Launcher[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Launcher.exe
Size 401KB
Sample260805-glrf9sed52
SHA256 5c87f6a43bf8df71faa10e6469c284cb14465c8ea1279c4f75bd877b4a128bdb
MD5 72d9d842c44107e2bbbf3ebee87529d1
SHA1 3399173fa0192c498b1c24158769673c9d00d454
SHA512 c1d758e277f5628e9cce7389e5a9a4a960104d54dca9997b24762febce84533887b4dd6d0a9a09c08a0fb8696b8629bbd9c113175114b40ebbb9db87e573aae9
SSDEEP 12288:2caDyCWDHnSUJ8fRhIo7M40Dn1GMqqyTtBLA:zaDcSUJEIhDs+kBLA
TLSH
T12894F0D9D8519EF7C28609B09A36009978B07B7BCFA964DA33E23C515A70DED534E332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Launcher.exe

File Explorer

Launcher.exe

.exe 401KB

Launcher.exe

IMPHASH 17e0c44e4ecf5477369b8d10f9309272
SHA256 5c87f6a43bf8df71faa10e6469c284cb14465c8ea1279c4f75bd877b4a128bdb
MD5 72d9d842c44107e2bbbf3ebee87529d1
SHA1 3399173fa0192c498b1c24158769673c9d00d454
SHA512 c1d758e277f5628e9cce7389e5a9a4a960104d54dca9997b24762febce84533887b4dd6d0a9a09c08a0fb8696b8629bbd9c113175114b40ebbb9db87e573aae9
SSDEEP 12288:2caDyCWDHnSUJ8fRhIo7M40Dn1GMqqyTtBLA:zaDcSUJEIhDs+kBLA
TLSH
T12894F0D9D8519EF7C28609B09A36009978B07B7BCFA964DA33E23C515A70DED534E332
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Sleep GetConsoleMode CloseHandle SetConsoleTitleW ReadFile WriteProcessMemory WaitForSingleObject CreateFileW CreateToolhelp32Snapshot OpenProcess GetLastError Process32NextW Process32FirstW VirtualProtectEx VirtualAllocEx GetFileSize CreateRemoteThread VirtualFreeEx SetUnhandledExceptionFilter SetConsoleMode GetExitCodeThread GetStdHandle InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW

advapi32

GetTokenInformation OpenProcessToken

shell32

ShellExecuteW

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset __C_specific_handler _CxxThrowException __current_exception __current_exception_context __std_exception_copy memcpy __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __acrt_iob_func _set_fmode __p__commode

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _set_app_type _get_initial_narrow_environment exit _initialize_onexit_table _register_onexit_function _crt_atexit terminate _seh_filter_exe _configure_narrow_argv _initterm_e system _initialize_narrow_environment _initterm _exit

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _callnewh free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

wcslen

Name

.text

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

732B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.upx0

Size

371KB

Virtual Size

371KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

116B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Launcher.exe

kernel32

advapi32

shell32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

generic