Yeni WinRAR ZIP arşivi[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
Yeni WinRAR ZIP arşivi.zip
Size 37.9MB
Sample260723-pfd8rawvdv
SHA256 f69525a85c126d7dde10b8fe7787c96f6289676add9c2779d7d9e6fb5e8fad15
MD5 6da5c4a9fc4932d4aa00a8ff5d80d9c0
SHA1 be1d29a0b03cd0530e4a5a720b1fc44a3e68c712
SHA512 f96bf9ecde64c347a51a74995c457c5ff3f584ff1a2d2dbb622471e61a80af11b63ea8a2388a29c0331607881e35b372c39c487e621d21c41f8ac75862daecb5
SSDEEP 786432:19BpQaGwpQE6QgB5QnCLpBbdzPVZRe1kY/fMGN43SFMtV5YIummVyr:LBaKpl5gBICXbdDVqJfMF9RYIuXVY
TLSH
T1F4973368F1729CB2DB66791C75A02A54F4266593F2094F83B7A20A4F1533ED4FFF0A90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
unpack001/TLauncher-Installer-1.9.5.1.exe

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Xenos.exe
unpack001/penis.dll

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/TLauncher-Installer-1.9.5.1.exe

File Explorer

Yeni WinRAR ZIP arşivi.zip

.zip 37.9MB
TLauncher-Installer-1.9.5.1.exe

.exe 25.5MB
Xenos.exe

.exe 1.1MB
penis.dll

.dll 13.7MB

Yeni WinRAR ZIP arşivi.zip

SHA256 f69525a85c126d7dde10b8fe7787c96f6289676add9c2779d7d9e6fb5e8fad15
MD5 6da5c4a9fc4932d4aa00a8ff5d80d9c0
SHA1 be1d29a0b03cd0530e4a5a720b1fc44a3e68c712
SHA512 f96bf9ecde64c347a51a74995c457c5ff3f584ff1a2d2dbb622471e61a80af11b63ea8a2388a29c0331607881e35b372c39c487e621d21c41f8ac75862daecb5
SSDEEP 786432:19BpQaGwpQE6QgB5QnCLpBbdzPVZRe1kY/fMGN43SFMtV5YIummVyr:LBaKpl5gBICXbdDVqJfMF9RYIuXVY
TLSH
T1F4973368F1729CB2DB66791C75A02A54F4266593F2094F83B7A20A4F1533ED4FFF0A90
MD5 SHA1 SHA512 SSDEEP TLSH

TLauncher-Installer-1.9.5.1.exe

IMPHASH edb0a89022b9c14b574f0c2cef13dfa2
SHA256 0619bd07d3183a8ae0cb1be408c6ad32295d47ddd666b2d51edd4d5f5d211227
MD5 de90bdf89be7e8f55b9ea1e9f0a88613
SHA1 ea25984a475c95ad41abae25885db7b24514a7af
SHA512 42f6cc77ea8cd43d167236e81e4164da7c8030605d7d1759494f41f5b9b5dcdbaec3b4d901f1925f13d915756b52ec22927e1dc304e89fb7f9342b84c475d188
SSDEEP 786432:ytpZzp8Q6W10rrKJBH5lFRqJkkt9O2B4Bi5e:ytpTTuPKJBZlC39ORb
TLSH
T1014733357AA29072D772363496996339F77EAD70AB3802D322903D3C7E716C15A7C21B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

a1:6d:e8:01:92:e9:be:36:ae:a0:a9:12:db:40:3c:57:46:9f:ab:99:86:7c:9e:63:6f:e1:0b:f6:5a:53:2e:78:72:e9:eb:19:91:92:5d:ba:30:f9:85:7a:91:cc:3c:fb

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

Chains

Nov 16, 2025

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

CN=Trustwave Global Code Signing CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

PE Signature issue

Digest

a9:1d:58:13:79:3a:f8:93:b6:41:04:86:95:0e:6d:33:98:fd:8e:f6:1f:bb:15:6a:d6:e6:c6:73:3e:49:c7:43

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

Chains

Nov 16, 2025

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

CN=Trustwave Global Code Signing CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Subject

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

Serial Number

07:7f:22:38:be:42:10:bc:dd:a8:7c:d5:bd:db:90:61:80:9f:32

Issuer

CN=Trustwave Global Code Signing CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 23, 2022 - Feb 2, 2026

Subject

CN=Trustwave Global Code Signing CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Serial Number

06:ce:82:d9:b3:d4:98:74:56:05:d6:66:6b:6d:6d:99:7b:cb:73

Issuer

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Mar 3, 2026

Timespan

Feb 6, 2018 - Aug 21, 2042

Subject

CN=Viking Cloud TWG Timestamping Responder 2022,O=Viking Cloud\, Inc.,C=US

Serial Number

07:71:c2:62:80:b4:da:77:02:03:13:ab:bc:fa:a3:ff:ed:8b:2a

Issuer

CN=Viking Cloud TWG Timestamping CA\, Level 1,O=Viking Cloud\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 10, 2022 - Nov 6, 2033

Subject

CN=Viking Cloud TWG Timestamping CA\, Level 1,O=Viking Cloud\, Inc.,C=US

Serial Number

07:71:c1:bc:fc:08:5f:97:f1:8c:6a:6a:23:c8:d3:7f:08:7d:f9

Issuer

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Revoked

Revocation Date

Mar 3, 2026

Timespan

Aug 10, 2022 - Aug 10, 2037

Minor OS version

Major OS version

Entry point

988539

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindClose FindFirstFileW GetVolumeInformationW GetFullPathNameW InterlockedExchange LockFile GetLocaleInfoW GetUserDefaultUILanguage GetFileAttributesExW FileTimeToLocalFileTime GetFileSizeEx GetFileTime GetTempFileNameW GetWindowsDirectoryW GetNumberFormatW GetTickCount GetProfileIntW SearchPathW VirtualProtect FindResourceExW ExitProcess DecodePointer HeapFree HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW RtlUnwind RaiseException EncodePointer HeapReAlloc ExitThread CreateThread HeapSize HeapQueryInformation GetSystemTimeAsFileTime VirtualAlloc GetSystemInfo VirtualQuery SetStdHandle GetFileType UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetStdHandle IsProcessorFeaturePresent HeapCreate GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount DuplicateHandle GetStringTypeW GetCPInfo GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation LCMapStringW GetConsoleCP GetConsoleMode WriteConsoleW SetEnvironmentVariableA FlushFileBuffers WriteFile lstrcmpiW GlobalFlags FreeResource GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom GetVersionExW InitializeCriticalSectionAndSpinCount lstrcmpW FileTimeToSystemTime lstrcmpA GlobalGetAtomNameW InterlockedIncrement WaitForSingleObject GetCurrentThreadId ResumeThread SetThreadPriority CopyFileW GlobalSize FormatMessageW MulDiv GetCurrentProcessId FindResourceW LoadResource LockResource SizeofResource InterlockedDecrement ActivateActCtx ReleaseActCtx DeactivateActCtx TlsFree GlobalFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalAlloc GlobalHandle GlobalUnlock GlobalReAlloc GlobalLock EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc SetLastError GetFileSize SetEndOfFile QueryPerformanceCounter UnlockFile MoveFileExW CreateSymbolicLinkW GetCurrentProcess LocalFree GetLastError GetExitCodeProcess GetCurrentDirectoryW GetTempPathW DeleteFileW RemoveDirectoryW GetFileAttributesW GetDiskFreeSpaceW _lopen CreateFileW SetCurrentDirectoryW CreateDirectoryW SetFilePointer ReadFile _lcreat _lwrite _lclose WideCharToMultiByte GetModuleFileNameW CloseHandle GetModuleHandleW GetProcAddress GetSystemDirectoryW lstrlenW lstrcatW lstrcpyW LoadLibraryW lstrlenA lstrcpyA CompareStringW Sleep FreeLibrary MultiByteToWideChar

user32

BringWindowToTop LockWindowUpdate GetMenuDefaultItem InvertRect HideCaret EnableScrollBar GetNextDlgTabItem GetIconInfo LoadImageW GetNextDlgGroupItem EndDialog CreateDialogIndirectParamW TranslateAcceleratorW InsertMenuItemW ReuseDDElParam UnpackDDElParam DefFrameProcW DefMDIChildProcW DrawMenuBar TranslateMDISysAccel MonitorFromPoint UnionRect UpdateLayeredWindow IsMenu CreateMenu PostThreadMessageW WaitMessage SetMenuDefaultItem IsClipboardFormatAvailable FrameRect GetUpdateRect OpenClipboard SetClipboardData CloseClipboard EmptyClipboard RegisterClipboardFormatW CopyIcon CharUpperBuffW GetDoubleClickTime IsCharLowerW GetKeyNameTextW MapVirtualKeyExW SubtractRect MapDialogRect DrawIcon DestroyCursor GetWindowRgn WindowFromPoint CreatePopupMenu DestroyAcceleratorTable SetParent SetWindowRgn IsZoomed OffsetRect IsRectEmpty KillTimer SetTimer DeleteMenu ShowOwnedPopups IntersectRect InvalidateRect IsIconic SetLayeredWindowAttributes EnumDisplayMonitors SetRectEmpty CopyImage EndPaint BeginPaint GetWindowDC GrayStringW DrawTextExW DrawTextW TabbedTextOutW FillRect SystemParametersInfoW DestroyMenu GetMenuItemInfoW InflateRect CharUpperW DestroyIcon GetDesktopWindow RealChildWindowFromPoint ClientToScreen ShowWindow MoveWindow SetWindowTextW IsDialogMessageW CheckDlgButton RegisterWindowMessageW LoadIconW SendDlgItemMessageW SetCursorPos WinHelpW IsChild GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW IsWindow SetFocus GetForegroundWindow SetActiveWindow BeginDeferWindowPos EndDeferWindowPos GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MonitorFromWindow GetMonitorInfoW MapWindowPoints ScrollWindow TrackPopupMenu SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos SetForegroundWindow ShowScrollBar RedrawWindow UpdateWindow GetClientRect PostMessageW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx GetWindowRect ScreenToClient EqualRect DeferWindowPos GetScrollInfo SetScrollInfo SetWindowPlacement GetWindowPlacement GetDlgCtrlID DefWindowProcW CallWindowProcW GetMenu SetWindowLongW SetWindowPos CopyRect PtInRect GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW EnableMenuItem CheckMenuItem GetWindowTextLengthW GetWindowTextW GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush SetWindowsHookExW CallNextHookEx GetMessageW GetActiveWindow IsWindowVisible GetKeyState GetCursorPos ValidateRect GetMenuState GetMenuStringW AppendMenuW GetMenuItemID InsertMenuW GetMenuItemCount GetSubMenu RemoveMenu MessageBoxW SetCursor LoadCursorW wsprintfW MsgWaitForMultipleObjects GetWindowThreadProcessId SendMessageW GetParent GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow UnhookWindowsHookEx PeekMessageW DispatchMessageW TranslateMessage SetRect CreateAcceleratorTableW LoadAcceleratorsW GetKeyboardState GetKeyboardLayout MapVirtualKeyW ToUnicodeEx CopyAcceleratorTableW DrawFocusRect DrawFrameControl DrawEdge DrawIconEx DrawStateW MessageBeep ReleaseCapture SetCapture GetSystemMenu LoadMenuW SetClassLongW GetAsyncKeyState SendDlgItemMessageA NotifyWinEvent PostQuitMessage

advapi32

RegCreateKeyExW RegOpenKeyExW RegCloseKey RegDeleteValueW RegSetValueExW RegEnumKeyExW RegQueryValueExW RegDeleteKeyW OpenProcessToken GetTokenInformation

shell32

ShellExecuteW ShellExecuteExW SHGetFileInfoW SHBrowseForFolderW SHAppBarMessage DragQueryFileW DragFinish SHGetFolderPathW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetDesktopFolder

msimg32

TransparentBlt AlphaBlend

comctl32

ImageList_GetIconSize

shlwapi

PathStripToRootW PathIsUNCW PathFindExtensionW PathFindFileNameW PathRemoveFileSpecW

oleacc

CreateStdAccessibleObject AccessibleObjectFromWindow LresultFromObject

gdiplus

GdipGetImageGraphicsContext GdipBitmapUnlockBits GdipFree GdipAlloc GdipDeleteGraphics GdipDisposeImage GdipCreateBitmapFromHBITMAP GdiplusStartup GdiplusShutdown GdipCreateFromHDC GdipSetInterpolationMode GdipDrawImageRectI GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipGetImagePaletteSize GdipGetImagePalette GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipDrawImageI

imm32

ImmReleaseContext ImmGetContext ImmGetOpenStatus

winmm

PlaySoundW

gdi32

CreateCompatibleBitmap CreateRectRgnIndirect GetTextMetricsW EnumFontFamiliesW GetTextCharsetInfo SetRectRgn CopyMetaFileW CreateDCW CreateBitmap SetTextColor SetBkColor GetObjectW DeleteObject CreateFontIndirectW CreateCompatibleDC DeleteDC ExtSelectClipRgn BitBlt ExtTextOutW GetTextExtentPoint32W SaveDC RestoreDC SetBkMode CreateDIBitmap CreateHatchBrush CreateSolidBrush CreatePen GetObjectType SelectPalette SetPolyFillMode SetROP2 SetMapMode GetClipBox ExcludeClipRect IntersectClipRect LineTo MoveToEx SetTextAlign GetLayout SelectClipRgn GetStockObject GetViewportExtEx GetWindowExtEx GetPixel PtVisible RectVisible TextOutW Escape CombineRgn PatBlt DPtoLP ScaleWindowExtEx SetWindowExtEx OffsetWindowOrgEx SetWindowOrgEx CreateDIBSection CreateRoundRectRgn CreatePolygonRgn GetBkColor GetTextColor CreateEllipticRgn Polyline Ellipse Polygon CreatePalette GetPaletteEntries GetNearestPaletteIndex RealizePalette GetSystemPaletteEntries OffsetRgn GetRgnBox SetDIBColorTable StretchBlt SetPixel Rectangle EnumFontFamiliesExW LPtoDP GetWindowOrgEx GetViewportOrgEx PtInRegion FillRgn FrameRgn GetBoundsRect ExtFloodFill SetPaletteEntries GetTextFaceW SetPixelV CreateRectRgn CreatePatternBrush ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetLayout GetDeviceCaps SelectObject

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

comdlg32

GetFileTitleW

ole32

OleGetClipboard RegisterDragDrop CoLockObjectExternal DoDragDrop CreateStreamOnHGlobal OleLockRunning IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor CoInitializeEx CoUninitialize CoInitialize CoTaskMemFree CoCreateInstance OleDuplicateData CoTaskMemAlloc ReleaseStgMedium RevokeDragDrop

oleaut32

VariantClear VariantChangeType VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen SysAllocStringLen VarBstrFromDate VariantInit SysAllocString SysFreeString

Xenos.exe

IMPHASH 2c4f8364dc2c225221cd7dc66caea7e0
SHA256 def1c2f12307d598e42506a55f1a06ed5e652af0d260aac9572469429f10d04d
MD5 4731b90db56fc5dd654d59deca1009e6
SHA1 7c486d696813b1e0102f2feb300e6c6a7610287c
SHA512 5d089c44cf073c438d68d3c48172647b8bf1b36886ab93fed3f2f41d2b5454ac14092653d4d70c5ef8076c1f88e1aab9c5bc732097f12e3ade32ab6ea258d6a0
SSDEEP 24576:F6vLpf9LJiOm0xg2VkVtw099I98mzGokH/Ngwpsu+VfSVgPCS3tMrMyj3F9hIF12:afJWVD99U8okH/NSVRSVE3tMx3FE1S0W
TLSH
T13445AE0272C580B2D17202705E7D9B368AFDBD250B2187DF67846B2D9F74EE22D36726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

390157

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Ton\Documents\Visual Studio 2017\Projects\Xenos\build\Win32\Release\Xenos.pdb

shlwapi

SHDeleteKeyW SHSetValueW

dbghelp

MiniDumpWriteDump

kernel32

RaiseException LoadResource FindResourceW DecodePointer GetWindowsDirectoryW DeleteCriticalSection CreateProcessW GetCurrentProcess GetModuleFileNameW WaitForSingleObject GetCurrentThreadId Sleep CreateThread GetLocalTime ExitProcess GetCurrentProcessId SetUnhandledExceptionFilter FlushFileBuffers GetFileAttributesW ResumeThread CloseHandle GetNativeSystemInfo GetModuleHandleW DeleteFileW LockResource GetLastError Wow64RevertWow64FsRedirection CreateFileW InitializeCriticalSectionEx Wow64DisableWow64FsRedirection WriteFile VirtualProtect SetEndOfFile WriteConsoleW ReadConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetTimeZoneInformation SetFilePointerEx EnumSystemLocalesW SizeofResource GetCommandLineW GetCurrentDirectoryW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW HeapFree GetConsoleMode GetConsoleCP EnterCriticalSection LeaveCriticalSection InitializeCriticalSection MultiByteToWideChar FormatMessageW LocalFree WideCharToMultiByte DeviceIoControl GetSystemTimeAsFileTime QueryPerformanceCounter VirtualFree VirtualAlloc TerminateProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW GetExitCodeProcess Thread32Next Thread32First CreateActCtxW GetTempPathW UnmapViewOfFile GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile DuplicateHandle ResetEvent GetTickCount LoadLibraryW GetProcAddress FreeLibrary GetCurrentThread GetSystemInfo VirtualAllocEx VirtualFreeEx ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW DeactivateActCtx GetSystemWow64DirectoryW Module32FirstW ReadFile CreateNamedPipeW TerminateThread GetExitCodeThread OpenProcess IsWow64Process SuspendThread GetThreadTimes OpenThread WriteProcessMemory VirtualProtectEx GetThreadContext ReadProcessMemory CreateRemoteThread SetThreadContext VirtualQueryEx GetStringTypeW TryEnterCriticalSection WaitForSingleObjectEx SwitchToThread SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo SetEvent IsDebuggerPresent UnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead OutputDebugStringW CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind ExitThread GetModuleHandleExW GetStdHandle GetFileType HeapAlloc

user32

GetWindowTextW GetMenu CreateWindowExW DestroyIcon LoadIconW ChangeWindowMessageFilterEx EnableMenuItem wsprintfW GetMessageW CreateDialogParamW CallWindowProcW DestroyWindow MessageBoxW SendMessageW EndDialog SetWindowTextW LoadAcceleratorsW ShowWindow IsWindow DispatchMessageW IsDialogMessageW TranslateAcceleratorW TranslateMessage SendMessageA SetWindowLongW GetDlgItem DialogBoxParamW EnableWindow

comdlg32

GetOpenFileNameW GetSaveFileNameW

shell32

CommandLineToArgvW DragQueryFileW

ole32

CoUninitialize CoCreateInstance CoInitialize

advapi32

RegCreateKeyW RegOpenKeyExW RegEnumValueW LookupPrivilegeValueW AdjustTokenPrivileges OpenThreadToken RegOpenKeyW OpenProcessToken RegSetValueExW RegCloseKey ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW

??0Assembler@asmjit@@QAE@PAURuntime@1@@Z ??0CodeGen@asmjit@@QAE@PAURuntime@1@@Z ??0HostRuntime@asmjit@@QAE@XZ ??0JitRuntime@asmjit@@QAE@XZ ??0Runtime@asmjit@@QAE@XZ ??0StaticRuntime@asmjit@@QAE@PAXI@Z ??0VMemMgr@asmjit@@QAE@PAX@Z ??0X86Assembler@asmjit@@QAE@PAURuntime@1@I@Z ??0Zone@asmjit@@QAE@I@Z ??1Assembler@asmjit@@UAE@XZ ??1CodeGen@asmjit@@UAE@XZ ??1HostRuntime@asmjit@@UAE@XZ ??1JitRuntime@asmjit@@UAE@XZ ??1Runtime@asmjit@@UAE@XZ ??1StaticRuntime@asmjit@@UAE@XZ ??1VMemMgr@asmjit@@QAE@XZ ??1X86Assembler@asmjit@@UAE@XZ ??1Zone@asmjit@@QAE@XZ ??_FVMemMgr@asmjit@@QAEXXZ ?_alloc@Zone@asmjit@@QAEPAXI@Z ?_emit@X86Assembler@asmjit@@UAEIIABUOperand@2@000@Z ?_grow@Assembler@asmjit@@QAEII@Z ?_grow@PodVectorBase@asmjit@@IAEIII@Z ?_newLabel@Assembler@asmjit@@QAEIPAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QAEPAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QAEII@Z ?_relocCode@X86Assembler@asmjit@@UBEIPAX_K@Z ?_reserve@Assembler@asmjit@@QAEII@Z ?_reserve@PodVectorBase@asmjit@@IAEIII@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UAEIPAPAXPAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UAEIPAPAXPAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UAEIII@Z ?alloc@VMemMgr@asmjit@@QAEPAXII@Z ?alloc@VMemUtil@asmjit@@SAPAXIPAII@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPAXPAXIPAII@Z ?allocZeroed@Zone@asmjit@@QAEPAXI@Z ?bind@Assembler@asmjit@@UAEIABULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QAEPAXPBXI@Z ?embed@Assembler@asmjit@@UAEIPBXI@Z ?embedLabel@X86Assembler@asmjit@@QAEIABULabel@2@@Z ?emit@Assembler@asmjit@@QAEII@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@00@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@00H@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@0@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@0H@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@H@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@_K@Z ?emit@Assembler@asmjit@@QAEIIH@Z ?emit@Assembler@asmjit@@QAEII_K@Z ?flush@HostRuntime@asmjit@@UAEXPAXI@Z ?getCpuInfo@HostRuntime@asmjit@@UAEPBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SAIXZ ?getPageSize@VMemUtil@asmjit@@SAIXZ ?getStackAlignment@HostRuntime@asmjit@@UAEIXZ ?make@Assembler@asmjit@@UAEPAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KABUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UAEIPAX@Z ?release@StaticRuntime@asmjit@@UAEIPAX@Z ?release@VMemMgr@asmjit@@QAEIPAX@Z ?release@VMemUtil@asmjit@@SAIPAXI@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPAX0I@Z ?relocCode@Assembler@asmjit@@QBEIPAX_K@Z ?reset@Assembler@asmjit@@QAEX_N@Z ?reset@PodVectorBase@asmjit@@QAEX_N@Z ?reset@VMemMgr@asmjit@@QAEXXZ ?reset@Zone@asmjit@@QAEX_N@Z ?sdup@Zone@asmjit@@QAEPADPBD@Z ?setArch@X86Assembler@asmjit@@QAEII@Z ?setError@CodeGen@asmjit@@QAEIIPBD@Z ?setErrorHandler@CodeGen@asmjit@@QAEIPAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QAAPADPBDZZ ?shrink@VMemMgr@asmjit@@QAEIPAXI@Z ?x86RegData@asmjit@@3UX86RegData@1@B

penis.dll

IMPHASH 2fdd434a46f2b8bee37a95d9f07f067a
SHA256 43db523c080d4b4d3077c631f471fd35d8b737c9863f1e01e9dd536cb4879f7a
MD5 6494b559c1d47c6ceb16030b63513994
SHA1 4f65b798ad2fe45c78011e4f300c95134fddefb1
SHA512 c45c504db69f6213a418afea4efaf1e156fe0a572f5755ae91667917465d162055c7ce433219983c6a5d9dd9362451c01049bf3085019876b80d3c54d3a793b9
SSDEEP 196608:pQVIRyXspnKu3zJrSPBuQTFOMF9rjFLYQ7bdYSTTSdejRvmpCk3DZlkgaQQjkEC0:lhpDJrWB7vv5B1ThOpC+AsM7cQ
TLSH
T162E61229BDC5F569D187A13110528023BB2870CEE14BE17B06EC65AB5E73D960F13FEA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21892

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls CloseHandle CreateThread GetModuleHandleA GetProcAddress FreeLibraryAndExitThread GetLastError GetFileAttributesA GetModuleHandleW CreateDirectoryA Sleep GetCurrentProcess GetCurrentProcessId GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead HeapCreate

user32

TranslateMessage GetForegroundWindow MessageBoxA GetCursorPos PeekMessageW DispatchMessageW GetAsyncKeyState GetClassNameW MapVirtualKeyA PostMessageW GetKeyNameTextA

shell32

SHGetFolderPathA

msvcp140

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove __std_exception_destroy __std_exception_copy __std_terminate _CxxThrowException memset __std_type_info_destroy_list memcpy __C_specific_handler

api-ms-win-crt-heap-l1-1-0

malloc free calloc _callnewh

api-ms-win-crt-stdio-l1-1-0

fgetpos fwrite setvbuf fsetpos fgetc fread fclose fflush fputc _fseeki64 ungetc _get_stream_buffer_pointers

api-ms-win-crt-string-l1-1-0

strcmp strncpy_s

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _cexit _invalid_parameter_noinfo_noreturn _crt_atexit _initterm_e _initterm

Sharing

General

Malware Config

Signatures

File Explorer

Yeni WinRAR ZIP arşivi.zip

TLauncher-Installer-1.9.5.1.exe

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

shell32

msimg32

comctl32

shlwapi

oleacc

gdiplus

imm32

winmm

gdi32

winspool.drv

comdlg32

ole32

oleaut32

generic

Xenos.exe

shlwapi

dbghelp

kernel32

user32

comdlg32

shell32

ole32

advapi32

generic

penis.dll

kernel32

user32

shell32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

generic