horizon-launcher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
horizon-launcher.exe
Size 57.1MB
Sample261104-tddawsdx9j
SHA256 c064e82aabef834f652017c0265863f014e18fe140b958a854576287285c23e9
MD5 005bff5929152258ccdc1636f8539eb3
SHA1 abb4a0ef9baa347e7881a10c366cc57c355a7647
SHA512 841e463a9990c0b3ea0570272be511c09ef6a39d0bffe912184c016931c0159de0f2bf9e5cd36c0152494ee28b056394f3886b637536981c3a437efc4b6aee91
SSDEEP 393216:NV6wT/oRiENVIY6cNQCpOWVKrRnZr6YDzGTVCPTYe1Aaq9yv:mg/sEY3qCpFYDzYNeo8v
TLSH
T193D72A12BB5A546AC166C4B083064A336B3434DF1B36BDFF50E552393FBAAB45B38319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
horizon-launcher.exe

File Explorer

horizon-launcher.exe

.exe 57.1MB

horizon-launcher.exe

IMPHASH 5cacbb34814681d29f40ff6078b8b174
SHA256 c064e82aabef834f652017c0265863f014e18fe140b958a854576287285c23e9
MD5 005bff5929152258ccdc1636f8539eb3
SHA1 abb4a0ef9baa347e7881a10c366cc57c355a7647
SHA512 841e463a9990c0b3ea0570272be511c09ef6a39d0bffe912184c016931c0159de0f2bf9e5cd36c0152494ee28b056394f3886b637536981c3a437efc4b6aee91
SSDEEP 393216:NV6wT/oRiENVIY6cNQCpOWVKrRnZr6YDzGTVCPTYe1Aaq9yv:mg/sEY3qCpFYDzYNeo8v
TLSH
T193D72A12BB5A546AC166C4B083064A336B3434DF1B36BDFF50E552393FBAAB45B38319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36520560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

horizon_launcher.pdb

kernel32

HeapSize LCMapStringW CompareStringW LoadLibraryExW GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage AttachConsole IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA WriteFile DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsGetValue RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead SetStdHandle GetStdHandle UnhandledExceptionFilter CloseHandle GetTempPathW WaitForMultipleObjects GetFileType FlsSetValue IsThreadAFiber FreeLibrary GetModuleHandleExW FindNextFileW FlsAlloc FlsFree GetFileAttributesW SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar ReadConsoleW GetModuleFileNameW SetEnvironmentVariableW GetEnvironmentVariableW GetProcessHeap DeleteFileW DeviceIoControl CreateSymbolicLinkW PowerSetRequest GetFinalPathNameByHandleW WaitForSingleObjectEx SwitchToThread ExitProcess FindClose FindFirstFileExW PowerCreateRequest CreateMutexA RemoveDirectoryW GetCommandLineW GetProcAddress SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx MapViewOfFile GetExitCodeProcess GetEnvironmentStringsW CloseThreadpoolTimer TerminateProcess GetCurrentThreadId WaitForSingleObject CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetCurrentProcess SetFileTime CancelIo GetSystemTimePreciseAsFileTime GetCurrentProcessId SetThreadpoolTimer UnlockFile TrySubmitThreadpoolCallback RtlCaptureContext RtlLookupFunctionEntry QueryPerformanceFrequency GlobalFree GlobalUnlock LockFileEx GlobalAlloc GlobalLock GetOverlappedResult ReadFile CreateEventW WriteFileEx SleepEx ReadFileEx CreateThread QueryPerformanceCounter GlobalSize HeapReAlloc CreateHardLinkW CopyFileExW CreateFileW SetFileInformationByHandle GetFullPathNameW SetLastError FreeEnvironmentStringsW CompareStringOrdinal LoadLibraryA RegisterWaitForSingleObject LocaleNameToLCID GetUserDefaultLocaleName GetSystemTimeAsFileTime PowerClearRequest ReleaseMutex SetThreadPriority GetConsoleMode SetConsoleMode SetConsoleTextAttribute GetConsoleScreenBufferInfo ProcessIdToSessionId GetSystemInfo VirtualProtect CreateFileMappingW DuplicateHandle FlushFileBuffers GetFileInformationByHandle GlobalMemoryStatusEx GetShortPathNameW SetFileAttributesW GetCurrentThread GetUserPreferredUILanguages CreateDirectoryW UnmapViewOfFile GetLastError GetTimeZoneInformationForYear GetBinaryTypeW UnregisterWaitEx FormatMessageW WideCharToMultiByte LoadLibraryExA lstrlenW Sleep GetCurrentPackageFullName GetModuleHandleW HeapAlloc GetSystemPowerStatus CreateThreadpoolTimer SetHandleInformation HeapFree GetFileInformationByHandleEx MoveFileExW GetModuleHandleA RtlVirtualUnwind GetCurrentDirectoryW

advapi32

CredFree CredWriteW RegDeleteKeyExW CredDeleteW RegOpenKeyExW RegCreateKeyTransactedW RegCreateKeyExW SystemFunction036 RegOpenKeyTransactedW RegCloseKey CredReadW RegQueryInfoKeyW RegSetValueExW RegQueryValueExW

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

combase

CoTaskMemFree CoCreateFreeThreadedMarshaler CoIncrementMTAUsage

user32

GetKeyboardLayoutNameW MapVirtualKeyW RedrawWindow ClientToScreen SendMessageW GetKeyboardState CloseClipboard EnumDisplaySettingsW RegisterClipboardFormatW GetClipboardFormatNameW GetClipboardData EnumClipboardFormats ToUnicode GetSystemMetricsForDpi CountClipboardFormats EmptyClipboard EnumDisplayMonitors OpenClipboard SetClipboardData SetWindowPos LoadImageW PostQuitMessage RegisterClassW SetWindowTextW GetForegroundWindow MessageBeep CreateWindowExW MonitorFromPoint KillTimer EnumThreadWindows GetClassNameW GetClientRect GetWindowPlacement SetTimer GetKeyState GetDoubleClickTime GetSystemMetrics GetPointerType GetMonitorInfoW SetCapture GetActiveWindow SetWindowLongPtrW TrackMouseEvent ReleaseCapture IsZoomed GetDpiForWindow EnableWindow IsWindowEnabled MonitorFromWindow GetFocus ScreenToClient SystemParametersInfoW GetCursorPos RegisterSuspendResumeNotification SetForegroundWindow SendInput SetFocus SetActiveWindow ShowWindowAsync SetWindowPlacement FlashWindowEx DefWindowProcW SetPropW RemovePropW GetWindowRect IsIconic IsWindowVisible ValidateRect PostMessageW PeekMessageW DestroyWindow TranslateMessage UnregisterPowerSettingNotification UnregisterSuspendResumeNotification DispatchMessageW GetMessageW SetCursor RegisterPowerSettingNotification GetProcessWindowStation GetWindowLongPtrW GetUserObjectInformationW

ole32

OleUninitialize RevokeDragDrop RegisterDragDrop CoInitializeEx CoUninitialize PropVariantClear ReleaseStgMedium OleInitialize CoCreateInstance

comctl32

TaskDialogIndirect

dwrite

DWriteCreateFactory

imm32

ImmGetCompositionStringW ImmSetCandidateWindow ImmSetCompositionWindow ImmNotifyIME ImmAssociateContextEx ImmReleaseContext ImmGetContext

icuuc

u_strlen

dcomp

DCompositionCreateDevice

shell32

DragQueryFileW SetCurrentProcessExplicitAppUserModelID SHCreateItemFromParsingName ShellExecuteW SHOpenFolderAndSelectItems SHGetDesktopFolder SHGetKnownFolderPath

gdi32

CreateSolidBrush

winmm

timeBeginPeriod timeEndPeriod

dxgi

CreateDXGIFactory2

d3d11

D3D11CreateDevice

dwmapi

DwmSetWindowAttribute DwmGetCompositionTimingInfo DwmFlush

ntdll

NtReadFile RtlNtStatusToDosError NtWriteFile RtlGetVersion NtCreateNamedPipeFile NtOpenFile

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

uiautomationcore

UiaGetReservedMixedAttributeValue UiaGetReservedNotSupportedValue UiaReturnRawElementProvider UiaLookupId UiaHostProviderFromHwnd UiaRaiseAutomationPropertyChangedEvent UiaRaiseAutomationEvent

oleaut32

SysAllocStringLen SetErrorInfo GetErrorInfo SysStringLen SafeArrayPutElement SysFreeString SafeArrayCreateVector VariantClear

ws2_32

freeaddrinfo WSAStartup send recv WSASocketW closesocket getsockopt bind connect listen getpeername ioctlsocket select WSASend WSAGetLastError getaddrinfo WSARecv getsockname accept WSADuplicateSocketW setsockopt

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

iphlpapi

GetAdaptersAddresses

bcrypt

BCryptGenRandom

userenv

GetUserProfileDirectoryW

Name

.text

Size

35.5MB

Virtual Size

35.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

19.7MB

Virtual Size

19.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

263KB

Virtual Size

266KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

122KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

horizon-launcher.exe

kernel32

advapi32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-l1-1-0

combase

user32

ole32

comctl32

dwrite

imm32

icuuc

dcomp

shell32

gdi32

winmm

dxgi

d3d11

dwmapi

ntdll

api-ms-win-shcore-scaling-l1-1-1

uiautomationcore

oleaut32

ws2_32

api-ms-win-core-winrt-error-l1-1-0

iphlpapi

bcrypt

userenv

generic