Saarandsky FFlag Launcer[.]exe

Resubmissions

30/07/2026, 14:00

260730-ra8arazape8

30/07/2026, 13:57

260730-q9f5wabl9t8

30/07/2026, 13:56

260730-q84jsabl813

Sharing

Copy URL Twitter E-mail

General

Target
Saarandsky FFlag Launcer.exe
Size 536KB
Sample260730-q84jsabl81
SHA256 c5da7c20ea6c6d18e8adcd3daf88f552dbf5398e387079b742f25b333a7177f1
MD5 82c263203f9d308ba61f30bc5f06a662
SHA1 81fab17d8ccf4495218c4459c2aff1a74da6a529
SHA512 49d71b88b4a55fb6d33b06f1841a2b7d759630866c94d242d5d9feb7b88533933ad1d4fda4269655a41d346a34d62862aa72ebba64a9e13ea43f0c38c82b4510
SSDEEP 6144:Ms54E1/6mZsmXg5ORbrc6e0xzhSURvvMXYEUfwOWb+URUTeoEaQrP9RsInH4qgnN:MrEktgo6pxUqEUnabXL7sOgpg2
TLSH
T1F0C47DA9A66407F5D1A7C138CA824507F7B27C5A0761DADF03E04AB61F276E24E3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Saarandsky FFlag Launcer.exe

File Explorer

Saarandsky FFlag Launcer.exe

.exe 536KB

Saarandsky FFlag Launcer.exe

IMPHASH 94c620cf1546b01f2838a4f75436530e
SHA256 c5da7c20ea6c6d18e8adcd3daf88f552dbf5398e387079b742f25b333a7177f1
MD5 82c263203f9d308ba61f30bc5f06a662
SHA1 81fab17d8ccf4495218c4459c2aff1a74da6a529
SHA512 49d71b88b4a55fb6d33b06f1841a2b7d759630866c94d242d5d9feb7b88533933ad1d4fda4269655a41d346a34d62862aa72ebba64a9e13ea43f0c38c82b4510
SSDEEP 6144:Ms54E1/6mZsmXg5ORbrc6e0xzhSURvvMXYEUfwOWb+URUTeoEaQrP9RsInH4qgnN:MrEktgo6pxUqEUnabXL7sOgpg2
TLSH
T1F0C47DA9A66407F5D1A7C138CA824507F7B27C5A0761DADF03E04AB61F276E24E3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

205320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetTickCount GlobalUnlock AllocConsole Process32First Module32Next Module32First OpenProcess CreateToolhelp32Snapshot Process32Next VirtualQueryEx SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage CreateDirectoryA SetConsoleTitleA ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetFileType ReadProcessMemory GlobalLock SetFileAttributesA CreateThread FreeConsole CloseHandle LoadLibraryA GetLastError GetTempPathA Sleep GetModuleHandleA HeapReAlloc WaitForSingleObject SetFilePointerEx GetFileSizeEx ReadConsoleW WriteProcessMemory GetCommandLineW GetCommandLineA WriteFile GetStdHandle GetModuleFileNameW QueryPerformanceCounter QueryPerformanceFrequency FormatMessageA ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread LocalFree GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte SleepConditionVariableSRW InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable CompareStringEx GetCPInfo GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess RtlUnwind

user32

BeginPaint EndPaint EnableWindow GetCursorPos UnregisterHotKey GetMessageA DispatchMessageA GetWindowRect LoadCursorA FillRect CallNextHookEx GetSystemMetrics ShowWindow GetAsyncKeyState OpenClipboard SetTimer DrawTextA CloseClipboard SetWindowsHookExA RegisterHotKey GetForegroundWindow UnhookWindowsHookEx DefWindowProcA CreateWindowExA TranslateMessage GetClipboardData SendMessageA GetClientRect KillTimer PostQuitMessage GetWindowTextLengthA FindWindowA PtInRect RegisterClassExA UpdateWindow InvalidateRect

gdi32

CreateFontA SelectObject GetStockObject SetTextColor SetBkMode LineTo CreatePen MoveToEx Ellipse DeleteObject CreateSolidBrush RoundRect

shell32

SHGetFolderPathA

comctl32

InitCommonControlsEx

wininet

InternetOpenA InternetCloseHandle InternetReadFile InternetOpenUrlA

Name

.text

Size

386KB

Virtual Size

385KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

119KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Saarandsky FFlag Launcer.exe

kernel32

user32

gdi32

shell32

comctl32

wininet

generic