentProcess
CloseHandle
LocalFree
SetLastError
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
SleepEx
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
VerifyVersionInfoA
GlobalUnlock
GlobalAlloc
RtlLookupFunctionEntry
InitializeCriticalSectionEx

user32

GetWindowRect
UpdateWindow
GetAsyncKeyState
GetDesktopWindow
FindWindowA
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
UnregisterClassW
PostQuitMessage
SetLayeredWindowAttributes
PeekMessageW
DispatchMessageW
TranslateMessage
LoadCursorW
OpenClipboard
CloseClipboard
SetClipboardData
MessageBoxA
ScreenToClient
GetClipboardData
EmptyClipboard
IsChild
GetKeyState
DefWindowProcW
GetCapture
SetCapture
ReleaseCapture
GetForegroundWindow
ClientToScreen
GetClientRect
SetCursorPos
GetCursorPos
SetCursor

shell32

ShellExecuteA
ShellExecuteW

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow

xinput1_4

ord4
ord2

msvcp140

?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
_Query_perf_counter
?_Xbad_function_call@std@@YAXXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
_Query_perf_frequency
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ

normaliz

IdnToAscii

wldap32

ord46
ord211
ord60
ord45
ord50
ord41
ord22
ord143
ord27
ord32
ord33
ord35
ord79
ord30
ord217
ord200
ord301
ord26

crypt32

CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertOpenStore
CertCloseStore
CertFreeCertificateChain
CertEnumCertificatesInStore

ws2_32

socket
closesocket
recv
send
ntohl
gethostname
sendto
recvfrom
freeaddrinfo
WSAGetLastError
getaddrinfo
bind
connect
select
__WSAFDIsSet
ioctlsocket
listen
accept
WSACleanup
getpeername
WSAStartup
WSAIoctl
WSASetLastError
htonl
setsockopt
ntohs
htons
getsockopt
getsockname

userenv

UnloadUserProfile

vcruntime140

__C_specific_handler
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memcmp
__current_exception_context
memmove
memcpy
memchr
strstr
__std_terminate
strrchr
memset
strchr
__current_exception

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strcspn
strncmp
strcmp
tolower
strpbrk
strncpy
_strdup
strspn
isupper

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_errno
_resetstkoflw
exit
_invalid_parameter_noinfo
strerror
__sys_nerr
_invalid_parameter_noinfo_noreturn
_wassert
_beginthreadex
_getpid
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
terminate
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
system
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

fseek
ftell
__acrt_iob_func
__p__commode
fwrite
fread
__stdio_common_vsprintf
fgets
fputc
__stdio_common_vsscanf
_read
feof
_write
fputs
fopen
_close
_open
fflush
_set_fmode
fclose
_wfopen
_lseeki64

api-ms-win-crt-heap-l1-1-0

malloc
free
calloc
_callnewh
realloc
_set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

ceilf
acosf
sqrtf
sinf
__setusermatherr
fmodf
floorf
cosf

api-ms-win-crt-convert-l1-1-0

strtod
strtoul
strtoull
atoi
strtoll
strtol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
localeconv

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64

api-ms-win-crt-filesystem-l1-1-0

_access
_unlink
_stat64
_fstat64

advapi32

GetLengthSid
OpenProcessToken
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
CopySid
IsValidSid
GetTokenInformation

Sections

.text
Size: 584KB - Virtual size: 584KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 149KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2ad7d55f58d616bc88072015a529bbff

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

d3d9

kernel32

user32

shell32

imm32

xinput1_4

msvcp140

normaliz

wldap32

crypt32

ws2_32

userenv

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

advapi32

Sections

.text Size: 584KB - Virtual size: 584KB

.rdata Size: 149KB - Virtual size: 149KB

.data Size: 1KB - Virtual size: 4KB

.pdata Size: 26KB - Virtual size: 25KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 584KB - Virtual size: 584KB

.rdata
Size: 149KB - Virtual size: 149KB

.data
Size: 1KB - Virtual size: 4KB

.pdata
Size: 26KB - Virtual size: 25KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1KB - Virtual size: 1KB