launcher[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
launcher.exe
Size 1.2MB
Sample260925-v5bf2stv2q
SHA256 efd1c803adec591a61f5cc0f3d20470672d4e961fbfe88f781f95381ac7f133e
MD5 ef97774ba67432b1909e6c8ba47a313b
SHA1 cbf4a123ac0e279a89a7c5ba795300948127f8f8
SHA512 bf93ce8252de3319fb376422fca5dfbba9d916f369a8a841d42bde1aec1f962d872fdf935cccddc3bdc8562ea333d1c0a9d827cc1954d20dd9c54d79aa6c6993
SSDEEP 24576:7T/7TBHNYOVksl3ze4g+W+K4CxUjb8RUitbw:7rHBHNYCe4g+WsCxWbRWw
TLSH
T198559DA9BBA8518AC53B903DCAA38618F5B13C4157314ACB51E4639D2F33EE52E3F714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
launcher.exe

File Explorer

launcher.exe

.exe 1.2MB

launcher.exe

IMPHASH 9b1bc1fa583ebc1132beea2c02f7f840
SHA256 efd1c803adec591a61f5cc0f3d20470672d4e961fbfe88f781f95381ac7f133e
MD5 ef97774ba67432b1909e6c8ba47a313b
SHA1 cbf4a123ac0e279a89a7c5ba795300948127f8f8
SHA512 bf93ce8252de3319fb376422fca5dfbba9d916f369a8a841d42bde1aec1f962d872fdf935cccddc3bdc8562ea333d1c0a9d827cc1954d20dd9c54d79aa6c6993
SSDEEP 24576:7T/7TBHNYOVksl3ze4g+W+K4CxUjb8RUitbw:7rHBHNYCe4g+WsCxWbRWw
TLSH
T198559DA9BBA8518AC53B903DCAA38618F5B13C4157314ACB51E4639D2F33EE52E3F714
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14566

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\build\discbot03\t1xfinal-pc-1.1.3\pc\default\Release\launcher.pdb

ole32

CoInitializeEx CoUninitialize

winpixeventruntime

PIXEventsReplaceBlock PIXGetThreadInfo

avrt

AvRevertMmThreadCharacteristics AvSetMmThreadCharacteristicsW AvSetMmThreadPriority

ntdll

NtQuerySystemInformation RtlUnwindEx RtlPcToFileHeader RtlUnwind

winmm

timeBeginPeriod timeEndPeriod

kernel32

GetConsoleMode CreateFileW WriteConsoleW HeapSize HeapReAlloc RtlCaptureContext GetConsoleOutputCP ReadConsoleW FlushFileBuffers SetFilePointerEx GetFileSizeEx CloseHandle CreateProcessA OutputDebugStringW GetProcessTimes GetCurrentProcess GetCurrentProcessId GlobalMemoryStatusEx GetSystemInfo GetSystemTimeAsFileTime LocalAlloc LocalFree RaiseException WaitForSingleObject Sleep SwitchToThread GetCurrentThread SetThreadPriority SuspendThread ResumeThread GetThreadId SetThreadDescription GetProcessAffinityMask SwitchToFiber DeleteFiber ConvertFiberToThread CreateFiberEx ConvertThreadToFiber SetThreadAffinityMask QueryPerformanceCounter QueryPerformanceFrequency GetLastError GetModuleHandleW GetProcAddress InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetEvent ResetEvent CreateEventExW PulseEvent VirtualAlloc VirtualFree IsDebuggerPresent InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS FormatMessageA SetWaitableTimer CreateWaitableTimerExW WaitForMultipleObjects CreateWaitableTimerW InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx CreateEventW SetConsoleCtrlHandler RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentThreadId InitializeSListHead GetStartupInfoW GetProcessHeap GetStringTypeW SetStdHandle InterlockedPushEntrySList InterlockedFlushSList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType MultiByteToWideChar GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW ReadFile

Name

.text

Size

709KB

Virtual Size

709KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

198KB

Virtual Size

197KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

696KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

904B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

337B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

562B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

296KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

launcher.exe

ole32

winpixeventruntime

avrt

ntdll

winmm

kernel32

generic