horizon-launcher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
horizon-launcher.exe
Size 37.3MB
Sample261030-ngnm5sysfv
SHA256 ef901348e259c39c83b8d246ecc92ccdeb4134aa07390777550799f2cfe63499
MD5 2c8bf88e757e776f7c578d3c48f2c840
SHA1 062ff4334d4115cb21a3cf85f8e37d414a8e211f
SHA512 0fd3af84fb4ef9ac2d2273e17164f5d1ebe8cc82a6621a4b277b625539258f6b1182c5b9a095b7cd968495fcc95698ceb9c84455b5bbf9a1be7d910fbc04e3fa
SSDEEP 393216:wDLy7S0NOs84VCbeQ7pZhe9iMuqlxWnDS4mDhMgDWpjn:b8MYZhrAIQdW9
TLSH
T178871811BB5B686CD05AC8B0834A8A335A3134DB1B35B9FF44D492353FBEAE45B38719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
horizon-launcher.exe

File Explorer

horizon-launcher.exe

.exe 37.3MB

horizon-launcher.exe

IMPHASH 7d219cbc056a52dc6f2cdfca18a94908
SHA256 ef901348e259c39c83b8d246ecc92ccdeb4134aa07390777550799f2cfe63499
MD5 2c8bf88e757e776f7c578d3c48f2c840
SHA1 062ff4334d4115cb21a3cf85f8e37d414a8e211f
SHA512 0fd3af84fb4ef9ac2d2273e17164f5d1ebe8cc82a6621a4b277b625539258f6b1182c5b9a095b7cd968495fcc95698ceb9c84455b5bbf9a1be7d910fbc04e3fa
SSDEEP 393216:wDLy7S0NOs84VCbeQ7pZhe9iMuqlxWnDS4mDhMgDWpjn:b8MYZhrAIQdW9
TLSH
T178871811BB5B686CD05AC8B0834A8A335A3134DB1B35B9FF44D492353FBEAE45B38719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28328400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

horizon_launcher.pdb

kernel32

LoadLibraryExW GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage UnhandledExceptionFilter LCMapStringW GetCommandLineA DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsGetValue RaiseException RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead CompareStringW HeapSize SetStdHandle AttachConsole GetStdHandle IsProcessorFeaturePresent CloseHandle FlushFileBuffers ReadFileEx CreateEventW CreateThread HeapReAlloc CreateHardLinkW CopyFileExW SetFileInformationByHandle MoveFileExW GetFullPathNameW DuplicateHandle GlobalLock RtlVirtualUnwind GetCurrentProcess MapViewOfFile CreateFileMappingW CreateProcessA GlobalAlloc GetExitCodeProcess WaitForSingleObject UnmapViewOfFile GetUserPreferredUILanguages GetSystemInfo SleepEx CompareStringOrdinal FreeLibrary WriteFileEx LoadLibraryA LockFileEx GetUserDefaultLocaleName QueryPerformanceCounter FreeEnvironmentStringsW GetEnvironmentStringsW LoadLibraryExA MultiByteToWideChar GetLastError FormatMessageW AddVectoredExceptionHandler GetCurrentDirectoryW lstrlenW GetCurrentThread VirtualQuery SetThreadStackGuarantee SwitchToFiber IsThreadAFiber ConvertThreadToFiber CreateFiber DeleteFiber ConvertFiberToThread GetCommandLineW DeleteFileW RemoveDirectoryW FindFirstFileExW GetSystemTimeAsFileTime ExitProcess GetTempPathW WaitForSingleObjectEx CreateMutexA SetLastError LocalFree ReleaseMutex GetFinalPathNameByHandleW CreateSymbolicLinkW SwitchToThread CreateDirectoryW DeviceIoControl GetEnvironmentVariableW GetFileAttributesW IsDebuggerPresent SetEnvironmentVariableW SetFileAttributesW GetCurrentThreadId QueryPerformanceFrequency GetCurrentProcessId ReadConsoleW RtlCaptureContext WriteConsoleW GetModuleHandleW GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer GetSystemTimePreciseAsFileTime Sleep GetSystemDirectoryW FlsFree GetProcAddress CreateFileW SetFilePointerEx ReadFile WriteFile FindNextFileW FindClose GetModuleFileNameW GetModuleHandleA FlsAlloc FlsSetValue SetHandleInformation GetFileType WaitForMultipleObjects RtlLookupFunctionEntry CancelIo VirtualProtect GetTimeZoneInformationForYear GlobalSize GetOverlappedResult SetFileTime GetModuleHandleExW GetFileInformationByHandle GetFileInformationByHandleEx GetWindowsDirectoryW GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleMode GetConsoleMode CreateProcessW HeapAlloc TerminateProcess GetStartupInfoW GlobalUnlock HeapFree GetProcessHeap WideCharToMultiByte

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyExW CredDeleteW CredWriteW CredFree CredReadW RegOpenKeyTransactedW RegCreateKeyExW RegCreateKeyTransactedW SystemFunction036

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

ole32

RevokeDragDrop ReleaseStgMedium OleUninitialize CoInitializeEx OleInitialize PropVariantClear RegisterDragDrop CoTaskMemFree CoCreateFreeThreadedMarshaler CoCreateInstance CoIncrementMTAUsage CoUninitialize

icuuc

u_strlen

dwrite

DWriteCreateFactory

user32

GetDoubleClickTime GetWindowPlacement GetClientRect EnumDisplayMonitors ShowWindowAsync SystemParametersInfoW SetWindowPlacement MonitorFromPoint ValidateRect MonitorFromWindow GetKeyState TranslateMessage SetCapture TrackMouseEvent ReleaseCapture RegisterClassW GetMonitorInfoW ToUnicode MapVirtualKeyW GetKeyboardLayoutNameW RegisterClipboardFormatW GetClipboardFormatNameW EnumClipboardFormats IsZoomed GetWindowRect GetClipboardData CountClipboardFormats CloseClipboard EmptyClipboard OpenClipboard MessageBoxW SetClipboardData ShowWindow SetForegroundWindow SendInput SetFocus SetActiveWindow ScreenToClient GetSystemMetricsForDpi IsIconic GetDpiForWindow RedrawWindow DefWindowProcW SetWindowTextW IsWindowVisible GetCursorPos PostMessageW SetCursor DestroyWindow DispatchMessageW GetMessageW GetActiveWindow IsWindowEnabled SendMessageW PostQuitMessage LoadImageW GetSystemMetrics IsClipboardFormatAvailable KillTimer SetTimer SetWindowLongPtrW CreateWindowExW GetWindowLongPtrW SetWindowPos

gdi32

CreateSolidBrush

shell32

SHCreateItemFromParsingName SHAppBarMessage DragQueryFileW ShellExecuteW SHOpenFolderAndSelectItems SHGetKnownFolderPath SHGetDesktopFolder CommandLineToArgvW

dxgi

CreateDXGIFactory2

imm32

ImmGetVirtualKey ImmGetCompositionStringW ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

dcomp

DCompositionCreateDevice

bcryptprimitives

ProcessPrng

d3d11

D3D11CreateDevice

ntdll

NtReadFile RtlNtStatusToDosError NtCreateNamedPipeFile NtWriteFile NtOpenFile RtlGetVersion

dwmapi

DwmSetWindowAttribute DwmGetCompositionTimingInfo DwmFlush

comctl32

TaskDialogIndirect

oleaut32

SysAllocStringLen SysStringLen SysFreeString SetErrorInfo GetErrorInfo

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

ws2_32

getaddrinfo select closesocket connect ioctlsocket WSAGetLastError WSAStartup recv send accept getpeername getsockname WSARecv listen setsockopt WSADuplicateSocketW WSASocketW bind getsockopt WSASend freeaddrinfo

bcrypt

BCryptGenRandom

Name

.text

Size

27.8MB

Virtual Size

27.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8.2MB

Virtual Size

8.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

262KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

952KB

Virtual Size

951KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

horizon-launcher.exe

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-l1-1-0

ole32

icuuc

dwrite

user32

gdi32

shell32

dxgi

imm32

api-ms-win-shcore-scaling-l1-1-1

dcomp

bcryptprimitives

d3d11

ntdll

dwmapi

comctl32

oleaut32

api-ms-win-core-winrt-error-l1-1-0

ws2_32

bcrypt

generic