App Launcher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
App Launcher.exe
Size 2.5MB
Sample260825-raqqpsap9w
SHA256 881fc31ab407d9615a84cd967ba7d61958958996f804605a11c1c501303b7a8d
MD5 b0aff322a43c49c3c23ece17cc66eb06
SHA1 1a2c1733fe05eaec36d3508432b21ce22042459a
SHA512 4df1cbb9231830a2c73f1bf7eacc9d9436d867aa41e97c6e36774fc6989c045dee19246fb1025f8819c2402d66f224763156052f3f3cd232abc19d997c06559d
SSDEEP 49152:adEMhOqvCgJp8ehSJ6kGLvHDZkBfUfz1Zbflqj+jzbPU1aHm5R9Tj0a3gu2U:5MOimSZ1Zbflqj+jzb5Hm50pU
TLSH
T15EC5AF5B967801FCD077D1B8CA62D607E7B2B05903306ADB03D08ABA2F576E15E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
App Launcher.exe

File Explorer

App Launcher.exe

.exe 2.5MB

App Launcher.exe

IMPHASH c22591e8ac20165c383ea8bc3ea0d412
SHA256 881fc31ab407d9615a84cd967ba7d61958958996f804605a11c1c501303b7a8d
MD5 b0aff322a43c49c3c23ece17cc66eb06
SHA1 1a2c1733fe05eaec36d3508432b21ce22042459a
SHA512 4df1cbb9231830a2c73f1bf7eacc9d9436d867aa41e97c6e36774fc6989c045dee19246fb1025f8819c2402d66f224763156052f3f3cd232abc19d997c06559d
SSDEEP 49152:adEMhOqvCgJp8ehSJ6kGLvHDZkBfUfz1Zbflqj+jzbPU1aHm5R9Tj0a3gu2U:5MOimSZ1Zbflqj+jzb5Hm50pU
TLSH
T15EC5AF5B967801FCD077D1B8CA62D607E7B2B05903306ADB03D08ABA2F576E15E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1743456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain D3D11CreateDevice

dxgi

CreateDXGIFactory2 CreateDXGIFactory1

dwmapi

DwmExtendFrameIntoClientArea

user32

DestroyWindow ShowWindow CreateWindowExW GetClientRect IsWindow MessageBoxA RegisterClassExW UnregisterClassW DefWindowProcW PeekMessageW SendInput GetWindowRect GetWindowTextA IsWindowVisible wsprintfW GetSystemMetrics SetProcessDPIAware DispatchMessageW TranslateMessage EnumDisplaySettingsW GetAsyncKeyState GetWindowThreadProcessId SetLayeredWindowAttributes EnumWindows

winmm

timeBeginPeriod timeEndPeriod

bcrypt

BCryptCloseAlgorithmProvider BCryptSetProperty BCryptOpenAlgorithmProvider BCryptGenerateKeyPair BCryptEncrypt BCryptDecrypt BCryptExportKey BCryptImportKeyPair BCryptFinalizeKeyPair BCryptDestroyKey BCryptDestroySecret BCryptSecretAgreement BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptGenRandom BCryptGenerateSymmetricKey BCryptDeriveKey

ole32

CoSetProxyBlanket CoTaskMemFree CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

crypt32

CryptBinaryToStringA CryptProtectData CryptUnprotectData CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore

secur32

InitSecurityInterfaceW

ws2_32

send recv ntohs listen htonl getsockname closesocket inet_pton accept inet_ntop getsockopt WSACloseEvent WSACreateEvent socket gethostname WSACleanup WSAResetEvent WSAWaitForMultipleEvents WSAGetLastError connect getpeername ioctlsocket sendto recvfrom select __WSAFDIsSet WSAEnumNetworkEvents bind WSAStartup WSAIoctl WSASetLastError setsockopt htons ntohl getaddrinfo WSAEventSelect freeaddrinfo

iphlpapi

if_nametoindex

kernel32

GetModuleHandleExW RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree ExitThread FreeLibraryAndExitThread GetDriveTypeW GetFileInformationByHandle SystemTimeToTzSpecificLocalTime GetConsoleMode ReadConsoleW GetConsoleOutputCP SetFilePointerEx IsProcessorFeaturePresent GetCommandLineA GetCommandLineW RaiseException GetFileInformationByHandleEx GetStringTypeW AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindFirstFileExW GetCurrentDirectoryW GetLocaleInfoEx SleepConditionVariableSRW WakeAllConditionVariable TryAcquireSRWLockExclusive GetExitCodeThread RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent EncodePointer LCMapStringEx GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime DecodePointer WaitForSingleObject SetWaitableTimerEx Sleep ExitProcess GetModuleHandleW GetProcAddress UnhandledExceptionFilter CreateDirectoryW CreateFileW DeleteFileW FileTimeToLocalFileTime FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileSizeEx ReadFile CloseHandle InitializeSListHead GetModuleFileNameA GetModuleFileNameW MoveFileW FileTimeToSystemTime MultiByteToWideChar HeapAlloc HeapFree GetProcessHeap GetCurrentProcess GetCurrentProcessId TerminateProcess GetCurrentThread GetCurrentThreadId OpenThread CreateProcessW OpenProcess GetSystemFirmwareTable VirtualProtect QueryFullProcessImageNameW CreateToolhelp32Snapshot Module32FirstW Module32NextW GetSystemTimePreciseAsFileTime GetLocalTime GetLastError CreateWaitableTimerExW MoveFileExW GetSystemTimes QueryPerformanceCounter QueryPerformanceFrequency SetEvent CreateEventW ReleaseMutex OpenEventA MapViewOfFile UnmapViewOfFile OpenMutexA OpenFileMappingA WriteFile LocalFree GetFileAttributesA CreateThread GetTickCount64 GetSystemDirectoryW VirtualQuery AddDllDirectory SetDefaultDllDirectories RtlUnwind VirtualFree VirtualLock VirtualUnlock GetOverlappedResult CancelIo CreateFileA FlushFileBuffers FreeLibrary LoadLibraryW ClearCommError GetCommState SetCommState SetCommTimeouts DuplicateHandle GetTempFileNameW RemoveDirectoryW GetTempPathW ResetEvent WaitForMultipleObjects SetLastError ReleaseSRWLockExclusive AcquireSRWLockExclusive FormatMessageA SleepEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetFullPathNameW InitializeConditionVariable GetEnvironmentVariableA VerSetConditionMask VerifyVersionInfoW GetStdHandle GetFileType PeekNamedPipe WakeConditionVariable SleepConditionVariableCS WaitForSingleObjectEx InitializeCriticalSection GetSystemInfo GetTickCount LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetExitCodeProcess CreatePipe GetTimeZoneInformation HeapReAlloc SetStdHandle SetEndOfFile IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW HeapSize WriteConsoleW LoadLibraryExA RtlLookupFunctionEntry WideCharToMultiByte SetDllDirectoryW

comdlg32

GetOpenFileNameW

advapi32

RegDeleteValueW RegCreateKeyExA SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegEnumValueW RegEnumKeyW RegDeleteKeyA RegCreateKeyExW RegQueryValueExA RegOpenKeyExA RegEnumValueA RegCloseKey ConvertSidToStringSidA GetTokenInformation OpenProcessToken

shell32

ShellExecuteA ShellExecuteW

ntdll

RtlPcToFileHeader

d2d1

ord1

dwrite

DWriteCreateFactory

shlwapi

PathFindFileNameW

wintrust

WinVerifyTrust

dnsapi

DnsQuery_A DnsFree

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

464KB

Virtual Size

464KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ident

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

App Launcher.exe

d3d11

dxgi

dwmapi

user32

winmm

bcrypt

ole32

oleaut32

crypt32

secur32

ws2_32

iphlpapi

kernel32

comdlg32

advapi32

shell32

ntdll

d2d1

dwrite

shlwapi

wintrust

dnsapi

generic