Launcher[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Launcher.exe
Size 303KB
Sample260706-bxbbjacx6m
SHA256 f34ea9c6d9330527426e9aad4b1934960fd9f7e862a6764cf1d10e68f8ffc45b
MD5 6017195b44c384cfba0b2bc0f8e71a51
SHA1 4beb311de9ad4e41944eb09f5b70d60ec4c1fb98
SHA512 5f427ef7d1de647181221e6209bd3e625eb4aa4656c11e3fa3c9b97a6452e5a0cb3e15b2c73b2fe3e8d75aee19ff10e74e670de8affe98b18ea6f4f2ce921f6b
SSDEEP 6144:1AwTB4bnwL0hn4xck5mw8Soc/or5MSX4j/zAGEvJxOyVn:uSV8Socm5Hoj/zA
TLSH
T185648D16E79511FDE5ABC17CCE828805EB727C4607B0DACF179049A62F636E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Launcher.exe

File Explorer

Launcher.exe

.exe 303KB

Launcher.exe

IMPHASH 173ab4caa82dbf3eff929bd100a09363
SHA256 f34ea9c6d9330527426e9aad4b1934960fd9f7e862a6764cf1d10e68f8ffc45b
MD5 6017195b44c384cfba0b2bc0f8e71a51
SHA1 4beb311de9ad4e41944eb09f5b70d60ec4c1fb98
SHA512 5f427ef7d1de647181221e6209bd3e625eb4aa4656c11e3fa3c9b97a6452e5a0cb3e15b2c73b2fe3e8d75aee19ff10e74e670de8affe98b18ea6f4f2ce921f6b
SSDEEP 6144:1AwTB4bnwL0hn4xck5mw8Soc/or5MSX4j/zAGEvJxOyVn:uSV8Socm5Hoj/zA
TLSH
T185648D16E79511FDE5ABC17CCE828805EB727C4607B0DACF179049A62F636E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

75792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

MessageBoxW EnumDisplayMonitors GetMonitorInfoW LoadCursorW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW FillRect ShowCursor GetMessageW InvalidateRect EndPaint BeginPaint DrawTextW KillTimer SetTimer DestroyWindow CreateWindowExW RegisterClassW PostQuitMessage DefWindowProcW DispatchMessageW TranslateMessage GetClientRect

shell32

ShellExecuteExW

advapi32

GetTokenInformation OpenProcessToken RegDeleteValueW RegOpenKeyExW RegSetValueExW RegCreateKeyW RegCreateKeyExW RegQueryValueExW RegDeleteTreeW CloseServiceHandle ControlService OpenSCManagerW QueryServiceStatusEx OpenServiceW RegCloseKey

winhttp

WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpQueryHeaders WinHttpReceiveResponse WinHttpReadData WinHttpAddRequestHeaders WinHttpSendRequest

bcrypt

BCryptGenRandom

ntdll

NtQuerySystemInformation RtlInitUnicodeString NtUnloadDriver RtlAdjustPrivilege RtlPcToFileHeader NtLoadDriver RtlUnwindEx

gdi32

CreateFontW MoveToEx CreatePen CreateSolidBrush DeleteObject CreateEllipticRgn GetStockObject LineTo SelectObject SetBkMode SetTextColor FillRgn

winmm

PlaySoundW

ole32

CoInitialize CoCreateInstance CoUninitialize

kernel32

LeaveCriticalSection DeleteCriticalSection WriteConsoleW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW HeapReAlloc HeapSize ReadConsoleW ReadFile GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetFilePointerEx GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect VirtualAlloc GetConsoleOutputCP LCMapStringW CreateDirectoryW CreateFileW DeleteFileW RemoveDirectoryW WriteFile GetTempPathW CloseHandle GetLastError QueryPerformanceCounter GetCurrentProcessId GetTickCount64 GetStdHandle ExitProcess GetConsoleMode SetConsoleMode ReadConsoleInputW FlushConsoleInputBuffer SetConsoleOutputCP SetConsoleCursorInfo SetConsoleTitleW GetCurrentProcess GetModuleFileNameW Sleep TerminateProcess OpenProcess GetModuleHandleW CreateToolhelp32Snapshot Process32FirstW Process32NextW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetFileSizeEx SetFilePointer SetFileTime DeviceIoControl GetCurrentThreadId GetTickCount EnterCriticalSection VirtualFree SetProcessWorkingSetSize GetModuleHandleA GetProcAddress MoveFileW MoveFileExW WaitForSingleObject CreateProcessW GetEnvironmentVariableW SetEnvironmentVariableW CopyFileW GetExitCodeProcess WaitForSingleObjectEx GetExitCodeThread QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable InitializeCriticalSectionEx GetSystemTimeAsFileTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead EncodePointer CompareStringW RaiseException SetLastError

Name

.text

Size

174KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Launcher.exe

user32

shell32

advapi32

winhttp

bcrypt

ntdll

gdi32

winmm

ole32

kernel32

generic