launcher5-signed[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

launcher5-signed.exe
Size

22.4MB
MD5

edbc1a24876bfc20b97b168aadfd271b
SHA1

92e844b6fc51cca96a1cc68c7debd73b42903033
SHA256

817c56aad3ef6ca99f2ba54a294b4d5388575ece586ead7ca410486b2913147d
SHA512

526e3cbb61bf4da6f429298474ba174edf1fc5fbc6287e646f4474cdca0d96b431ad188ff7421d9286bb4f312880daf0a6e8bcdd744bfeec7c2966ab8b2e4853
SSDEEP

393216:+uBhX/hERSC8EmDpkI8ti7skydvVWXqHvXBbCeiIre8V7:+uHXzCtkl8/7oA8BIre07

Score

1^/10

Malware Config

Signatures

Files

launcher5-signed.exe
.exe windows:6 windows x64 arch:x64

ed089b32dc5a5d25e18d82e2e09fd291

Code Sign

56:00:00:0c:87:de:d2:d0:b4:fd:c0:8f:fc:00:00:00:00:0c:87
Certificate

Issuer

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Not Before

31/08/2020, 11:24

Not After

17/06/2021, 23:59

Subject

CN=Intel(R) Software Development Products,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/10/2015, 00:00

Not After

17/06/2021, 23:59

Subject

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Not Before

30/05/2014, 16:35

Not After

17/03/2021, 18:33

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9f
Certificate

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Not Before

20/04/2018, 16:52

Not After

17/03/2021, 18:33

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:0E37-9649-08C5,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

00:a2:5a:40:2c:9a:69:ad:77:12:53:ac:74:af:e4:a1:7e:07:93:90:34:4e:cf:d7:77:47:d6:18:ca:06:29:db
Signer

Actual PE Digest

00:a2:5a:40:2c:9a:69:ad:77:12:53:ac:74:af:e4:a1:7e:07:93:90:34:4e:cf:d7:77:47:d6:18:ca:06:29:db

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualProtect

msvcp140

?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception

api-ms-win-crt-stdio-l1-1-0

_fseeki64

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-runtime-l1-1-0

_exit

api-ms-win-crt-heap-l1-1-0

realloc

api-ms-win-crt-string-l1-1-0

_stricmp

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 16.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pedrin0
Size: - Virtual size: 7.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.pedrin1
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pedrin2
Size: 22.4MB - Virtual size: 22.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ed089b32dc5a5d25e18d82e2e09fd291

Code Sign

56:00:00:0c:87:de:d2:d0:b4:fd:c0:8f:fc:00:00:00:00:0c:87Certificate

Extended Key Usages

Key Usages

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3Certificate

Extended Key Usages

Key Usages

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bfCertificate

Key Usages

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9fCertificate

Extended Key Usages

Key Usages

00:a2:5a:40:2c:9a:69:ad:77:12:53:ac:74:af:e4:a1:7e:07:93:90:34:4e:cf:d7:77:47:d6:18:ca:06:29:dbSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: - Virtual size: 15KB

.rdata Size: - Virtual size: 10KB

.data Size: - Virtual size: 16.5MB

.pdata Size: - Virtual size: 1KB

.pedrin0 Size: - Virtual size: 7.2MB

.pedrin1 Size: 512B - Virtual size: 224B

.pedrin2 Size: 22.4MB - Virtual size: 22.4MB

.rsrc Size: 512B - Virtual size: 480B

56:00:00:0c:87:de:d2:d0:b4:fd:c0:8f:fc:00:00:00:00:0c:87
Certificate

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9f
Certificate

00:a2:5a:40:2c:9a:69:ad:77:12:53:ac:74:af:e4:a1:7e:07:93:90:34:4e:cf:d7:77:47:d6:18:ca:06:29:db
Signer

.text
Size: - Virtual size: 15KB

.rdata
Size: - Virtual size: 10KB

.data
Size: - Virtual size: 16.5MB

.pdata
Size: - Virtual size: 1KB

.pedrin0
Size: - Virtual size: 7.2MB

.pedrin1
Size: 512B - Virtual size: 224B

.pedrin2
Size: 22.4MB - Virtual size: 22.4MB

.rsrc
Size: 512B - Virtual size: 480B