HytaleLauncher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
HytaleLauncher.exe
Size 482KB
Sample260623-py547acz81
SHA256 a7a2bd445664d2f4c27f2800c5a02e76861d52e1b66d30d5132c449b9c78e292
MD5 16ae6dbd416fab9a312650427095938b
SHA1 1582716951659d1f3316f27a7fff08ac3ca72566
SHA512 20704dc88e32c68bfae3f9067c91364ce66928af73320ca0b12dc9094d6cd8b41efef821322d838f188cf9c87e60f56fb5a42dcd4e2095df0f8f20ac78bae937
SSDEEP 6144:QCY/ljyKGBPvX0G/Zymjc7D4Te/rvGGdZUhyG5RHd8iv2/t:NqyL10G/01QT4aGwnL+e2/
TLSH
T116A4CF067698C0F4E1679838C996C20EE73178944F759ACB27511BEE9F336E4AD3E780
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
HytaleLauncher.exe

File Explorer

HytaleLauncher.exe

.exe 482KB

HytaleLauncher.exe

IMPHASH d67a4b1af34be878962cd7ea13ab2557
SHA256 a7a2bd445664d2f4c27f2800c5a02e76861d52e1b66d30d5132c449b9c78e292
MD5 16ae6dbd416fab9a312650427095938b
SHA1 1582716951659d1f3316f27a7fff08ac3ca72566
SHA512 20704dc88e32c68bfae3f9067c91364ce66928af73320ca0b12dc9094d6cd8b41efef821322d838f188cf9c87e60f56fb5a42dcd4e2095df0f8f20ac78bae937
SSDEEP 6144:QCY/ljyKGBPvX0G/Zymjc7D4Te/rvGGdZUhyG5RHd8iv2/t:NqyL10G/01QT4aGwnL+e2/
TLSH
T116A4CF067698C0F4E1679838C996C20EE73178944F759ACB27511BEE9F336E4AD3E780
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

45024

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rpcrt4

RpcStringFreeW UuidToStringW UuidCreate

kernel32

RtlPcToFileHeader WriteConsoleW SetEndOfFile HeapReAlloc SetEnvironmentVariableW FreeEnvironmentStringsW MultiByteToWideChar CloseHandle ExitProcess CreateProcessW WideCharToMultiByte GetEnvironmentStringsW HeapSize GetFileSizeEx GetConsoleOutputCP FlushFileBuffers CreateFileW GetProcessHeap LCMapStringW GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress MoveFileExW GetFileInformationByHandleEx LocalFree FormatMessageA GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ReadFile GetCPInfo IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess TerminateProcess FreeLibrary GetModuleHandleExW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetFilePointerEx GetConsoleMode ReadConsoleW GetFileType HeapFree HeapAlloc GetStringTypeW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW SetStdHandle VirtualProtect LoadLibraryExW

user32

MessageBoxA MessageBoxW

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

Name

.text

Size

117KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

284KB

Virtual Size

284KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

HytaleLauncher.exe

rpcrt4

kernel32

user32

shell32

ole32

generic