SR[.]launcher[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
SR.launcher.zip
Size 10.1MB
Sample261102-dcwsvazwew
SHA256 4e4887cfb27509330951cea9a4a43f633df43228603f82644f12a44e0667b691
MD5 aea15e4caacafb2be46153ee335561bc
SHA1 d55f8d936f612f0471f9c58898f019d1770cf408
SHA512 b169a60904ae6c1cb210a983c2f27770a0d4612789d27b839b33b9abe0b5d473896aa118507387a45d5327bc0af9dcbcecdcd1df50437ce10f35663cbfc5f78e
SSDEEP 196608:/LhfTBkA8gi+lGpjvKEvYfNUbn8l/VEnqzY+LOdNNf5+0r0DMP:/tfTB/05vJYKb+AqzYUOdXoiP
TLSH
T172B6333B584B1EAF874D7B3051E18C7CBC29B9EDD2D2B16612FEE978D1060CD2345A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SR launcher.exe

File Explorer

SR.launcher.zip

.zip 10.1MB
SR launcher.exe

.exe 27.0MB
WebView2Loader.dll

.dll 156KB

SR.launcher.zip

SHA256 4e4887cfb27509330951cea9a4a43f633df43228603f82644f12a44e0667b691
MD5 aea15e4caacafb2be46153ee335561bc
SHA1 d55f8d936f612f0471f9c58898f019d1770cf408
SHA512 b169a60904ae6c1cb210a983c2f27770a0d4612789d27b839b33b9abe0b5d473896aa118507387a45d5327bc0af9dcbcecdcd1df50437ce10f35663cbfc5f78e
SSDEEP 196608:/LhfTBkA8gi+lGpjvKEvYfNUbn8l/VEnqzY+LOdNNf5+0r0DMP:/tfTB/05vJYKb+AqzYUOdXoiP
TLSH
T172B6333B584B1EAF874D7B3051E18C7CBC29B9EDD2D2B16612FEE978D1060CD2345A1A
MD5 SHA1 SHA512 SSDEEP TLSH

SR launcher.exe

IMPHASH c95c90b720252e29525d6dafb889cd05
SHA256 d2f04dccf5993eea968011918c64888c1d83241b4eb82c1432f72266ef713328
MD5 fd030965c3ec8cc9187d1facbbbbcc5c
SHA1 2ce9e6c321bb6cea2524f66be2fc6b7fa6ea915c
SHA512 09210cb07b746bab86e28cbfb38c0d05c5fdb45566257416eab013379e95406205fff03d09781cb36c96f1110c890d37c9640a37632fa4472618c90aeeb04d6f
SSDEEP 196608:Y0LaX3c54X7fXzPl6sbxXbEkNi+Po0rN/MYnK+0rl8EhqsjH:Y01sNrM6uYK+Ql/j
TLSH
T17A578E43F5650EADC9AFDA39865F6336F7703C854132EBAB0AB097311E12692DB1C718
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4119

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

webview2loader

CreateCoreWebView2EnvironmentWithOptions GetAvailableCoreWebView2BrowserVersionString

bcryptprimitives

ProcessPrng

kernel32

CloseHandle GetModuleHandleA GetProcAddress Sleep FreeLibrary GetCurrentThreadId GetModuleHandleW GetUserDefaultUILanguage HeapFree LCIDToLocaleName LoadLibraryA LoadLibraryW TlsGetValue TlsSetValue lstrlenW LoadLibraryExA FormatMessageW GetLastError GetProcessHeap HeapAlloc CancelIoEx ConnectNamedPipe CreateFileW CreateIoCompletionPort DisconnectNamedPipe DuplicateHandle GetComputerNameExW GetConsoleMode GetConsoleScreenBufferInfo GetCurrentProcess GetFileInformationByHandle GetNamedPipeInfo GetOverlappedResult GetQueuedCompletionStatusEx LocalFree PostQueuedCompletionStatus ReadFile RegisterWaitForSingleObject SetConsoleMode SetConsoleTextAttribute SetFileCompletionNotificationModes SetHandleInformation SetNamedPipeHandleState UnregisterWaitEx WriteFile AddVectoredExceptionHandler CancelIo CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventW CreateFileMappingA CreateHardLinkW CreatePipe CreateProcessW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DeleteProcThreadAttributeList DeviceIoControl ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FreeEnvironmentStringsW GetCommandLineW GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcessId GetCurrentThread GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetModuleFileNameW GetProcessId GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetWindowsDirectoryW HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeProcThreadAttributeList LockFileEx MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFileEx RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetCurrentDirectoryW SetEnvironmentVariableW SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree UnlockFile UnmapViewOfFile UpdateProcThreadAttribute WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFileEx DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

advapi32

RegGetValueW RegCloseKey RegCreateKeyExW RegCreateKeyTransactedW RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegOpenKeyTransactedW RegQueryInfoKeyW RegQueryValueExW CryptAcquireContextW CryptDestroyKey CryptImportKey CryptReleaseContext SystemFunction036 RegGetValueA

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

comctl32

DefSubclassProc RemoveWindowSubclass SetWindowSubclass TaskDialogIndirect

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

gdi32

BitBlt CombineRgn CreateCompatibleDC CreateDIBSection CreateRectRgn CreateSolidBrush DeleteDC DeleteObject GetDeviceCaps SelectObject SetBkMode SetTextColor

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow

ole32

CoCreateInstance CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize OleInitialize PropVariantClear PropVariantCopy RegisterDragDrop RevokeDragDrop CoCreateFreeThreadedMarshaler CoCreateGuid

oleaut32

VariantClear VariantCopy GetErrorInfo SetErrorInfo SysAllocStringLen SysFreeString SysStringLen

propsys

PropVariantCompareEx PropVariantToBSTR PropVariantToBoolean PropVariantToDouble PropVariantToInt16 PropVariantToInt32 PropVariantToInt64 PropVariantToUInt16 PropVariantToUInt32 PropVariantToUInt64 PropVariantToVariant VariantToBoolean VariantToDouble VariantToInt16 VariantToInt32 VariantToInt64 VariantToPropVariant VariantToUInt16 VariantToUInt32 VariantToUInt64

shell32

DragFinish DragQueryFileW SHAppBarMessage SHGetKnownFolderPath ShellExecuteW

shlwapi

SHCreateMemStream

user32

AdjustWindowRect AdjustWindowRectEx AppendMenuW ChangeDisplaySettingsExW CheckMenuItem ClientToScreen ClipCursor CloseTouchInputHandle CreateAcceleratorTableW CreateIcon CreateMenu CreatePopupMenu CreateWindowExW DefWindowProcW DestroyAcceleratorTable DestroyIcon DestroyMenu DestroyWindow DispatchMessageA DispatchMessageW DrawIconEx DrawMenuBar DrawTextW EnableMenuItem EnableWindow EnumChildWindows EnumDisplayMonitors FillRect FindWindowExW FlashWindowEx GetActiveWindow GetAsyncKeyState GetClientRect GetClipCursor GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetKeyboardState GetMenu GetMenuBarInfo GetMenuItemInfoW GetMessageA GetMessageW GetMonitorInfoW GetParent GetRawInputData GetRawInputDeviceInfoW GetSystemMenu GetSystemMetrics GetTouchInputInfo GetUpdateRect GetWindow GetWindowDC GetWindowLongPtrW GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextLengthW GetWindowTextW InsertMenuW InvalidateRect InvalidateRgn IsIconic IsProcessDPIAware IsWindow IsWindowEnabled IsWindowVisible LoadCursorW LoadImageW MapVirtualKeyExW MapVirtualKeyW MapWindowPoints MonitorFromPoint MonitorFromRect MonitorFromWindow MsgWaitForMultipleObjectsEx OffsetRect PeekMessageW PostMessageW PostQuitMessage PostThreadMessageW RedrawWindow RegisterClassExW RegisterRawInputDevices RegisterTouchWindow RegisterWindowMessageA ReleaseCapture ReleaseDC RemoveMenu ScreenToClient SendInput SendMessageW SetCapture SetCursor SetCursorPos SetFocus SetForegroundWindow SetMenu SetMenuItemInfoW SetParent SetPropW SetWindowDisplayAffinity SetWindowLongPtrW SetWindowLongW SetWindowPlacement SetWindowPos SetWindowRgn SetWindowTextW ShowCursor ShowWindow SystemParametersInfoA SystemParametersInfoW ToUnicodeEx TrackMouseEvent TrackPopupMenu TranslateAcceleratorW TranslateMessage UpdateWindow ValidateRect

ktmw32

CommitTransaction CreateTransaction

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

bcrypt

BCryptGenRandom

crypt32

CertAddCertificateContextToStore CertAddEncodedCTLToStore CertAddEncodedCertificateToStore CertCloseStore CertCreateCTLEntryFromCertificateContextProperties CertCreateCertificateContext CertDeleteCertificateFromStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCTLContext CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertGetCertificateContextProperty CertGetEnhancedKeyUsage CertOpenStore CertSetCertificateContextProperty CertVerifyCertificateChainPolicy CertVerifyTimeValidity CryptAcquireCertificatePrivateKey CryptBinaryToStringA CryptDecodeObjectEx CryptEncodeObjectEx CryptHashCertificate CryptMsgEncodeAndSignCTL CryptStringToBinaryA PFXExportCertStore PFXImportCertStore

ncrypt

NCryptFreeObject

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile RtlNtStatusToDosError RtlGetVersion NtOpenFile NtReadFile NtWriteFile NtCreateNamedPipeFile

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

ws2_32

WSADuplicateSocketW WSAGetLastError WSAIoctl WSAPoll WSARecv WSARecvFrom WSASend WSASendMsg WSASendTo WSASocketW accept bind closesocket connect getpeername getsockname getsockopt ioctlsocket listen recv recvfrom send sendto setsockopt shutdown socket GetHostNameW WSACleanup WSAStartup freeaddrinfo getaddrinfo select

userenv

GetUserProfileDirectoryW

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr floor fmod fmodf pow round roundf trunc

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _fpreset _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf

api-ms-win-crt-string-l1-1-0

memset strlen strncmp wcslen

Name

.text

Size

13.1MB

Virtual Size

13.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

384KB

Virtual Size

384KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

76KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

WebView2Loader.dll

IMPHASH 90db803f7a0acc2517ef287c1dc1bb76
SHA256 8427b1fc58ec707813e5c0a51eb5d69397bb333250a7b891be4d3b123f1e0f1c
MD5 b7f10b8066ee96c628e09c439b8d0b9b
SHA1 3a2fe02d9d43100056b7dd1ccd2dfb3f30ad0f55
SHA512 4ce26a59faadfa0a20e098caf297f3403ac1542706f72879ed7248dee4026a5c7ffc3aa95912d8e3510ac7593082429ce0e83978a5843cfce52fb475cc975333
SSDEEP 3072:1mJgy7/ph9euiDNQ6A93jJBC9JGv6T/MEtJ6mj4UrqhQ:w/NVZ6A93j//EtJnrX
TLSH
T173F35C5BB2E900BBE17BC278C5A34A15E772B8111760AAEF036447791F137D0AE3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

20:0a:0b:1d:57:67:2c:96:ed:25:eb:8b:ac:94:71:7c:b9:ef:20:b6:a5:c9:21:f6:fb:30:b0:72:47:ef:a7:71

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Dec 1, 2025

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

18608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

WebView2Loader.dll.pdb

kernel32

AcquireSRWLockExclusive CloseHandle CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileType GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SR.launcher.zip

SR launcher.exe

webview2loader

bcryptprimitives

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

comctl32

dwmapi

gdi32

imm32

ole32

oleaut32

propsys

shell32

shlwapi

user32

ktmw32

api-ms-win-core-winrt-error-l1-1-0

bcrypt

crypt32

ncrypt

ntdll

secur32

ws2_32

userenv

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

generic

WebView2Loader.dll

kernel32

generic