BR-MOD LAUCHER[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
BR-MOD LAUCHER.exe
Size 318KB
Sample260930-wmhyvaee75
SHA256 1e11bc4668bc0e098d9ab424be201352400de3d528a3c5f3f56176a54497b4fa
MD5 d8af79d4552601737d088cd4e93e7af2
SHA1 97ce21a4fe8eb262c7a9200cc6ca4fac6de7287c
SHA512 ecf7ccf70b0fb549978852c4582b07c478bc7b1bee947b59091931c1f98ed4b32649fe4a39304fc6a330a55e7f0a0646434216cd0cc47d71c977025094590603
SSDEEP 3072:uB8efMv5bKInriJ9TgsBFi/3JoWPVFC0Knjl7yIc72CQGQxmBUzJR:uB8efMv5prWTgUFiPJTnDKNABUl
TLSH
T1A2642816A3DC11F9D0638AF88E554E01E3B3F8858764D6DB0390A1A6EF63EE05D3A7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BR-MOD LAUCHER.exe

File Explorer

BR-MOD LAUCHER.exe

.exe 318KB

BR-MOD LAUCHER.exe

IMPHASH afe8e8e0e4867bcb45736a5bd097726d
SHA256 1e11bc4668bc0e098d9ab424be201352400de3d528a3c5f3f56176a54497b4fa
MD5 d8af79d4552601737d088cd4e93e7af2
SHA1 97ce21a4fe8eb262c7a9200cc6ca4fac6de7287c
SHA512 ecf7ccf70b0fb549978852c4582b07c478bc7b1bee947b59091931c1f98ed4b32649fe4a39304fc6a330a55e7f0a0646434216cd0cc47d71c977025094590603
SSDEEP 3072:uB8efMv5bKInriJ9TgsBFi/3JoWPVFC0Knjl7yIc72CQGQxmBUzJR:uB8efMv5prWTgUFiPJTnDKNABUl
TLSH
T1A2642816A3DC11F9D0638AF88E554E01E3B3F8858764D6DB0390A1A6EF63EE05D3A7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

60912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdipCreatePen1 GdipDeletePen GdipDeleteFont GdiplusStartup GdiplusShutdown GdipCreateStringFormat GdipDeleteFontFamily GdipAddPathRectangleI GdipAddPathArcI GdipCreateFontFamilyFromName GdipDeleteBrush GdipAlloc GdipDeletePath GdipSetSmoothingMode GdipCreatePath GdipSetStringFormatLineAlign GdipCreateFont GdipCreateSolidFill GdipFillPath GdipSetPixelOffsetMode GdipClosePathFigure GdipFree GdipDrawPath GdipDrawString GdipCreateFromHDC GdipSetTextRenderingHint GdipCloneBrush GdipFillRectangleI GdipDeleteGraphics GdipDeleteStringFormat GdipSetStringFormatAlign

winhttp

WinHttpCrackUrl WinHttpConnect WinHttpSendRequest WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle

shell32

SHGetKnownFolderPath ShellExecuteExW ord680

ole32

CoTaskMemFree

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapAlloc HeapFree GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread CreateDirectoryW ReadFile WriteProcessMemory GetCurrentProcess WriteFile GetModuleFileNameW SetErrorMode CreateMutexW WaitForSingleObject CreateFileW GetProcessHeap OpenProcess SetProcessMitigationPolicy CreateToolhelp32Snapshot GetExitCodeThread GetLastError GetFileAttributesExW Process32NextW GetCurrentThread Process32FirstW CloseHandle Module32FirstW GetProcAddress SetFilePointerEx VirtualAllocEx MoveFileExW ExitProcess GetModuleHandleW CreateRemoteThread Module32NextW VirtualFreeEx IsWow64Process IsDebuggerPresent CheckRemoteDebuggerPresent ExitThread CreateThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapReAlloc HeapSize WriteConsoleW GetFileAttributesW QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW Sleep InitializeCriticalSectionEx GetSystemTimeAsFileTime WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter

user32

MessageBoxW CreateWindowExW GetSystemMetrics RegisterClassExW ShowWindow DispatchMessageW SetTimer SetLayeredWindowAttributes DestroyWindow LoadIconW LoadCursorW GetClientRect KillTimer PostQuitMessage UpdateWindow InvalidateRect BeginPaint EndPaint PostMessageW DefWindowProcW GetMessageW TranslateMessage

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteDC DeleteObject CreateSolidBrush BitBlt

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

Name

.text

Size

143KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

160KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

BR-MOD LAUCHER.exe

gdiplus

winhttp

shell32

ole32

kernel32

user32

gdi32

advapi32

generic