end-launcher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
end-launcher.exe
Size 5.3MB
Sample260714-pmwrdafs2w
SHA256 16d52377a45c36711159402bdb472222c29cb9637bbe9c53b006352dc7f26b46
MD5 bc87291918e8ccb6c0f452aa0b44328a
SHA1 d882ac0e9811ffa0495fa65cb1333e8386262cbd
SHA512 793c8612366974396b2dd29072e44efdd57de83b8c7f9b94706edbae0a2abd6ee23e85d9fed4bd4a7eb5c10c0b8f16f9a9357f52d62c27cf89d53658ea7636ed
SSDEEP 49152:eGhBTCr3tgbFzJB2tHaTsT2OSbS2yQF2WuGfZA96v3L5BT144BrwSM1eW8cB5nVx:1TsJaTXoWM6mp1B8+nVQAvfwbnbkwk
TLSH
T185466C03F6A281ECC06EC179C35AA633EB36B88D093076AF5B941B212F56F506F5D359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
end-launcher.exe

File Explorer

end-launcher.exe

.exe 5.3MB

end-launcher.exe

IMPHASH abbcb2df9ec5712b7519b66378ae24f4
SHA256 16d52377a45c36711159402bdb472222c29cb9637bbe9c53b006352dc7f26b46
MD5 bc87291918e8ccb6c0f452aa0b44328a
SHA1 d882ac0e9811ffa0495fa65cb1333e8386262cbd
SHA512 793c8612366974396b2dd29072e44efdd57de83b8c7f9b94706edbae0a2abd6ee23e85d9fed4bd4a7eb5c10c0b8f16f9a9357f52d62c27cf89d53658ea7636ed
SSDEEP 49152:eGhBTCr3tgbFzJB2tHaTsT2OSbS2yQF2WuGfZA96v3L5BT144BrwSM1eW8cB5nVx:1TsJaTXoWM6mp1B8+nVQAvfwbnbkwk
TLSH
T185466C03F6A281ECC06EC179C35AA633EB36B88D093076AF5B941B212F56F506F5D359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3920016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

end_launcher.pdb

kernel32

lstrlenW GetCurrentThread SetThreadStackGuarantee SetLastError HeapReAlloc LCIDToLocaleName GetUserDefaultUILanguage ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable GetProcessId CompareStringOrdinal SleepConditionVariableSRW LoadLibraryW GetSystemTimeAsFileTime RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess GetCurrentProcessId WideCharToMultiByte ReleaseMutex WaitForSingleObject MultiByteToWideChar SleepEx SetHandleInformation ExitProcess GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW DuplicateHandle WaitForMultipleObjects GetExitCodeProcess SetWaitableTimer FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext AddVectoredExceptionHandler GetCommandLineW SetEnvironmentVariableW FlsSetValue FlsFree GetModuleHandleW GetCurrentThreadId EncodePointer FindNextFileW SetFilePointerEx CreateWaitableTimerExW DeleteFileW GetTempPathW GetFileAttributesW CreateProcessW CancelIo CreateEventW CreateDirectoryW GetFileInformationByHandle FindFirstFileExW SetFileTime CreateThread WriteFileEx SwitchToThread ReadFileEx WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle CreateMutexA GetModuleHandleA Sleep GetProcAddress InitializeSListHead SetUnhandledExceptionFilter CreateFileW LoadLibraryExA RtlUnwindEx FormatMessageW GetLastError CreatePipe CancelIoEx SetFileCompletionNotificationModes CreateIoCompletionPort TerminateProcess GetQueuedCompletionStatusEx ReadFile PostQueuedCompletionStatus WriteFile GetProcessHeap InitializeCriticalSectionEx GetSystemTimePreciseAsFileTime GetSystemInfo GetOverlappedResult GetFinalPathNameByHandleW GetFullPathNameW FindClose SetFileInformationByHandle OutputDebugStringA OutputDebugStringW LoadLibraryExW FreeLibrary HeapAlloc CloseHandle GetLogicalDrives HeapFree GetFileInformationByHandleEx LoadLibraryA DeleteCriticalSection

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW RegGetValueW EventRegister EventSetInformation EventUnregister EventWriteTransfer

oleaut32

SetErrorInfo GetErrorInfo SysStringLen SysFreeString

bcryptprimitives

ProcessPrng

ntdll

NtWriteFile NtReadFile NtOpenFile NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile RtlNtStatusToDosError RtlGetVersion NtDeviceIoControlFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute DwmEnableBlurBehindWindow

user32

LoadCursorW GetForegroundWindow FlashWindowEx SetParent RegisterTouchWindow CreateWindowExW SetWindowLongPtrW IsWindow IsWindowEnabled IsIconic IsWindowVisible GetMessageW EnableWindow SetPropW GetKeyboardState MonitorFromPoint EnumDisplayMonitors AdjustWindowRect RedrawWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW SetWindowDisplayAffinity SetCursor MonitorFromRect ToUnicodeEx MapVirtualKeyExW GetKeyboardLayout ClipCursor GetSystemMetrics GetClipCursor ShowCursor GetWindowLongPtrW PostMessageW PostThreadMessageW SystemParametersInfoW SetCursorPos PeekMessageW TranslateMessage DispatchMessageW SetWindowLongW InvalidateRect GetSystemMenu GetMonitorInfoW GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW UpdateWindow RegisterRawInputDevices AdjustWindowRectEx GetMenu GetWindowLongW InvalidateRgn ReleaseCapture GetAsyncKeyState GetKeyState RegisterWindowMessageA ScreenToClient SetCapture GetTouchInputInfo MsgWaitForMultipleObjectsEx CloseTouchInputHandle IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos EnableMenuItem DrawIconEx GetDC DefWindowProcW AppendMenuW InsertMenuW SendInput CheckMenuItem DrawTextW ReleaseDC FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo ShowWindow PostQuitMessage SystemParametersInfoA GetActiveWindow SetMenu RemoveMenu CreateIcon SetMenuItemInfoW DrawMenuBar CreatePopupMenu CreateMenu CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu TrackMouseEvent FindWindowExW GetParent TranslateAcceleratorW GetMenuItemInfoW SendMessageW SetWindowRgn GetWindow VkKeyScanW DestroyWindow EnumChildWindows DispatchMessageA GetMessageA SetWindowPos RegisterClassExW SetFocus MapVirtualKeyW GetUpdateRect ValidateRect GetRawInputData

comctl32

DefSubclassProc RemoveWindowSubclass SetWindowSubclass TaskDialogIndirect

ole32

CoInitializeEx RevokeDragDrop CoCreateFreeThreadedMarshaler CoTaskMemAlloc CoCreateInstance RegisterDragDrop CoInitialize CoUninitialize CoTaskMemFree OleInitialize

shlwapi

SHCreateMemStream

shell32

SHAppBarMessage ShellExecuteW DragFinish DragQueryFileW SHCreateItemFromParsingName ShellExecuteExW SHGetKnownFolderPath ord155 SHOpenFolderAndSelectItems ord190

gdi32

GetDeviceCaps CombineRgn CreateSolidBrush SetBkMode SetTextColor CreateRectRgn DeleteObject DeleteDC CreateCompatibleDC CreateDIBSection SelectObject BitBlt

ws2_32

getsockopt WSADuplicateSocketW accept freeaddrinfo getaddrinfo send getpeername shutdown WSACleanup WSAStartup recv setsockopt WSASend connect getsockname closesocket WSAGetLastError listen bind WSASocketW WSAIoctl ioctlsocket

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertGetCertificateChain CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertEnumCertificatesInStore CertOpenStore CertFreeCertificateChain CertDuplicateStore CertVerifyCertificateChainPolicy

secur32

ApplyControlToken AcquireCredentialsHandleA FreeCredentialsHandle DecryptMessage DeleteSecurityContext QueryContextAttributesW EncryptMessage FreeContextBuffer AcceptSecurityContext InitializeSecurityContextW

api-ms-win-crt-string-l1-1-0

strcpy_s wcscmp wcslen strlen _wcsicmp

api-ms-win-crt-math-l1-1-0

__setusermatherr trunc floor pow roundf round

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free calloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _register_thread_local_exe_atexit_callback _configure_narrow_argv _initterm _initterm_e _c_exit exit _exit _wassert _initialize_onexit_table __p___argc _set_app_type _crt_atexit __p___argv _seh_filter_exe _get_initial_narrow_environment terminate abort _cexit _register_onexit_function

api-ms-win-crt-utility-l1-1-0

_rotl64

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale