qwley-shade-launcher (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
qwley-shade-launcher (1).exe
Size 11.9MB
Sample261107-nlek2axybw
SHA256 e7fa1cf72e5ae1ef7f7ed18e099d28ac2dbce8ed2cafa5c57206d1978a608115
MD5 2440c322287130a76ce6ae676af6f602
SHA1 a8ea31360bb32160cc5b429a962d474287c04f5d
SHA512 b5c025beb5d4bca70ab9b08f6cf9d923ee4a623c950ee593b65bce0e6eadd2076304c251f5b23ad4b162cfaad6fd64140f1db0ff863735c2034296fd52867728
SSDEEP 98304:i9YGg8TKdUaAG7/xc5jkvo7FWCzuVytE5/0WMwyWtKlsSfSU+c+98xoRAUQQcRYh:i9rzykTs11SfSUd+98xoRAfQcBjJi
TLSH
T1B9C619157A6F99ACD18BC87083474AB30E2130DB1A36B9BF44C4523D3F79BF46B29259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
qwley-shade-launcher (1).exe

File Explorer

qwley-shade-launcher (1).exe

.exe 11.9MB

qwley-shade-launcher (1).exe

IMPHASH 8789ed771b82f9eb14af9230644acbfe
SHA256 e7fa1cf72e5ae1ef7f7ed18e099d28ac2dbce8ed2cafa5c57206d1978a608115
MD5 2440c322287130a76ce6ae676af6f602
SHA1 a8ea31360bb32160cc5b429a962d474287c04f5d
SHA512 b5c025beb5d4bca70ab9b08f6cf9d923ee4a623c950ee593b65bce0e6eadd2076304c251f5b23ad4b162cfaad6fd64140f1db0ff863735c2034296fd52867728
SSDEEP 98304:i9YGg8TKdUaAG7/xc5jkvo7FWCzuVytE5/0WMwyWtKlsSfSU+c+98xoRAUQQcRYh:i9rzykTs11SfSUd+98xoRAfQcBjJi
TLSH
T1B9C619157A6F99ACD18BC87083474AB30E2130DB1A36B9BF44C4523D3F79BF46B29259
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7955104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

qwley_shade_launcher.pdb

bcryptprimitives

ProcessPrng

ntdll

RtlNtStatusToDosError RtlGetVersion NtCreateNamedPipeFile NtWriteFile NtReadFile NtOpenFile

kernel32

Sleep GetModuleHandleA FindClose SetThreadStackGuarantee GetCurrentThread GetProcessHeap GetProcAddress HeapFree SetWaitableTimer HeapReAlloc FreeLibrary WaitForSingleObject LockResource GetExitCodeProcess GetCurrentProcess lstrlenW SwitchToThread GetCurrentThreadId DuplicateHandle GetModuleHandleW LoadResource SizeofResource FindResourceW LoadLibraryA OutputDebugStringW LoadLibraryExW GetLastError CloseHandle ReleaseSRWLockExclusive OutputDebugStringA FindNextFileW AcquireSRWLockExclusive WakeAllConditionVariable LoadLibraryW RtlLookupFunctionEntry WaitForSingleObjectEx WideCharToMultiByte ReleaseMutex FormatMessageW GetFileInformationByHandle MultiByteToWideChar FlsAlloc GetModuleHandleExW IsThreadAFiber FlsSetValue FlsFree HeapAlloc SetLastError SleepEx SetHandleInformation ExitProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW WaitForMultipleObjects LoadLibraryExA MoveFileExW SleepConditionVariableSRW GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetCurrentProcessId OpenProcess QueryFullProcessImageNameW TerminateProcess GetProcessId CopyFileExW GetFinalPathNameByHandleW DeleteFileW GetTempPathW GetFileAttributesW GetFileInformationByHandleEx SetFileInformationByHandle GetStdHandle LCIDToLocaleName SetFileTime FindFirstFileExW GetSystemInfo GetFullPathNameW WriteConsoleW GetConsoleOutputCP GetUserDefaultUILanguage GetConsoleMode FlushFileBuffers Process32NextW CreateProcessW SetEnvironmentVariableW CreateThread CreateWaitableTimerExW RtlCaptureContext RtlVirtualUnwind GetCurrentDirectoryW CreateMutexA GetEnvironmentVariableW Process32FirstW WriteFileEx QueryPerformanceFrequency CreateFileW CreateDirectoryW CreateEventW CancelIo GetOverlappedResult ReadFile GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineW CreateToolhelp32Snapshot QueryPerformanceCounter AddVectoredExceptionHandler InitializeSListHead ReadFileEx SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

shell32

ShellExecuteW SHAppBarMessage SHGetKnownFolderPath DragQueryFileW DragFinish

ole32

RegisterDragDrop OleInitialize CoCreateInstance CoTaskMemFree CoTaskMemAlloc CoCreateFreeThreadedMarshaler CoUninitialize RevokeDragDrop CoInitializeEx

user32

FindWindowExW SetParent SendMessageTimeoutW GetWindow SetPropW GetMenu ClipCursor GetClipCursor ShowCursor SetWindowTextW SetWindowLongW GetWindowThreadProcessId GetSystemMenu WaitForInputIdle EnumWindows GetWindowTextW AdjustWindowRect ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW MsgWaitForMultipleObjectsEx GetMessageW GetWindowPlacement SetWindowRgn ChangeDisplaySettingsExW PostThreadMessageW DispatchMessageW TranslateMessage PeekMessageW SetCursor LoadCursorW GetParent CloseTouchInputHandle GetTouchInputInfo DestroyWindow TrackMouseEvent SetCapture SystemParametersInfoW ReleaseCapture FillRect GetKeyState GetAsyncKeyState GetMonitorInfoW MonitorFromRect GetWindowLongW ScreenToClient GetKeyboardState DispatchMessageA EnumChildWindows SetWindowPlacement GetMenuItemInfoW SetMenu DrawMenuBar GetRawInputData ValidateRect SetFocus IsProcessDPIAware GetUpdateRect TranslateAcceleratorW DestroyMenu DestroyIcon DestroyAcceleratorTable CreateAcceleratorTableW SetMenuItemInfoW VkKeyScanW EnableMenuItem GetWindowTextLengthW GetDC ReleaseDC DrawIconEx CheckMenuItem TrackPopupMenu DrawTextW GetWindowDC DefWindowProcW SetWindowLongPtrW OffsetRect MapWindowPoints GetMenuBarInfo SetWindowDisplayAffinity ShowWindow PostQuitMessage SystemParametersInfoA RegisterTouchWindow GetSystemMetrics IsWindow CreateWindowExW AdjustWindowRectEx RegisterClassExW CreatePopupMenu SetCursorPos InvalidateRgn SetWindowPos GetWindowRect UpdateWindow InvalidateRect GetMessageA CreateMenu SendInput MapVirtualKeyW SetForegroundWindow GetForegroundWindow GetClientRect FlashWindowEx CreateIcon GetActiveWindow ClientToScreen IsWindowEnabled MonitorFromPoint GetWindowLongPtrW EnumDisplayMonitors MonitorFromWindow IsIconic IsWindowVisible EnableWindow RegisterRawInputDevices RedrawWindow GetCursorPos SendMessageW RemoveMenu PostMessageW AppendMenuW InsertMenuW RegisterWindowMessageA

oleaut32

GetErrorInfo SysStringLen SetErrorInfo SysFreeString

gdi32

SetTextColor CreateDIBSection GetDeviceCaps SetBkMode CreateSolidBrush CombineRgn DeleteObject BitBlt CreateRectRgn DeleteDC SelectObject CreateCompatibleDC

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow DwmGetWindowAttribute

comctl32

TaskDialogIndirect SetWindowSubclass RemoveWindowSubclass DefSubclassProc

shlwapi

SHCreateMemStream

advapi32

RegOpenKeyExW RegGetValueW RegQueryValueExW RegCloseKey EventSetInformation EventRegister SystemFunction036 EventUnregister EventWriteTransfer

bcrypt

BCryptGenRandom

ws2_32

select ioctlsocket listen accept recv WSARecv getpeername freeaddrinfo getaddrinfo send bind connect WSADuplicateSocketW setsockopt WSAStartup getsockopt closesocket WSASocketW WSAGetLastError getsockname WSASend

vcruntime140

__CxxFrameHandler3 memcpy memmove memset memcmp _CxxThrowException wcsrchr _purecall __C_specific_handler __current_exception __current_exception_context __std_exception_copy __std_exception_destroy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

pow roundf floor trunc round __setusermatherr

api-ms-win-crt-string-l1-1-0

wcslen _wcsicmp wcscmp strlen

api-ms-win-crt-runtime-l1-1-0

_exit _wassert _configure_narrow_argv __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initterm_e _seh_filter_exe __p___argc _initialize_onexit_table _initterm _register_onexit_function _crt_atexit terminate _get_initial_narrow_environment exit _set_app_type _initialize_narrow_environment

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale