TLauncher-Installer-1[.]4[.]2[.]exe

General

Target
TLauncher-Installer-1.4.2.exe
Size 22.3MB
Sample260623-x2jdlafx4l
SHA256 8f657e915ef6ab8f9f0ecb653f2b79b19a6e68bb14d997b4b8c6e005c3923453
MD5 7467a35cd1f34498c32d68fc11cf2dd6
SHA1 3349ad795ff859a581f8d1c99d735f1817ca17e6
SHA512 840fdc04e600fd6e0c01d2ee03b0e2f904f08ef1e59dce14b9c4897fa1971f4ad8431321e3061ef09ae981bcae5f008e613f8497745e29f9f007842877b6efa5
SSDEEP 393216:/25KXSlsQ8C+Q5JIkc2rr6of5MJ7ZWqxPAIgtMIMlFRqH0fHbS1K8kn/rbhQyDkd:GKXWsQ8CJIArrKJBH5lFRqH0fYk/pUJn
TLSH
T193373352A9BAF470D7934A380E95B634BB368D219B2C86D37648347EBD373C55BF8108
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
TLauncher-Installer-1.4.2.exe

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
TLauncher-Installer-1.4.2.exe

File Explorer

TLauncher-Installer-1.4.2.exe

.exe 22.3MB

TLauncher-Installer-1.4.2.exe

IMPHASH d619eda1a774da262071361b928bb2e4
SHA256 8f657e915ef6ab8f9f0ecb653f2b79b19a6e68bb14d997b4b8c6e005c3923453
MD5 7467a35cd1f34498c32d68fc11cf2dd6
SHA1 3349ad795ff859a581f8d1c99d735f1817ca17e6
SHA512 840fdc04e600fd6e0c01d2ee03b0e2f904f08ef1e59dce14b9c4897fa1971f4ad8431321e3061ef09ae981bcae5f008e613f8497745e29f9f007842877b6efa5
SSDEEP 393216:/25KXSlsQ8C+Q5JIkc2rr6of5MJ7ZWqxPAIgtMIMlFRqH0fHbS1K8kn/rbhQyDkd:GKXWsQ8CJIArrKJBH5lFRqH0fYk/pUJn
TLSH
T193373352A9BAF470D7934A380E95B634BB368D219B2C86D37648347EBD373C55BF8108
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f2:53:8c:7d:6b:fb:af:fd:68:44:51:1f:8b:17:92:94:be:a6:96:a0:2f:41:4c:75:8d:00:9f:d5:9b:12:b6:11:f4:7f:53:35:ea:7e:d3:e4:2c:31:14:11:e8:5c:81:a2

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

Chains

May 29, 2024

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

CN=Trustwave Global Code Signing CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

PE Signature issue

Digest

7b:1d:37:00:73:ee:76:9a:9e:52:1a:44:8b:09:97:b7:da:ec:03:36:b9:51:10:ac:d7:37:d8:ae:b7:57:aa:65

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

Chains

May 29, 2024

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

CN=Trustwave Global Code Signing CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Subject

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

Serial Number

07:7f:22:38:be:42:10:bc:dd:a8:7c:d5:bd:db:90:61:80:9f:32

Issuer

CN=Trustwave Global Code Signing CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 23, 2022 - Feb 2, 2026

Subject

CN=Trustwave Global Code Signing CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Serial Number

06:ce:82:d9:b3:d4:98:74:56:05:d6:66:6b:6d:6d:99:7b:cb:73

Issuer

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Mar 3, 2026

Timespan

Feb 6, 2018 - Aug 21, 2042

Subject

CN=Viking Cloud TWG Timestamping Responder 2022,O=Viking Cloud\, Inc.,C=US

Serial Number

07:71:c2:62:80:b4:da:77:02:03:13:ab:bc:fa:a3:ff:ed:8b:2a

Issuer

CN=Viking Cloud TWG Timestamping CA\, Level 1,O=Viking Cloud\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 10, 2022 - Nov 6, 2033

Subject

CN=Viking Cloud TWG Timestamping CA\, Level 1,O=Viking Cloud\, Inc.,C=US

Serial Number

07:71:c1:bc:fc:08:5f:97:f1:8c:6a:6a:23:c8:d3:7f:08:7d:f9

Issuer

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Revoked

Revocation Date

Mar 3, 2026

Timespan

Aug 10, 2022 - Aug 10, 2037

Minor OS version

1

Major OS version

5

Entry point

11489

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA lstrcpyA lstrcatA lstrlenA GetSystemDirectoryA GetProcAddress GetModuleHandleA _lclose GetModuleFileNameA _lread _llseek _lopen _lwrite _lcreat CreateDirectoryA SetCurrentDirectoryA GetDiskFreeSpaceA GetFileAttributesA CompareStringA DeleteFileA GetTempPathA GetCurrentDirectoryA CloseHandle GetExitCodeProcess GetLastError LocalFree GetCurrentProcess MoveFileExA GetStringTypeW MultiByteToWideChar LCMapStringW HeapReAlloc RtlUnwind HeapSize Sleep RemoveDirectoryA FreeLibrary IsValidCodePage GetOEMCP GetModuleHandleW ExitProcess DecodePointer HeapFree HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer LoadLibraryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent HeapCreate FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP

user32

TranslateMessage DispatchMessageA PeekMessageA wsprintfA LoadCursorA SetCursor MessageBoxA MsgWaitForMultipleObjects

advapi32

GetTokenInformation OpenProcessToken

shell32

ShellExecuteExA

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

TLauncher-Installer-1.4.2.exe

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

shell32

generic