Launcher[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Launcher.exe
Size 46.4MB
Sample260807-ar4v8athmc
SHA256 2171c280ac5dab4747127d5dd24f6d512f19f6d64d103d8c50d33e0b2072f4fe
MD5 cb676a2f3585a4b44e506bd01d35b63c
SHA1 8f8fb7d4b0bcd0b08e6f1d69989dc1bc472dad7a
SHA512 baa357c28f64493836b440384a54e3ffcbe6f7a4a059178b71cecf22716f9064e175f96a8fe067345e243bab1ec714b8adbf76b00f21afa5537e60d7d1935634
SSDEEP 786432:KSy89Rv5xj16kF0PxkbhgbX/W0QQE+HWt+14fkaHYJZnIiJPKX8v3feuF:K/8PBxj16kFHiLW02iWtw4M4EIiRyGd
TLSH
T144B722C669D181ACC881C574F6850AFEE4CDF8898CBD592FBFCB48123135CA6C8E9579
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Launcher.exe

File Explorer

Launcher.exe

.exe 46.4MB

Launcher.exe

IMPHASH 6eb3b8d5208d04b592abe956379bbbe1
SHA256 2171c280ac5dab4747127d5dd24f6d512f19f6d64d103d8c50d33e0b2072f4fe
MD5 cb676a2f3585a4b44e506bd01d35b63c
SHA1 8f8fb7d4b0bcd0b08e6f1d69989dc1bc472dad7a
SHA512 baa357c28f64493836b440384a54e3ffcbe6f7a4a059178b71cecf22716f9064e175f96a8fe067345e243bab1ec714b8adbf76b00f21afa5537e60d7d1935634
SSDEEP 786432:KSy89Rv5xj16kF0PxkbhgbX/W0QQE+HWt+14fkaHYJZnIiJPKX8v3feuF:K/8PBxj16kFHiLW02iWtw4M4EIiRyGd
TLSH
T144B722C669D181ACC881C574F6850AFEE4CDF8898CBD592FBFCB48123135CA6C8E9579
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

48811120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dbghelp

SymFunctionTableAccess64

crypt32

CertDuplicateCertificateContext

ws2_32

ntohs

d3d11

D3D11CreateDeviceAndSwapChain

dxgi

CreateDXGIFactory2

mfplat

MFCreateMediaType

mfreadwrite

MFCreateSourceReaderFromURL

bcrypt

BCryptDestroyKey

shell32

ShellExecuteA

advapi32

ControlService

urlmon

URLDownloadToFileW

kernel32

OutputDebugStringW

user32

SetCapture

gdi32

CreateRoundRectRgn

ole32

CoTaskMemFree

oleaut32

SysFreeString

msvcp140

?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ

ntdll

NtQuerySystemInformation

winmm

timeEndPeriod

winhttp

WinHttpCrackUrl

wintrust

WinVerifyTrust

shlwapi

PathFileExistsW

imm32

ImmGetContext

d3dcompiler_47

D3DCompile

vcruntime140

__std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

_stricmp

api-ms-win-crt-stdio-l1-1-0

fputs

api-ms-win-crt-runtime-l1-1-0

_errno

api-ms-win-crt-heap-l1-1-0

realloc

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_wremove

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

ceilf

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

secur32

InitSecurityInterfaceW

iphlpapi

if_nametoindex

Name

.text

Size

Virtual Size

14.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

283KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.Dbq

Size

Virtual Size

26.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.0o2

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

."(R

Size

46.2MB

Virtual Size

46.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

265KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Launcher.exe

dbghelp

crypt32

ws2_32

d3d11

dxgi

mfplat

mfreadwrite

bcrypt

shell32

advapi32

urlmon

kernel32

user32

gdi32

ole32

oleaut32

msvcp140

ntdll

winmm

winhttp

wintrust

shlwapi

imm32

d3dcompiler_47

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

secur32

iphlpapi

generic