reboot_launcher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
reboot_launcher.exe
Size 212KB
Sample260808-cbb7daxhka
SHA256 d1f0c8a945ecd14859173a047a6d43a721babb6a800d3a3d1200e9424f5b2056
MD5 47d2e57e14f0b49b3298bde869fe095a
SHA1 7028ea00098df48134f843bb22ddefc38d0e0476
SHA512 adf643e486559bcfdffdaa743c24adb0e510d7defca1653eab487d2aaf1faf257a8ab84ec94460c118255a6c415225efbbccbc0ab663e639cb00273e0cb380eb
SSDEEP 3072:c15RMEnk2uWKmJ/G6hujG69mkN3xI7T4++2POyW4Q80Ulb7I3:cdMWk4pJ/G6hujG6t3w4L2PRuXU17I3
TLSH
T1FE247D27EA5550BED299853CC9435D85DB72BC8A4755ABCF07804EA70F63AD09F3E302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
reboot_launcher.exe

File Explorer

reboot_launcher.exe

.exe 212KB

reboot_launcher.exe

IMPHASH ca13cc8515a0f43cd80fd055d7c639f7
SHA256 d1f0c8a945ecd14859173a047a6d43a721babb6a800d3a3d1200e9424f5b2056
MD5 47d2e57e14f0b49b3298bde869fe095a
SHA1 7028ea00098df48134f843bb22ddefc38d0e0476
SHA512 adf643e486559bcfdffdaa743c24adb0e510d7defca1653eab487d2aaf1faf257a8ab84ec94460c118255a6c415225efbbccbc0ab663e639cb00273e0cb380eb
SSDEEP 3072:c15RMEnk2uWKmJ/G6hujG69mkN3xI7T4++2POyW4Q80Ulb7I3:cdMWk4pJ/G6hujG6t3w4L2PRuXU17I3
TLSH
T1FE247D27EA5550BED299853CC9435D85DB72BC8A4755ABCF07804EA70F63AD09F3E302
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

102400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

app_links_plugin

SendAppLink AppLinksPluginCApiRegisterWithRegistrar

flutter_acrylic_plugin

FlutterAcrylicPluginRegisterWithRegistrar

local_notifier_plugin

LocalNotifierPluginRegisterWithRegistrar

screen_retriever_windows_plugin

ScreenRetrieverWindowsPluginCApiRegisterWithRegistrar

system_theme_plugin

SystemThemePluginRegisterWithRegistrar

url_launcher_windows_plugin

UrlLauncherWindowsRegisterWithRegistrar

window_manager_plugin

WindowManagerPluginRegisterWithRegistrar

windows_taskbar_plugin

WindowsTaskbarPluginRegisterWithRegistrar

flutter_windows

FlutterDesktopEngineDestroy FlutterDesktopEngineReloadSystemFonts FlutterDesktopEngineGetPluginRegistrar FlutterDesktopEngineGetMessenger FlutterDesktopViewControllerCreate FlutterDesktopEngineCreate FlutterDesktopViewControllerGetView FlutterDesktopViewControllerHandleTopLevelWindowProc FlutterDesktopMessengerSend FlutterDesktopMessengerSendWithReply FlutterDesktopMessengerSendResponse FlutterDesktopMessengerSetCallback FlutterDesktopGetDpiForMonitor FlutterDesktopViewControllerDestroy FlutterDesktopMessengerAddRef FlutterDesktopMessengerRelease FlutterDesktopMessengerIsAvailable FlutterDesktopMessengerLock FlutterDesktopMessengerUnlock FlutterDesktopViewGetHWND FlutterDesktopResyncOutputStreams

kernel32

GetStartupInfoW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateMutexW ReleaseMutex GetLastError CloseHandle IsDebuggerPresent GetCommandLineW LocalFree WideCharToMultiByte AllocConsole AttachConsole FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryA

user32

MonitorFromPoint LoadIconW LoadCursorW SetParent SetWindowLongPtrW GetWindowLongPtrW GetMessageW TranslateMessage DispatchMessageW ShowWindow SetWindowPos GetWindowPlacement SetForegroundWindow FindWindowW DefWindowProcW PostQuitMessage RegisterClassW UnregisterClassW CreateWindowExW DestroyWindow MoveWindow SetFocus GetClientRect

shell32

CommandLineToArgvW

ole32

CoUninitialize CoInitializeEx

msvcp140

?good@ios_base@std@@QEBA_NXZ ?_Xbad_function_call@std@@YAXXZ ?sync_with_stdio@ios_base@std@@SA_N_N@Z ?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA ?_Xlength_error@std@@YAXPEBD@Z ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception __current_exception_context __std_exception_copy __std_exception_destroy __C_specific_handler __std_type_info_compare _CxxThrowException memcmp memmove memcpy __std_terminate memset

api-ms-win-crt-runtime-l1-1-0

_initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _initterm_e _set_app_type _c_exit exit _register_onexit_function _crt_atexit _register_thread_local_exe_atexit_callback _invoke_watson _exit _invalid_parameter_noinfo_noreturn terminate _cexit _seh_filter_exe _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode _fileno __acrt_iob_func freopen_s __p__commode _dup2

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh free malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcd7cb

Size

112KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

reboot_launcher.exe

app_links_plugin

flutter_acrylic_plugin

local_notifier_plugin

screen_retriever_windows_plugin

system_theme_plugin

url_launcher_windows_plugin

window_manager_plugin

windows_taskbar_plugin

flutter_windows

kernel32

user32

shell32

ole32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic