launcher[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
launcher.exe
Size 45.3MB
Sample261002-1lw7astelf
SHA256 2c0495e82d19e270864efd110f63b44499335379a8d917dc6ba2edeec47d1c9e
MD5 75f7a795ccd35c9146768b0e05d372a0
SHA1 c4b483f7e6c549e7ad8d563d17bd0a5e516a3d59
SHA512 8259e14162bea75d3e74cd9bcf71ff7a4120572bc93f3a733bece9218422809aa4899330922c0c82d6d921d66112aa57df9c99f9174c64d649d4dcb0b053e9ae
SSDEEP 786432:m5okR4/VeBWCI7ekWDbmTTV3LXe3DFZ3GClE0Ckd5L1wj2h8:3k8eBKSdDC16TFdGqCkdwj
TLSH
T11CA7239629E482DCCB918474E6491EFDF0C9785E8CBD982ABFC709012630D95CCFAD76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
launcher.exe

File Explorer

launcher.exe

.exe 45.3MB

launcher.exe

IMPHASH 48f46fa2548752963000b310ead750ba
SHA256 2c0495e82d19e270864efd110f63b44499335379a8d917dc6ba2edeec47d1c9e
MD5 75f7a795ccd35c9146768b0e05d372a0
SHA1 c4b483f7e6c549e7ad8d563d17bd0a5e516a3d59
SHA512 8259e14162bea75d3e74cd9bcf71ff7a4120572bc93f3a733bece9218422809aa4899330922c0c82d6d921d66112aa57df9c99f9174c64d649d4dcb0b053e9ae
SSDEEP 786432:m5okR4/VeBWCI7ekWDbmTTV3LXe3DFZ3GClE0Ckd5L1wj2h8:3k8eBKSdDC16TFdGqCkdwj
TLSH
T11CA7239629E482DCCB918474E6491EFDF0C9785E8CBD982ABFC709012630D95CCFAD76
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

82442897

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wininet

InternetReadFile

crypt32

CertOpenStore

advapi32

RegQueryInfoKeyW

user32

FindWindowExW

bcrypt

BCryptGenRandom

kernel32

FormatMessageA

gdi32

GetObjectW

shell32

ShellExecuteA

ole32

CoTaskMemFree

oleaut32

SysFreeString

msvcp140

?id@?$collate@_W@std@@2V0locale@2@A

ntdll

NtResumeProcess

netapi32

NetApiBufferFree

sfc

SRSetRestorePointW

gdiplus

GdipSaveImageToStream

vcruntime140

memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-stdio-l1-1-0

fflush

api-ms-win-crt-runtime-l1-1-0

__p___argv

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-filesystem-l1-1-0

_stat64i32

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-conio-l1-1-0

_getch

ws2_32

setsockopt

wintrust

WinVerifyTrust

tbs

Tbsi_GetDeviceInfo

setupapi

SetupDiGetDeviceInstanceIdW

cfgmgr32

CM_Set_DevNode_PropertyW

Name

.text

Size

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

909KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eac0

Size

Virtual Size

34.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.eac1

Size

1024B

Virtual Size

600B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eac2

Size

45.3MB

Virtual Size

45.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

launcher.exe

wininet

crypt32

advapi32

user32

bcrypt

kernel32

gdi32

shell32

ole32

oleaut32

msvcp140

ntdll

netapi32

sfc

gdiplus

vcruntime140

vcruntime140_1

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-conio-l1-1-0

ws2_32

wintrust

tbs

setupapi

cfgmgr32

generic