�?\i�����^��@�;�D�`��=�K1\����]@���T�0z���탶�����]����+�G�qd�gr8?{���vcv�[��l���ĩ��m�~i����n�D�q3���qv�X?��X�,���0q�-��Z[�e�ϧ�<�o4��ݢ�y�u �!�Ab�g�������p�>���Q�!p�=A;�3�%�Z�F^�c�����]����L��d�>���LN�D6l����5���^b��p��1b{�}|?�uɆ]�f����n{�1��h��C��B����^����X���l�� !�Ѥi$*Vʊ���������+[���r��r���|���.�מ�`����˶��lY�Q��1G@WmrH�ܳ��6y\sc�H��b=��轉������6;�Į��.����%�fp�f<�������W��x���"���G7���������uK������9J����p0�8��qznC(��,� �+��4�[+����+�#�A`$@(MrrW�k�_a�$4�=�{����j�K�u��'l�z7�2�X&W�S<�2���R)[���j�!���ч�s��)��/0E�o��O����幾ޥ�P�R�4������'�9տ�~�$Y�5���Jm����TY���"Ѿ�L�e�)m��5cm���c\SG(㤩�{M�6�?����8�m��� DH����sXu)��c�I7;q�qm�u݉$�K���>~��2{ٗN�@���S�,��W ���Ǚ��W}w�L�b��V�� �G9��K���.�C�I�1�^��I���\���V�B|a�<���'<��!%�Σv�g�d7��c":%���j��spS����M* ��4V���2���qmi s�w�k��-6� ��"�n!5SW���&$ ��+1��䩹��O��<|s?�̜q*u푡������$k�ZHp�I���ґA�s��[{��I����d �9����<�h\s�VCn���+V'E\b�����^p@&���rʛ����i�C:������fW� �Hj�/c�L/$!�۲�İxP[o�О2 �������Es�;�}0�j�]�����Us���`H������x�\�����U��6կ��Y���viF������`e���%�qGSx �s<$e�c�����lb����s����"�J���yk��-~�|�.|�>�uF�����X�> �y�H��<�l�尌T�s���^�q�;��UK+{�C�Vٟn�>h�@�(�%hӃP�pnf��淳�S��NP�}G�(���欂�~[��E�u���������U�����U��T1\M��H�Ozb���0���a�y2�M��4ꆲ\9��G�+���v,����t��f'����"Tȁ�L� �{ y���G��Y�8j�O�U+%�{���9ClQ���ĪR�RWl���(qތ�P��h�/��a�}(ʋ���(�W��(P�+E㫸ř���o!V��9�}�i����yw���ӆ�&W��۵E�.�p9S{�)� _!m�oCp "��6!�^0��0sa��&�������#t�I�硟mꄁᖴ��M3Z�ɡ\2�>p;7�]ݤ?%�J?����S�T���W��v~Ŕ������������+J������ ��t���%� �8��*�a�gH����#��@J��i���X�(}Ue��2��E���Gڶu ܳ��P��W�ડꁤӷ�؊^��y�۞]Ȋ�O��&d�5�R�L��$�ފ���}+r�鐗�\�j!C�4q�����AzSͰP3��ƣҫDjb}6sK���m7�Ds�н�����o�����٥y̽��=��B\�Ĭ|�;�o'�Aހ����ys�a*����z�R�����2(=?ի� ��0V��/����٫��X�l�H@S�Z�i{M����v�:�S1"s� ��H�*�,��,�rf�:�h�A�M��c��<��D��.�!�ݐ�CX�k���d� �R��.��~b�^q(1�'�M��Ĭ��9RM��̙��A���yQ�~W`<i16h�-��u�����S| n�����*B��A85���"�.L�3��~��BD���� ����n�`�?� b^�I�ڀ����3��~�1�Я�@AI7��%��jfZ;���L�8>QK��K�� ��Y����N�2�/���쪚��g�Hh�;+ o[/-АH��a%���K"겇�0�.��J�ٟb��X��z���3|B0)��+H��FS���kK嚙=�)�AB��=ә ���&��G��ޏ@ M������ٌ�)��}X��6[-��bpA(F����LyZ5�W49����f�]1ϥ�^�.PLҪ�0�>����yq����:�x�x@����0!g��~vN6��Bw�ޘ�1�.��3_�V��ז=��tШ������k�P%���Z���Df~�y��h|����"�)3�A3;���+]�!���L��.����d�.�i㒖7VT������+a�\I|��[��O�2��h�@��{�'�V��h~fs�,B�������ͩ`���"�CX����L)�{����GT�zV;��hzW@��S|�%��R�I�#�%�J�ǁ�̌�/�b��%Q�h�W"��E@��m����N��3�N۹b��/�)�=w���p@V�B�2�6�EdW.IK��0�rv����$ϝk��k��h�j����믇��~���g�0�HC��ת����H"�GA�Yi��O3˷����[*� w�����cR߇6�1��.:=|��U��Db ���)��H6����û��� �E\ua�����f݆{#�J���dF��� u�H�����@*��Bi��q�B� �2���W����W]:D��0���~i*E<F�D��:U =��i� ������y?��N���Z���w��ü9��;x�6�O��iC#��>7 �B�A��UJB���pM���*K�.�������\����ַe~ė([�k���O��-� �r�i�S�-�8m��K�v��E)5�gy�<�Q��v�Phkj��t �� ����6i?�,��h����8Hڞj�Ef�f�x �+�F�&�/t��������J�yb+22�Jv�u>b���I�����1=�P��SR$��| �B��v(�0������M��U�ڮa�6_�F�6H��qsU��ê6�e��ÓZ�Y<�hK�^ 8xҜ`��x��`@~B�g�������co=�d�pK� ���]��+1ab���gX�)��1������*���qQw�;+�]#,���N f.3��&�ԗr����d�_H��to��:u�NJ�ና{�A^�Ƴ~ 6o( ������,�}F�vx�z_��Fz�C4x�ȽXt.�:ƽco��-��3_�<t�UO˼��AҩjO٠��ڰ�����g��_� �F�w��⺁?�+��}(J[M���� ��'�|.� 8��|�f����(�����@����X|,��]�=Ӽ����{��B���n��a��ab�o�f�h:��^�Xyy���G��t�����*���yV }̱���6 �@�Pᘨ�,�
Static task
static1
Behavioral task
behavioral1
Sample
PLauncher.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
PLauncher.exe
Resource
win10v2004-20240802-en
General
-
Target
PLauncher.exe
-
Size
10.0MB
-
MD5
baff8086d821a3684b7cf2d6c52352d2
-
SHA1
d716e7fc04988ddc3a31ca5e812ed6416f160a83
-
SHA256
8ff56fab3fe9f2f73c63c2093a6bf59eb2d3206400f066c647f8a15fe084eb0e
-
SHA512
de2c8630223fc1d8eab96fc4cff32b0607bbc9dd2d651bea19ab22605fa5ac3576540c1d53337b8395a67738cd199dd968ab92bfe8f6f7ae813ad35b59613274
-
SSDEEP
196608:Xs7rE/sEEAS1eWLYDHI2bu5zAl3k8C5epyKLZFFASp+Y/TM/Wn11+/M:OE/sfd1MD8eE2LWig/W1aM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PLauncher.exe
Files
-
PLauncher.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 630KB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 201KB - Virtual size: 332KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 440KB - Virtual size: 988KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 66KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 294KB - Virtual size: 39.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8.4MB - Virtual size: 8.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE