launcher[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
launcher.exe
Size 1.2MB
Sample260712-w6arksfv2m
SHA256 dc65df4c52ad4e8c2589453e347964a35ca3e753bb2f13a91d8414cc91d48542
MD5 7b0d3f5fea4925e11de3dfdc89c2d7d6
SHA1 14f880c6f7c66a6e406878ffcad1cee3dc87c786
SHA512 c3ae12655004396ccc35454d6cc650f5135279ce800e0f4feeac845daa2df39f92965119a3061a955afe379d9eeaaa2376295b0e64d62e46f6f57667e7250e1f
SSDEEP 24576:u5JAC0Y1jK6543XZjptWD6m9bjdu7gH8RUitbwc:u5JAzYpK650UD6m9bocRWw
TLSH
T15755AEA9BBA8508AC53B903D89A38618F5F23C4147315ACB55E4639D2F33EE52E3F714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
launcher.exe

File Explorer

launcher.exe

.exe 1.2MB

launcher.exe

IMPHASH 744bd974ad2584bac90942bd7d17814b
SHA256 dc65df4c52ad4e8c2589453e347964a35ca3e753bb2f13a91d8414cc91d48542
MD5 7b0d3f5fea4925e11de3dfdc89c2d7d6
SHA1 14f880c6f7c66a6e406878ffcad1cee3dc87c786
SHA512 c3ae12655004396ccc35454d6cc650f5135279ce800e0f4feeac845daa2df39f92965119a3061a955afe379d9eeaaa2376295b0e64d62e46f6f57667e7250e1f
SSDEEP 24576:u5JAC0Y1jK6543XZjptWD6m9bjdu7gH8RUitbwc:u5JAzYpK650UD6m9bocRWw
TLSH
T15755AEA9BBA8508AC53B903D89A38618F5F23C4147315ACB55E4639D2F33EE52E3F714
MD5 SHA1 SHA512 SSDEEP TLSH

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Password

123

Digest

86:3f:a2:90:39:52:5c:ec:85:ac:dd:89:9b:2a:33:7e:01:a4:11:04

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=201635710028,CN=Sony Interactive Entertainment LLC,O=Sony Interactive Entertainment LLC,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jun 25, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

06:53:2c:92:f7:7d:92:68:dc:17:83:74:53:e8:5e:28

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 12, 2024 - Dec 11, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

14566

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\build\discbot03\t1xfinal-pc-1.1.5\pc\default\Release\launcher.pdb

ole32

CoInitializeEx CoUninitialize

winpixeventruntime

PIXEventsReplaceBlock PIXGetThreadInfo

avrt

AvRevertMmThreadCharacteristics AvSetMmThreadCharacteristicsW AvSetMmThreadPriority

ntdll

RtlUnwind RtlUnwindEx NtQuerySystemInformation RtlPcToFileHeader

winmm

timeEndPeriod timeBeginPeriod

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll

kernel32

GetConsoleMode CreateFileW WriteConsoleW HeapSize HeapReAlloc DeleteCriticalSection GetConsoleOutputCP ReadConsoleW FlushFileBuffers SetFilePointerEx GetFileSizeEx SetConsoleCtrlHandler GetProcessHeap GetStringTypeW CloseHandle CreateProcessA OutputDebugStringW GetProcessTimes GetCurrentProcess GetCurrentProcessId GlobalMemoryStatusEx GetSystemInfo GetSystemTimeAsFileTime LocalAlloc LocalFree RaiseException WaitForSingleObject Sleep SwitchToThread GetCurrentThread SetThreadPriority SuspendThread ResumeThread GetThreadId SetThreadDescription GetProcessAffinityMask SwitchToFiber DeleteFiber ConvertFiberToThread CreateFiberEx ConvertThreadToFiber SetThreadAffinityMask QueryPerformanceCounter QueryPerformanceFrequency GetLastError GetModuleHandleW GetProcAddress ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId SetEvent ResetEvent CreateEventExW PulseEvent VirtualAlloc VirtualFree IsDebuggerPresent InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW FormatMessageA SetWaitableTimer CreateWaitableTimerExW WaitForMultipleObjects CreateWaitableTimerW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount SetStdHandle WaitForSingleObjectEx CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW InterlockedPushEntrySList InterlockedFlushSList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType MultiByteToWideChar GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte ReadFile

Name

.text

Size

710KB

Virtual Size

710KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

198KB

Virtual Size

198KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

696KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

904B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

337B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

562B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

296KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

launcher.exe

ole32

winpixeventruntime

avrt

ntdll

winmm

api-ms-win-core-synch-l1-2-0

kernel32

generic