KFlauncher[.]exe[.]vir

General

Target
KFlauncher.exe.vir
Size 551KB
Sample240707-phd1rssapn
SHA256 53aa6c3c439042df9157823b07c3c2b4e8e39c6090b6f9558e22837eac5f7411
MD5 101219048ce6d73fb8a92a731c2f6546
SHA1 92d846e64c8d57e4db2f118e09c3fe46e67bc4b3
SHA512 79853dfaed89cc120aae0e618f9a867e8b98e60b54dfce5aa86e93605edb0f66b0d666cea64c816b4dd57b7e1902ddd3aaa0a318f2e7541828e6e054c3354c6d
SSDEEP 12288:C0P9EDfkdB92gdknOAuSoETAHOrQNUyqR0w2pkNJ5sAx:C0PyDfkHMgKfuA0HOrq4R6qJ7
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KFlauncher.exe.vir

File Explorer

KFlauncher.exe.vir

.exe 551KB

KFlauncher.exe.vir

IMPHASH b1fdca67f9b8dae5c0fa30f8218d4955
SHA256 53aa6c3c439042df9157823b07c3c2b4e8e39c6090b6f9558e22837eac5f7411
MD5 101219048ce6d73fb8a92a731c2f6546
SHA1 92d846e64c8d57e4db2f118e09c3fe46e67bc4b3
SHA512 79853dfaed89cc120aae0e618f9a867e8b98e60b54dfce5aa86e93605edb0f66b0d666cea64c816b4dd57b7e1902ddd3aaa0a318f2e7541828e6e054c3354c6d
SSDEEP 12288:C0P9EDfkdB92gdknOAuSoETAHOrQNUyqR0w2pkNJ5sAx:C0PyDfkHMgKfuA0HOrq4R6qJ7
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

53102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

OffsetRect

kernel32

CreateFileW HeapSize SetStdHandle WaitForSingleObject Sleep CreateThread VirtualAlloc FreeConsole RaiseException InitOnceBeginInitialize InitOnceComplete CloseHandle WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetLastError FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess TerminateProcess GetCurrentProcessId InitializeSListHead GetProcessHeap RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitThread FreeLibraryAndExitThread ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW

Name

.text

Size

168KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bSS

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

320KB

Virtual Size

324KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

KFlauncher.exe.vir

user32

kernel32

generic