PekoraPlayerLauncher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
PekoraPlayerLauncher.exe
Size 1.4MB
Sample260227-1ls5msg12a
SHA256 a3b3a175d5f15c7794cf51412dd54073efaa0b98376ba0b906245128f72015b3
MD5 f745edf5a96ba145ca392df6aa67fe6e
SHA1 a6c3eddf363ad26c17121d4ed4d41fc7fe6153e9
SHA512 ee89006b29fc8fd32cbf8c446d36fd56a325d8e5771dd0e4b423225e43995b572248faf715dc371ebc95b0a45606350d0e8c9f12a8d7205e4849eba0eb07acf9
SSDEEP 24576:6r1tT1Gq71jvmhom9yjYpADVoEUmCHQCt:6rb1Xdjm9yjYpADqmCwCt
TLSH
T158655AC2EE4E11E8E07584F5C5224855E26F3C2AB2609ACB128172D64F77D537B3AF1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PekoraPlayerLauncher.exe

File Explorer

PekoraPlayerLauncher.exe

.exe 1.4MB

PekoraPlayerLauncher.exe

IMPHASH ee5703b05ca4e3694504a5c6cfe1248c
SHA256 a3b3a175d5f15c7794cf51412dd54073efaa0b98376ba0b906245128f72015b3
MD5 f745edf5a96ba145ca392df6aa67fe6e
SHA1 a6c3eddf363ad26c17121d4ed4d41fc7fe6153e9
SHA512 ee89006b29fc8fd32cbf8c446d36fd56a325d8e5771dd0e4b423225e43995b572248faf715dc371ebc95b0a45606350d0e8c9f12a8d7205e4849eba0eb07acf9
SSDEEP 24576:6r1tT1Gq71jvmhom9yjYpADVoEUmCHQCt:6rb1Xdjm9yjYpADqmCwCt
TLSH
T158655AC2EE4E11E8E07584F5C5224855E26F3C2AB2609ACB128172D64F77D537B3AF1E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

288524

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\Korone-Bootstrapper\Korone-Bootstrapper\BootstrapperClient\bin\Release\x64\PekoraPlayerLauncher.pdb

kernel32

GetTempPathW DeleteFileW GetSystemTime lstrcmpW VerifyVersionInfoW VerSetConditionMask GetProcAddress GetModuleHandleW GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte WaitForSingleObject ReleaseMutex CreateMutexW SetEvent ResetEvent OpenEventW CreateEventW CloseHandle GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc SetEndOfFile WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileType GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread HeapReAlloc GetLastError HeapSize ExitThread CreateThread InitializeCriticalSectionAndSpinCount HeapFree Sleep SizeofResource LockResource LoadResource FindResourceW FindResourceExW LocalFree GetCurrentThreadId GetCurrentProcess GetCurrentThread CreateProcessW RaiseException GetTickCount CompareFileTime FindFirstFileW FindNextFileW FindClose lstrlenW GetLocalTime CreateDirectoryW GetDiskFreeSpaceExW SetFileAttributesW RemoveDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile GetShortPathNameW FormatMessageW LoadLibraryW FreeLibrary CreateFileW GetFileAttributesW GetFileAttributesExW GetFileSizeEx MulDiv OpenProcess InitializeCriticalSectionEx WaitForSingleObjectEx GetExitCodeProcess TerminateProcess lstrcpyW lstrcatW WriteFile GetFileTime DosDateTimeToFileTime LocalFileTimeToFileTime SetFileTime IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetTickCount64 EncodePointer LCMapStringEx CompareStringEx GetCPInfo GetSystemTimeAsFileTime GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetCommandLineA GetCommandLineW

user32

LoadBitmapW CallWindowProcW GetParent GetWindowRect SendMessageW GetWindowLongPtrW AllowSetForegroundWindow SetWindowTextW LoadAcceleratorsW GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW SetFocus CharNextW MessageBoxW PostThreadMessageW GetWindowThreadProcessId EnumWindows GetDlgItem PostQuitMessage BeginPaint FillRect EndPaint CreateWindowExW RegisterClassW GetSystemMetrics GetDC ReleaseDC SetTimer KillTimer DestroyWindow EnableWindow LoadIconW SetForegroundWindow PostMessageW GetWindowTextW CharUpperW MessageBoxA DefWindowProcW SetWindowLongPtrW ShowWindow InvalidateRect SetWindowPos IsWindowVisible

gdi32

CreateFontW GetDeviceCaps DeleteObject Rectangle SelectObject CreatePen SetBkMode SetTextColor GetStockObject CreateSolidBrush

advapi32

OpenThreadToken InitializeSid GetSidSubAuthority CheckTokenMembership DuplicateToken RegDeleteKeyW RegEnumKeyExW RegDeleteValueW RegFlushKey CryptAcquireContextW CryptCreateHash IsValidSid GetLengthSid CopySid OpenProcessToken CryptReleaseContext CryptDestroyHash RegSetValueExW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey GetUserNameW CryptHashData CryptGetHashParam GetTokenInformation GetSidLengthRequired

shell32

SHGetFolderPathAndSubDirW ShellExecuteExW ShellExecuteW

ole32

CoUninitialize CoInitialize CoCreateInstance CoCreateGuid

oleaut32

VariantClear VariantInit RegisterTypeLi SysFreeString SysAllocString

shlwapi

PathFileExistsW StrCmpNW SHDeleteKeyW StrStrW StrCpyW StrCmpW PathAddBackslashW StrDupW StrRChrW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wininet

HttpAddRequestHeadersW InternetReadFile HttpSendRequestW HttpEndRequestW HttpQueryInfoW HttpSendRequestExW InternetWriteFile InternetCloseHandle InternetOpenW InternetConnectW HttpOpenRequestW InternetQueryDataAvailable

ws2_32

WSAStartup getaddrinfo closesocket freeaddrinfo WSACleanup connect socket recv send

sensapi

IsNetworkAlive

userenv

UnloadUserProfile

comctl32

InitCommonControlsEx _TrackMouseEvent

psapi

GetProcessImageFileNameW EnumProcesses

iphlpapi

GetAdaptersInfo

Name

.text

Size

488KB

Virtual Size

487KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

166KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

711KB

Virtual Size

710KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

PekoraPlayerLauncher.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

wininet

ws2_32

sensapi

userenv

comctl32

psapi

iphlpapi

generic