MKLauncher[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

MKLauncher.exe
Size

943KB
MD5

e9000f08b554b824372a023826366b82
SHA1

613fd183ea20b91a56feabce3721c8b094dbe2d9
SHA256

56807e109ec15cbe152199b2be0e8daa454880478c177be7074aa4b894ce3764
SHA512

1a0f66993fafbca82deec1453dcd80f3046777414ddddf01f01471ef7c4ec3c723178a816864ceda516a743347f82a3ae1b7e31f92c0d4e45d2a4e3eaaa2f62a
SSDEEP

6144:kxZKdJD94uu6QgNqCaMG2taYDXIf90AAoUdBe3ZTa26gjlOh/:knKdtW36iMB34f90AAoUdBe3ZTa26g5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MKLauncher.exe

Files

MKLauncher.exe
.exe windows:6 windows x86 arch:x86

fa02e6c8363262f64e9fa5f1326578f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Develop\Combo\MK9\Development\Src\MK9Launcher\ComboLauncher\Release\MKLauncher.pdb

Imports

shlwapi

StrToIntW
PathAppendW

kernel32

WritePrivateProfileStringW
GetPrivateProfileStringW
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetSystemTimeAsFileTime
Sleep
GetLastError
SetLastError
WideCharToMultiByte
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer

shell32

SHGetFolderPathW
ShellExecuteW

msvcr110

_except_handler4_common
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
?terminate@@YAXXZ
_onexit
_lock
??1type_info@@UAE@XZ
__dllonexit
??3@YAXPAX@Z
memset
memcpy
__CxxUnregisterExceptionObject
__CxxDetectRethrow
_CxxThrowException
__CxxRegisterExceptionObject
_amsg_exit
_vswprintf_c_l
tolower
memmove
swscanf
__CxxFrameHandler3
_purecall
?what@exception@std@@UBEPBDXZ
__FrameUnwindFilter
_calloc_crt
_cexit
??2@YAPAXI@Z
_unlock
strstr
?__ExceptionPtrCopy@@YAXPAXPBX@Z
memchr
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??_V@YAXPAX@Z
sprintf_s
strcat_s
mbstowcs
??_U@YAPAXI@Z
__CxxQueryExceptionSize
__CxxExceptionFilter
isspace

msvcp110

?_Orphan_all@_Container_base0@std@@QAEXXZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
??0id@locale@std@@QAE@I@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z

d3d9

Direct3DCreate9

setupapi

SetupDiEnumDeviceInfo
SetupDiGetClassDevsExW
SetupDiOpenDevRegKey
SetupDiDestroyDeviceInfoList

user32

EnumDisplayDevicesW

advapi32

RegCloseKey
RegEnumValueW

ole32

CoInitializeEx

mscoree

_CorExeMain

Exports

Exports

NvOptimusEnablement

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 889KB - Virtual size: 888KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa02e6c8363262f64e9fa5f1326578f8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

kernel32

shell32

msvcr110

msvcp110

d3d9

setupapi

user32

advapi32

ole32

mscoree

Exports

Exports

Sections

.text Size: 42KB - Virtual size: 41KB

.rdata Size: 889KB - Virtual size: 888KB

.data Size: 2KB - Virtual size: 4KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 42KB - Virtual size: 41KB

.rdata
Size: 889KB - Virtual size: 888KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 6KB - Virtual size: 5KB