Launcher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Launcher.exe
Size

189KB
MD5

d24ab08d6b0f93302ad8618dd72f869f
SHA1

2a944e1bf8a438649553cfde1034ff1acc9219c0
SHA256

fa98078217409e88631f41d7b0bd29a8c5889df46c534edb7da72d17109375ea
SHA512

49d8d923c64599a4e940fae0cff7eaa4d87de75fea46c2a3e4c5a6bf63dfd7f4b4163a1630e7b64174df9cd875cbf3bf556a30aba8ef2a3b3910573c57d8409e
SSDEEP

3072:wCML+fTiRqs4BeVRsFtDnlDq6stJrqvdDFdS3QsFp:gL+fTiv45jNq6sbW5FoFp

Score

1^/10

Malware Config

Signatures

Files

Launcher.exe
.exe windows:4 windows x86 arch:x86

2593177288af9ed6a9a0b94340086b1e

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

46:97:e3:6a:b4:3a:8b:ee:4b:39:41:70:d9:ab:43:17
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

08/08/2006, 00:00

Not After

08/08/2007, 23:59

Subject

CN=Travellers Tales (UK) Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Travellers Tales (UK) Ltd,L=Knutsford,ST=Cheshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

41:e1:fc:84:07:12:c4:02:99:33:47:56:94:c5:fd:79:89:32:c0:b9
Signer

Actual PE Digest

41:e1:fc:84:07:12:c4:02:99:33:47:56:94:c5:fd:79:89:32:c0:b9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Projects\Launcher\Release\Launcher.pdb

Imports

comctl32

ord17

kernel32

Sleep
GetCommandLineW
GetSystemDefaultUILanguage
GetSystemInfo
VirtualProtect
FindFirstFileW
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
GetLocaleInfoA
FindClose
VerSetConditionMask
VerifyVersionInfoW
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
RtlUnwind
RaiseException
GetStartupInfoA
GetCommandLineA
GetVersionExA
HeapAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
TlsAlloc
SetLastError
GetLastError
TlsFree
TlsSetValue
TlsGetValue
SetUnhandledExceptionFilter
HeapReAlloc
HeapSize
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LoadLibraryA
InterlockedExchange
VirtualQuery
InitializeCriticalSection
IsBadReadPtr
IsBadCodePtr
GetACP
GetOEMCP
GetCPInfo

user32

CreateDialogParamW
LoadIconW
SetClassLongW
SetWindowTextW
GetDlgItem
EnableWindow
ShowWindow
UpdateWindow
DestroyWindow
PeekMessageW
DispatchMessageW
IsWindow
TranslateMessage
IsDialogMessageW
SetFocus

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

ShellExecuteW

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2593177288af9ed6a9a0b94340086b1e

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

46:97:e3:6a:b4:3a:8b:ee:4b:39:41:70:d9:ab:43:17Certificate

Extended Key Usages

Key Usages

41:e1:fc:84:07:12:c4:02:99:33:47:56:94:c5:fd:79:89:32:c0:b9Signer

Headers

File Characteristics

PDB Paths

Imports

comctl32

kernel32

user32

advapi32

shell32

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 128KB - Virtual size: 127KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

46:97:e3:6a:b4:3a:8b:ee:4b:39:41:70:d9:ab:43:17
Certificate

41:e1:fc:84:07:12:c4:02:99:33:47:56:94:c5:fd:79:89:32:c0:b9
Signer

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 128KB - Virtual size: 127KB