C:\Users\dylan-work\Documents\projects\mc-w10-version-launcher\MCLauncher\obj\x64\Release\MCLauncher.pdb
Static task
static1
Behavioral task
behavioral1
Sample
MCLauncher.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
MCLauncher.exe
Resource
win10v2004-20240802-en
General
-
Target
MCLauncher (1).zip
-
Size
1.4MB
-
MD5
04cf65781f2f3d9da622a710cce581b2
-
SHA1
4858a6d47628c18320f64beb5841a424763bf8f8
-
SHA256
4e62cefbd747b0656dd19fd55e6f3b222b139cb7b52c80db474f72035d4ed701
-
SHA512
84ff9e35a9abf3ed401e161f4e2357f88702ab50877f94150d57c8cb58d4424e66adf0ce979fc529a30cff28476ea111bc26d171b8c1983d731093cb8d4cf591
-
SSDEEP
24576:XpAIO/9yU267EaW7OHv/WTIEhtatTpcjQdxWfU2dQ5sAys2O:yj8OH2TbXatTpivdQ5pys9
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/MCLauncher.exe unpack001/WUTokenHelper.dll
Files
-
MCLauncher (1).zip.zip
-
MCLauncher.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Sections
.text Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
MCLauncher.pdb
-
Newtonsoft.Json.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Code Sign
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77Certificate
IssuerCN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before10/11/2006, 00:00Not After10/11/2031, 00:00SubjectCN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23Certificate
IssuerCN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before27/04/2018, 12:41Not After27/04/2028, 12:41SubjectCN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7eCertificate
IssuerCN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=USNot Before25/10/2018, 00:00Not After29/10/2021, 12:00SubjectSERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate
IssuerCN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before04/01/2017, 00:00Not After18/01/2028, 00:00SubjectCN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before07/01/2016, 12:00Not After07/01/2031, 12:00SubjectCN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
e7:f7:51:e6:72:c9:8b:01:74:26:25:32:5b:fe:58:a5:df:cb:23:3c:93:43:64:58:dc:10:9e:40:c8:d1:97:dcSigner
Actual PE Digeste7:f7:51:e6:72:c9:8b:01:74:26:25:32:5b:fe:58:a5:df:cb:23:3c:93:43:64:58:dc:10:9e:40:c8:d1:97:dcDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 649KB - Virtual size: 648KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Newtonsoft.Json.pdb
-
WUTokenHelper.dll.dll windows:6 windows x64 arch:x64
e7dcda8b49c601567cff5a8685df8fd0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\Users\dylan-work\Documents\projects\mc-w10-version-launcher\x64\Release\WUTokenHelper.pdb
Imports
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoIncrementMTAUsage
CoCreateFreeThreadedMarshaler
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
memset
__std_exception_destroy
__std_exception_copy
__std_type_info_destroy_list
memcpy
_CxxThrowException
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_cexit
terminate
_execute_onexit_table
_register_onexit_function
_initterm
_initterm_e
_crt_atexit
_initialize_onexit_table
_configure_narrow_argv
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfwprintf
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
kernel32
GetModuleHandleW
GetProcAddress
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CloseHandle
RtlLookupFunctionEntry
RtlVirtualUnwind
WakeConditionVariable
SleepConditionVariableSRW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InterlockedPushEntrySList
UnhandledExceptionFilter
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
RtlCaptureContext
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
oleaut32
SysFreeString
api-ms-win-core-winrt-error-l1-1-0
GetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsGetStringLen
WindowsDeleteString
WindowsGetStringRawBuffer
Exports
Exports
GetWUToken
Sections
.text Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
WUTokenHelper.pdb