TLauncher-Installer-1[.]4[.]7[.]exe

General

Target
TLauncher-Installer-1.4.7.exe
Size 24.1MB
Sample261017-tmlcvswwbt
SHA256 9f0ffcd4852f9af353558f104dd8edf13e67971076341e87da304b8e6d8c5414
MD5 86fc2557f00baf9698715dc99a8cec41
SHA1 75f8f54eabd25749af37d21316f02d7d5868c398
SHA512 521e19cc02c996fc478fead4239cd3ab24b70a441df138ed955d349eb46e7a03ccc10a3d58d8dc726292f494d6bd6efd2a92f62d3f179cb2751fc725ea7d449e
SSDEEP 786432:lKxabBbJyM9irrKJBH5lFRqH0fYk/pUJ8a:lKcSMQPKJBZlCUfYSpUJ8
TLSH
T112473352EDBAF474D7934A780E99A6347B368D21A72D42E37248347B7D372C41BF9208
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
TLauncher-Installer-1.4.7.exe

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
TLauncher-Installer-1.4.7.exe

File Explorer

TLauncher-Installer-1.4.7.exe

.exe 24.1MB

TLauncher-Installer-1.4.7.exe

IMPHASH d619eda1a774da262071361b928bb2e4
SHA256 9f0ffcd4852f9af353558f104dd8edf13e67971076341e87da304b8e6d8c5414
MD5 86fc2557f00baf9698715dc99a8cec41
SHA1 75f8f54eabd25749af37d21316f02d7d5868c398
SHA512 521e19cc02c996fc478fead4239cd3ab24b70a441df138ed955d349eb46e7a03ccc10a3d58d8dc726292f494d6bd6efd2a92f62d3f179cb2751fc725ea7d449e
SSDEEP 786432:lKxabBbJyM9irrKJBH5lFRqH0fYk/pUJ8a:lKcSMQPKJBZlCUfYSpUJ8
TLSH
T112473352EDBAF474D7934A780E99A6347B368D21A72D42E37248347B7D372C41BF9208
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

16:8e:5b:91:0e:76:09:81:69:93:3e:49:4f:ee:ee:9e:e7:25:fb:ef:82:44:fe:2e:8b:d5:83:b9:a2:b9:fc:1c:97:be:8b:cf:a1:7b:48:8a:d2:a6:c9:29:30:25:89:66

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

Chains

Jun 16, 2024

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

CN=Trustwave Global Code Signing CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

PE Signature issue

Digest

85:6a:37:7b:ce:6b:94:d4:76:fe:9b:13:9f:87:11:d9:5c:af:8c:5a:a3:87:4d:08:16:05:92:0b:ea:b2:2b:73

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

Chains

Jun 16, 2024

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

CN=Trustwave Global Code Signing CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Subject

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

Serial Number

07:7f:22:38:be:42:10:bc:dd:a8:7c:d5:bd:db:90:61:80:9f:32

Issuer

CN=Trustwave Global Code Signing CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 23, 2022 - Feb 2, 2026

Subject

CN=Trustwave Global Code Signing CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Serial Number

06:ce:82:d9:b3:d4:98:74:56:05:d6:66:6b:6d:6d:99:7b:cb:73

Issuer

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Mar 3, 2026

Timespan

Feb 6, 2018 - Aug 21, 2042

Subject

CN=Viking Cloud TWG Timestamping Responder 2022,O=Viking Cloud\, Inc.,C=US

Serial Number

07:71:c2:62:80:b4:da:77:02:03:13:ab:bc:fa:a3:ff:ed:8b:2a

Issuer

CN=Viking Cloud TWG Timestamping CA\, Level 1,O=Viking Cloud\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 10, 2022 - Nov 6, 2033

Subject

CN=Viking Cloud TWG Timestamping CA\, Level 1,O=Viking Cloud\, Inc.,C=US

Serial Number

07:71:c1:bc:fc:08:5f:97:f1:8c:6a:6a:23:c8:d3:7f:08:7d:f9

Issuer

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Revoked

Revocation Date

Mar 3, 2026

Timespan

Aug 10, 2022 - Aug 10, 2037

Minor OS version

1

Major OS version

5

Entry point

11489

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA lstrcpyA lstrcatA lstrlenA GetSystemDirectoryA GetProcAddress GetModuleHandleA _lclose GetModuleFileNameA _lread _llseek _lopen _lwrite _lcreat CreateDirectoryA SetCurrentDirectoryA GetDiskFreeSpaceA GetFileAttributesA CompareStringA DeleteFileA GetTempPathA GetCurrentDirectoryA CloseHandle GetExitCodeProcess GetLastError LocalFree GetCurrentProcess MoveFileExA GetStringTypeW MultiByteToWideChar LCMapStringW HeapReAlloc RtlUnwind HeapSize Sleep RemoveDirectoryA FreeLibrary IsValidCodePage GetOEMCP GetModuleHandleW ExitProcess DecodePointer HeapFree HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer LoadLibraryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent HeapCreate FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP

user32

TranslateMessage DispatchMessageA PeekMessageA wsprintfA LoadCursorA SetCursor MessageBoxA MsgWaitForMultipleObjects

advapi32

GetTokenInformation OpenProcessToken

shell32

ShellExecuteExA

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

TLauncher-Installer-1.4.7.exe

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

shell32

generic