weblauncher[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
weblauncher.exe
Size 13.3MB
Sample260930-srpemsbd37
SHA256 5d756c3d6ef2776b574a69c5096b065531be128b78f579017e08ca7c60e7d181
MD5 7d99b702bcd90ba66a84ad53f636550c
SHA1 a61fbd6769615902b83ea2ecb94b0296de9681b4
SHA512 7cf5910ccdeeea03ddaec1e3916f5fd78436a84af18dc5f7244801c9047e61ac34fd291338594a654b9e67a2c8035435e43af606176390d51814c33d708c4253
SSDEEP 98304:UiqMy8ptSnCzJuT40LcMj4Kkz8qqoTqupR+Ui8t+PT+I5GYHasdKl6ED2+BaVjbC:UNMDJcLcMsX+tdKqefFRL
TLSH
T108E6F6217B5E99ACD19BC47483874A72497130CB0B35B9FF449496382FAABF42F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
weblauncher.exe

File Explorer

weblauncher.exe

.exe 13.3MB

weblauncher.exe

IMPHASH 5c16110f753876824bfcb6c06eb7923e
SHA256 5d756c3d6ef2776b574a69c5096b065531be128b78f579017e08ca7c60e7d181
MD5 7d99b702bcd90ba66a84ad53f636550c
SHA1 a61fbd6769615902b83ea2ecb94b0296de9681b4
SHA512 7cf5910ccdeeea03ddaec1e3916f5fd78436a84af18dc5f7244801c9047e61ac34fd291338594a654b9e67a2c8035435e43af606176390d51814c33d708c4253
SSDEEP 98304:UiqMy8ptSnCzJuT40LcMj4Kkz8qqoTqupR+Ui8t+PT+I5GYHasdKl6ED2+BaVjbC:UNMDJcLcMsX+tdKqefFRL
TLSH
T108E6F6217B5E99ACD19BC47483874A72497130CB0B35B9FF449496382FAABF42F38359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9340892

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

weblauncher.pdb

user32

MessageBoxW DestroyAcceleratorTable DrawTextW RedrawWindow PostThreadMessageW PostMessageW DispatchMessageW TranslateMessage GetMessageW SetWindowPlacement MapVirtualKeyW GetWindowDC OffsetRect GetMenuBarInfo GetWindowPlacement SetWindowPos DrawMenuBar InvalidateRgn SendMessageW CreateWindowExW RegisterClassExW LoadCursorW FindWindowW DestroyWindow SetCursor DefWindowProcW TranslateAcceleratorW GetWindowLongPtrW CreateAcceleratorTableW FlashWindowEx PostQuitMessage SetMenu GetMenuItemInfoW GetMessageA TrackPopupMenu KillTimer ChangeWindowMessageFilterEx RegisterClassW DispatchMessageA EnumChildWindows IsIconic CreateIcon GetAsyncKeyState ScreenToClient GetKeyboardState GetWindowLongW GetClientRect ClientToScreen MonitorFromRect InsertMenuW FillRect AppendMenuW ChangeDisplaySettingsExW TrackMouseEvent GetTouchInputInfo CloseTouchInputHandle GetSystemMetrics GetCursorPos MonitorFromWindow GetMonitorInfoW ValidateRect GetMenu IsWindowVisible MapVirtualKeyExW GetKeyboardLayout ToUnicodeEx GetUpdateRect GetKeyState GetRawInputData EnumDisplayMonitors MonitorFromPoint SetCursorPos SetWindowTextW GetWindowTextW GetWindowTextLengthW SendInput SetForegroundWindow DestroyIcon SetWindowDisplayAffinity SystemParametersInfoA SetPropW SetWindowLongW EnableMenuItem GetSystemMenu ClipCursor GetClipCursor ShowCursor InvalidateRect RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx UpdateWindow GetActiveWindow RegisterWindowMessageA SetParent MapWindowPoints GetWindow SetFocus ShowWindow ReleaseDC IsProcessDPIAware GetDC SystemParametersInfoW GetWindowRect GetParent FindWindowExW SetWindowRgn AdjustWindowRectEx EnableWindow IsWindowEnabled IsWindow RegisterTouchWindow SetMenuItemInfoW CreateMenu CreatePopupMenu PeekMessageW AdjustWindowRect RemoveMenu CheckMenuItem DestroyMenu SetTimer DrawIconEx GetForegroundWindow SetWindowLongPtrW

bcryptprimitives

ProcessPrng

advapi32

RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteTreeW RegCreateKeyExW SystemFunction036 EventRegister EventSetInformation EventWriteTransfer EventUnregister RegCloseKey RegGetValueW

ntdll

NtOpenFile RtlNtStatusToDosError NtCreateNamedPipeFile NtReadFile RtlGetVersion NtWriteFile

kernel32

LoadLibraryExW FreeLibrary lstrlenW LoadLibraryA HeapFree LoadLibraryW GetProcessHeap GetModuleFileNameW ReleaseSRWLockExclusive OutputDebugStringW AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer CloseHandle GetLastError OutputDebugStringA GetProcAddress Sleep GetModuleHandleA ReleaseMutex GetModuleHandleW CreateEventW OpenMutexW LoadLibraryExA OpenEventW HeapAlloc GetCurrentThreadId GetUserDefaultUILanguage LCIDToLocaleName FormatMessageW GetConsoleMode FreeConsole AllocConsole SetStdHandle SetConsoleTitleW GetFileAttributesW GetFileInformationByHandle DeleteCriticalSection InitializeCriticalSectionEx RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead CreateFileW FindNextFileW RtlLookupFunctionEntry RtlCaptureContext GetProcessId GetExitCodeProcess GetSystemInfo QueryPerformanceCounter GetSystemTimePreciseAsFileTime WriteFileEx CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal FreeEnvironmentStringsW CreateThread SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetStdHandle WriteConsoleW MultiByteToWideChar CancelIo QueryPerformanceFrequency ReadFile SleepEx ReadFileEx WaitForMultipleObjects ExitProcess GetTempPathW GetFullPathNameW SetEnvironmentVariableW FindClose FindFirstFileExW GetFinalPathNameByHandleW DeleteFileW GetOverlappedResult SwitchToThread GetFileInformationByHandleEx DeviceIoControl CreateDirectoryW GetCommandLineW GetEnvironmentStringsW GetCurrentDirectoryW SetLastError GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetHandleInformation WaitForSingleObject DuplicateHandle SetFileInformationByHandle CreateMutexA GetCurrentProcessId WaitForSingleObjectEx WideCharToMultiByte GetCurrentProcess HeapReAlloc GetEnvironmentVariableW RtlVirtualUnwind CreateMutexW

shell32

Shell_NotifyIconGetRect ILCreateFromPathW DragFinish DragQueryFileW ShellExecuteW SHGetKnownFolderPath SHCreateItemFromParsingName SHAppBarMessage Shell_NotifyIconW ShellExecuteExW SHOpenFolderAndSelectItems ILFree

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

comctl32

RemoveWindowSubclass TaskDialogIndirect DefSubclassProc SetWindowSubclass

ole32

CoUninitialize RegisterDragDrop OleInitialize CoTaskMemFree CoInitialize CoIncrementMTAUsage CoTaskMemAlloc RevokeDragDrop CoInitializeEx CoCreateFreeThreadedMarshaler CoCreateInstance

gdi32

SelectObject CreateSolidBrush DeleteObject CreateRectRgn CreateCompatibleDC SetBkMode CreateDIBSection DeleteDC BitBlt GetDeviceCaps CombineRgn SetTextColor

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

shlwapi

SHCreateMemStream

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

oleaut32

SysStringLen SetErrorInfo SysFreeString GetErrorInfo

ws2_32

select connect WSASend WSARecv listen bind getsockname getpeername WSAStartup recv accept ioctlsocket setsockopt getsockopt freeaddrinfo getaddrinfo WSACleanup WSAGetLastError WSASocketW WSADuplicateSocketW closesocket send

bcrypt

BCryptGenRandom

api-ms-win-crt-string-l1-1-0

wcslen _wcsicmp wcscmp strlen strcpy_s

api-ms-win-crt-math-l1-1-0

trunc round floor atan2 __setusermatherr cos roundf pow sin

api-ms-win-crt-stdio-l1-1-0

freopen __p__commode _set_fmode __acrt_iob_func

api-ms-win-crt-heap-l1-1-0

_callnewh free calloc _set_new_mode malloc

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

_cexit _register_thread_local_exe_atexit_callback __p___argv exit _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _initialize_onexit_table abort terminate _crt_atexit __p___argc _exit _c_exit _register_onexit_function

api-ms-win-crt-locale-l1-1-0

_configthreadlocale