Feather Launcher Setup 2[.]6[.]13-c[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Feather Launcher Setup 2.6.13-c.exe
Size 3.2MB
Sample260517-xe1pcscs8s
SHA256 45edf0c8985b84655ca0524029500e8ba26ea2a4171057ab77302bb98085ef90
MD5 fd1003bc73d0d66a81c585be89abf933
SHA1 5925167a50b88c258afa206b684bec9b7853cb29
SHA512 0836597f75447597ea9f657ec91a9afb814ebd5ce4c4221758f2186e7e9da72a2b0be23728f47ee9489701f5285b10b356de0f9ab019806de5e570f1eedaaacc
SSDEEP 49152:4EEKrH9kR9rC82bGOcgPugq1NTxoPCdIA1sITLl3oKJ6mEO2lfZmmPYEoRP/malx:LI7fXxof1YEOOalS0sTs
TLSH
T171F5F1B972582398C05BC9349523BD0BF276350907B489EF72E7B5D02FEA1909E36B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Feather Launcher Setup 2.6.13-c.exe

File Explorer

Feather Launcher Setup 2.6.13-c.exe

.exe 3.2MB

Feather Launcher Setup 2.6.13-c.exe

IMPHASH 64ffa488da32ad1ae930fad046cb695d
SHA256 45edf0c8985b84655ca0524029500e8ba26ea2a4171057ab77302bb98085ef90
MD5 fd1003bc73d0d66a81c585be89abf933
SHA1 5925167a50b88c258afa206b684bec9b7853cb29
SHA512 0836597f75447597ea9f657ec91a9afb814ebd5ce4c4221758f2186e7e9da72a2b0be23728f47ee9489701f5285b10b356de0f9ab019806de5e570f1eedaaacc
SSDEEP 49152:4EEKrH9kR9rC82bGOcgPugq1NTxoPCdIA1sITLl3oKJ6mEO2lfZmmPYEoRP/malx:LI7fXxof1YEOOalS0sTs
TLSH
T171F5F1B972582398C05BC9349523BD0BF276350907B489EF72E7B5D02FEA1909E36B47
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

558520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea

d3d9

Direct3DCreate9

advapi32

CreateProcessAsUserW DuplicateTokenEx RegQueryValueExW RevertToSelf PrivilegeCheck SetTokenInformation OpenProcessToken SetThreadToken LookupPrivilegeValueW GetTokenInformation

d3dx9_43

D3DXCreateTextureFromFileInMemory

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

kernel32

GetFileAttributesExW InitializeSListHead GetSystemTimeAsFileTime IsDebuggerPresent AreFileApisANSI GetLocaleInfoEx WriteProcessMemory GetCurrentProcess TerminateProcess GetModuleFileNameW CreateFileW OpenProcess MultiByteToWideChar Sleep GetLastError Process32NextW Process32FirstW CloseHandle GetProcAddress LocalFree ReadProcessMemory GetModuleHandleW WideCharToMultiByte GetTickCount VirtualQueryEx GetCurrentProcessId GetCurrentThreadId LoadLibraryA GlobalAlloc GlobalLock GlobalUnlock CompareFileTime K32GetMappedFileNameA Thread32Next Thread32First SuspendThread ResumeThread GetModuleHandleA GetTickCount64 GetThreadTimes OpenThread ExitProcess OutputDebugStringA GlobalFree GetLocaleInfoA QueryPerformanceFrequency IsDBCSLeadByte QueryPerformanceCounter GetLocalTime GetStartupInfoW GetCommandLineW SetUnhandledExceptionFilter GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable IsProcessorFeaturePresent FormatMessageA FindClose CreateToolhelp32Snapshot FindFirstFileW UnhandledExceptionFilter

user32

MapWindowPoints SetWindowDisplayAffinity MoveWindow SetWindowLongW SetForegroundWindow GetWindowRect GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetWindowLongW PeekMessageW DefWindowProcW GetCursorPos GetAsyncKeyState OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DispatchMessageW TranslateMessage

shell32

ShellExecuteW

ole32

CoInitializeEx

msvcp140

_Mtx_unlock _Mtx_lock ?_Xbad_function_call@std@@YAXXZ _Thrd_detach _Thrd_yield ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z _Query_perf_counter _Cnd_do_broadcast_at_thread_exit ?_Random_device@std@@YAIXZ ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove _CxxThrowException __C_specific_handler __current_exception_context __current_exception memset __std_exception_destroy __std_exception_copy strchr memcmp memchr memcpy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s fputc __stdio_common_vsscanf _wfopen _set_fmode __stdio_common_vfprintf fseek __acrt_iob_func ftell __p__commode fflush __stdio_common_vsprintf _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos fwrite fgetc fclose

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode free _callnewh

api-ms-win-crt-string-l1-1-0

_wcsicmp towlower strncpy strncmp strcmp tolower

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit _errno _exit exit _initterm_e _initterm terminate _get_wide_winmain_command_line _beginthreadex _initialize_wide_environment _configure_wide_argv _invoke_watson abort system _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-convert-l1-1-0

strtoll strtod atof strtoull

api-ms-win-crt-math-l1-1-0

_dclass sqrtf cosf __setusermatherr log logf acosf _dsign pow powf atan2f sqrt fmodf ceilf sinf

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func _configthreadlocale