E:\Tool\WeGame_Launcher\proj\build\bin\Release\launcher.pdb
Static task
static1
Behavioral task
behavioral1
Sample
97c5209221ad1294488119f5c37e4263841a8e57d1aa68143d9e4da64d64572d.exe
Resource
win7-20240903-en
General
-
Target
97c5209221ad1294488119f5c37e4263841a8e57d1aa68143d9e4da64d64572d
-
Size
2.8MB
-
MD5
d0957b8b6e1b88a2a05c03f48b4bfb2d
-
SHA1
64eab9983698039c7a90899db4b7047b81ded7c2
-
SHA256
97c5209221ad1294488119f5c37e4263841a8e57d1aa68143d9e4da64d64572d
-
SHA512
8ee84ca8bcadaaeef801517859bae7a96a74a564a112b1a7dce575ec4cfc1ed722e55bc2fddeb1906b0b3e612c0ec7a3d3ec721962a8caaf3bb5123553f8cd8b
-
SSDEEP
49152:lLPkdVO3K46qKCSoJhMPmuYnH7mSl5cTsp/UJQyKnzZ/Yeco/rZjGxqm:93K46qKDKMPMnHRcQqYZWt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 97c5209221ad1294488119f5c37e4263841a8e57d1aa68143d9e4da64d64572d
Files
-
97c5209221ad1294488119f5c37e4263841a8e57d1aa68143d9e4da64d64572d.exe windows:5 windows x86 arch:x86
a6a388164482761a7d57623069911127
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
Process32FirstW
CreateToolhelp32Snapshot
GetPrivateProfileIntW
WritePrivateProfileStringW
GetModuleHandleW
GetPrivateProfileStringW
OutputDebugStringW
Sleep
OutputDebugStringA
FindNextFileW
GetSystemTime
FileTimeToSystemTime
FindFirstFileW
LocalFree
GetCommandLineW
GetCurrentProcess
GetEnvironmentVariableW
SetEnvironmentVariableW
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
ReadFile
WriteFile
Module32FirstW
OpenProcess
SetLastError
TerminateProcess
SleepEx
LoadLibraryA
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapSetInformation
InterlockedCompareExchange
Process32NextW
DecodePointer
EncodePointer
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTempPathA
GetConsoleScreenBufferInfo
GetStdHandle
InitializeCriticalSection
GetWindowsDirectoryA
SetConsoleTextAttribute
GetComputerNameA
GetVersionExW
InterlockedDecrement
GetExitCodeProcess
MoveFileExW
GetWindowsDirectoryW
DeviceIoControl
GetDriveTypeW
GetDiskFreeSpaceExW
TerminateThread
CreateThread
OpenFileMappingA
CreateFileMappingA
GetUserDefaultUILanguage
CreateProcessW
FindClose
SetFileAttributesW
ReleaseMutex
CreateMutexA
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateDirectoryW
CreateFileW
GetFileSize
OpenEventA
CreateEventA
QueryPerformanceFrequency
QueryPerformanceCounter
WideCharToMultiByte
MultiByteToWideChar
CreateEventW
WaitForSingleObject
DeleteFileW
GetTickCount
OpenEventW
GetCurrentProcessId
TlsGetValue
FormatMessageA
VerifyVersionInfoA
SetEvent
CloseHandle
GetModuleFileNameW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetFileType
ExpandEnvironmentStringsA
GetModuleHandleA
GetVersion
GlobalMemoryStatus
SystemTimeToFileTime
FlushConsoleInputBuffer
FreeLibrary
LoadLibraryW
GetLastError
InterlockedExchange
GetProcAddress
user32
PeekMessageW
DestroyWindow
SetWindowLongW
TranslateMessage
DispatchMessageW
SetCursor
ClipCursor
MessageBoxW
wsprintfW
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA
SetTimer
KillTimer
UpdateWindow
ShowWindow
CreateWindowExW
IsWindow
DefWindowProcW
GetWindowLongW
shell32
ShellExecuteW
CommandLineToArgvW
ShellExecuteExW
SHFileOperationW
SHGetFolderPathW
advapi32
AdjustTokenPrivileges
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
DeregisterEventSource
ReportEventA
RegisterEventSourceA
OpenProcessToken
LookupPrivilegeValueW
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
shlwapi
PathCanonicalizeW
msvcp100
??1_Lockit@std@@QAE@XZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??Bid@locale@std@@QAEIXZ
?id@?$ctype@D@std@@2V0locale@2@A
??0_Lockit@std@@QAE@H@Z
?id@?$collate@D@std@@2V0locale@2@A
??1facet@locale@std@@UAE@XZ
??1_Locinfo@std@@QAE@XZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??0facet@locale@std@@IAE@I@Z
??0_Locinfo@std@@QAE@PBD@Z
?c_str@?$_Yarn@D@std@@QBEPBDXZ
_Strcoll
_Strxfrm
?tolower@?$ctype@D@std@@QBEDD@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?_Xmem@tr1@std@@YAXXZ
?max@?$numeric_limits@D@std@@SADXZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$ctype@_W@std@@2V0locale@2@A
??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PAV32@@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@_JHH@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?_Xlength_error@std@@YAXPBD@Z
??1_Container_base12@std@@QAE@XZ
?_Orphan_all@_Container_base0@std@@QAEXXZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAH@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?_BADOFF@std@@3_JB
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?is@?$ctype@D@std@@QBE_NFD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?_Xinvalid_argument@std@@YAXPBD@Z
_Stolx
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_K@Z
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Xbad@tr1@std@@YAXW4error_type@regex_constants@12@@Z
?_Incref@facet@locale@std@@QAEXXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Xout_of_range@std@@YAXPBD@Z
msvcr100
_lock
_onexit
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
exit
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
__dllonexit
_fmode
__set_app_type
_except_handler4_common
?terminate@@YAXXZ
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_unlock
strpbrk
_stat64i32
_gmtime64
wprintf
_fstat64
isalnum
_beginthreadex
fputc
fgets
fputs
qsort
_strtoi64
strtoul
isalpha
strncmp
_stat64
__sys_nerr
strerror
srand
_CIsqrt
strnlen
_snprintf
sprintf_s
calloc
_snprintf_s
fopen
toupper
signal
strncpy
_lseeki64
strstr
atoi
strspn
isdigit
isxdigit
tolower
isspace
_unlink
_fdopen
_strdup
_vsnprintf
sscanf
_getpid
_close
getenv
_write
strrchr
_wunlink
fprintf
_wassert
strtol
_errno
_popen
fflush
__iob_func
strerror_s
_localtime64_s
?_open@@YAHPBDHH@Z
_pclose
?_wopen@@YAHPB_WHH@Z
perror
abort
_wcsdup
_wcslwr_s
_stricmp
realloc
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
strchr
swscanf_s
strncpy_s
__RTDynamicCast
??8type_info@@QBE_NABV0@@Z
_vswprintf_c_l
rand
memcpy_s
strncat_s
_strtoui64
_wcstoi64
_time64
??0exception@std@@QAE@XZ
wctob
sprintf
??_V@YAXPAX@Z
vsprintf_s
free
malloc
fseek
ftell
fread
printf
wcsncpy_s
_snwprintf_s
wcschr
_vsnwprintf_s
memchr
memcmp
wcscpy_s
fwrite
_wfopen
fclose
wcsrchr
_time32
wcscat_s
strcpy_s
_wcsicmp
_purecall
_waccess
??0exception@std@@QAE@ABV01@@Z
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
vswprintf_s
_CxxThrowException
memcpy
memmove
strlen
__CxxFrameHandler3
wcslen
??2@YAPAXI@Z
memset
??3@YAXPAX@Z
_commode
_open
isupper
wcsstr
raise
strcmp
_strnicmp
ferror
_setmode
_fileno
feof
islower
isprint
isgraph
_getch
swprintf_s
_read
iphlpapi
GetAdaptersInfo
ws2_32
recv
send
closesocket
getsockopt
__WSAFDIsSet
connect
bind
listen
ioctlsocket
setsockopt
socket
WSACleanup
inet_addr
WSAStartup
gethostbyname
inet_ntoa
WSAGetLastError
ntohl
htonl
select
htons
gethostname
shutdown
WSASetLastError
WSAIoctl
getsockname
getpeername
freeaddrinfo
getaddrinfo
sendto
recvfrom
accept
ntohs
wldap32
ord60
ord50
ord301
ord26
ord79
ord35
ord32
ord200
ord46
ord41
ord22
ord211
ord143
ord33
ord27
ord30
normaliz
IdnToAscii
ole32
StringFromCLSID
IIDFromString
CoUninitialize
CoCreateGuid
CoInitialize
CoCreateInstance
CLSIDFromProgID
CoTaskMemFree
oleaut32
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysFreeString
SysStringLen
VariantInit
VariantClear
VariantChangeType
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 407KB - Virtual size: 407KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 92KB - Virtual size: 182KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 888KB - Virtual size: 888KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE