cpplauncher[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cpplauncher.exe
Size 6.5MB
Sample260706-nxe1yaav4n
SHA256 3d763e3d45df4a2a6fcbafd4bd69f58c795598081a456993d5f7f81db0b01c45
MD5 8c6cc6992b11b99534fa7945e03982ad
SHA1 adb6bfd50e037bbab2bb012af9811b7e2060e5fc
SHA512 988ea017ee07478d02826f924512cfd262c00c20e44b9ac1013bbb5e2efcacfcf2a52582f12f93158060e91f7303503ba630eff769f6e42182d1399577201233
SSDEEP 49152:yGtlqyUIU6iMVwASOBB122/r0sCqcJAfFqkVHhXb0IS71C7J6ukfK1e25u57A5PG:x+mBZDYSfFh30ISJgkfKFhAPsu4p0
TLSH
T10866AE69B2BC01D9D87AC1BDC286A227E772B42517F057CF2A6456F50F63AE01E7B340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cpplauncher.exe

File Explorer

cpplauncher.exe

.exe 6.5MB

cpplauncher.exe

IMPHASH afff98d79ef1f27d2c70e3f80600af7a
SHA256 3d763e3d45df4a2a6fcbafd4bd69f58c795598081a456993d5f7f81db0b01c45
MD5 8c6cc6992b11b99534fa7945e03982ad
SHA1 adb6bfd50e037bbab2bb012af9811b7e2060e5fc
SHA512 988ea017ee07478d02826f924512cfd262c00c20e44b9ac1013bbb5e2efcacfcf2a52582f12f93158060e91f7303503ba630eff769f6e42182d1399577201233
SSDEEP 49152:yGtlqyUIU6iMVwASOBB122/r0sCqcJAfFqkVHhXb0IS71C7J6ukfK1e25u57A5PG:x+mBZDYSfFh30ISJgkfKFhAPsu4p0
TLSH
T10866AE69B2BC01D9D87AC1BDC286A227E772B42517F057CF2A6456F50F63AE01E7B340
MD5 SHA1 SHA512 SSDEEP TLSH

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4236848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\.workspace\cpplauncher\x64\Release\cpplauncher.pdb

ws2_32

gethostbyname gethostbyaddr inet_ntoa inet_addr htons htonl WSASetLastError WSACleanup __WSAFDIsSet closesocket select shutdown WSASocketW inet_pton getaddrinfo WSAStartup getpeername getsockname send socket ntohs connect recv getsockopt freeaddrinfo ioctlsocket getnameinfo setsockopt getservbyport getservbyname recvfrom sendto WSAGetLastError

crypt32

CertGetCertificateContextProperty CertDuplicateCertificateContext CertFreeCertificateContext CertOpenSystemStoreW CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFindCertificateInStore

opengl32

glClear glViewport glClearColor

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

kernel32

GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindFirstFileExW HeapSize SetEndOfFile WriteConsoleW PeekNamedPipe InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree QueryPerformanceCounter QueryPerformanceFrequency VerSetConditionMask GetLastError GetModuleHandleExW FormatMessageW MultiByteToWideChar WideCharToMultiByte FreeLibrary GetProcAddress LoadLibraryA Sleep GetStartupInfoW GetModuleHandleW GlobalAlloc GlobalUnlock GlobalLock GlobalFree SetThreadExecutionState GetStdHandle GetFileType WriteFile GetSystemDirectoryA FormatMessageA SetLastError InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetCurrentThreadId GetEnvironmentVariableW VirtualProtect VirtualFree GetACP RtlVirtualUnwind CloseHandle ReleaseSemaphore WaitForSingleObject GetExitCodeThread CreateSemaphoreA SwitchToFiber DeleteFiber CreateFiberEx GetCurrentProcessId GetSystemTimeAsFileTime LoadLibraryW GetSystemTime SystemTimeToFileTime ConvertFiberToThread ConvertThreadToFiberEx GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW FindClose FindFirstFileW FindNextFileW InitOnceComplete InitOnceBeginInitialize SleepConditionVariableSRW LCMapStringEx InitializeCriticalSectionEx EncodePointer DecodePointer CompareStringEx GetCPInfo WakeAllConditionVariable GetStringTypeW SetUnhandledExceptionFilter InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree ReadFile GetCurrentProcess ExitProcess TerminateProcess SetConsoleCtrlHandler CreateThread ExitThread FreeLibraryAndExitThread CreateFileW GetDriveTypeW GetFileInformationByHandle RtlUnwind SystemTimeToTzSpecificLocalTime FileTimeToSystemTime IsProcessorFeaturePresent GetModuleFileNameW GetCommandLineA GetCommandLineW RtlCaptureContext IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FlushFileBuffers GetConsoleOutputCP SetFilePointerEx GetFileSizeEx GetTimeZoneInformation SetStdHandle GetCurrentDirectoryW GetFullPathNameW IsValidCodePage GetOEMCP

user32

TranslateMessage DispatchMessageW PeekMessageW RegisterDeviceNotificationW UnregisterDeviceNotification DefWindowProcW UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow ToUnicode MapVirtualKeyW DestroyIcon GetDC ReleaseDC ChangeDisplaySettingsExW EnumDisplaySettingsW EnumDisplaySettingsExW EnumDisplayDevicesW GetMonitorInfoW EnumDisplayMonitors TrackMouseEvent GetMessageTime SendMessageW PostMessageW WaitMessage GetLayeredWindowAttributes SetLayeredWindowAttributes FlashWindow MoveWindow SetWindowPos GetWindowPlacement SetWindowPlacement IsWindowVisible IsIconic BringWindowToTop IsZoomed OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard SetFocus GetActiveWindow GetKeyState SetCapture ReleaseCapture MsgWaitForMultipleObjects GetSystemMetrics SetForegroundWindow SetPropW GetPropW RemovePropW SetWindowTextW GetClientRect GetWindowRect AdjustWindowRectEx SetCursorPos SetCursor GetCursorPos ClientToScreen ScreenToClient WindowFromPoint ClipCursor SetRect OffsetRect PtInRect GetWindowLongW SetWindowLongW GetClassLongPtrW LoadCursorW LoadImageW CreateIconIndirect SystemParametersInfoW MonitorFromWindow GetRawInputData RegisterRawInputDevices GetRawInputDeviceInfoA GetRawInputDeviceList GetMessageExtraInfo CallWindowProcW GetWindowLongPtrW SetWindowLongPtrW GetProcessWindowStation GetUserObjectInformationW MessageBoxW

gdi32

CreateBitmap DeleteObject GetDeviceGammaRamp GetDeviceCaps DeleteDC CreateDCW CreateDIBSection ChoosePixelFormat DescribePixelFormat SetPixelFormat CreateRectRgn SwapBuffers SetDeviceGammaRamp

advapi32

CryptGetUserKey RegisterEventSourceW CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey DeregisterEventSource CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW

shell32

DragFinish DragQueryPoint DragQueryFileW DragAcceptFiles

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

738KB

Virtual Size

775KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

173KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cpplauncher.exe

ws2_32

crypt32

opengl32

imm32

kernel32

user32

gdi32

advapi32

shell32

generic