horizon-launcher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
horizon-launcher.exe
Size 58.7MB
Sample261113-vxtbwsd18t
SHA256 858df0bca971217439fee84a0d40b42a5aeacc906f9f573aa364d10f0b4b8d1d
MD5 50fdeac0afb3ecdcee33df3c70c4e15f
SHA1 8792140e88f2e357f9e5f04e409d394fe8e9f9b6
SHA512 9bcae9fb724b6b343e9c34d19449fce6d4f6f8a5582dfe75af58fda6802d2f0cd986923c0defc4eba77e9bcfabd4f41f76914116f9e7bdf71a2910eff93825ad
SSDEEP 393216:MSbaMhKwoIgPJJwzr0Db4/4Zotknc4Q5yznDzgr60XDCdbEk2+4SUK:pbaMhKwoIJ9eotB8DztuTt+4SU
TLSH
T178D73A12B75A546ED1A6C4B083064A336B3434DF1B36ADFF50E552383FBAAB45B38319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
horizon-launcher.exe

File Explorer

horizon-launcher.exe

.exe 58.7MB

horizon-launcher.exe

IMPHASH e268ac1f777933122a8cb371e53aec41
SHA256 858df0bca971217439fee84a0d40b42a5aeacc906f9f573aa364d10f0b4b8d1d
MD5 50fdeac0afb3ecdcee33df3c70c4e15f
SHA1 8792140e88f2e357f9e5f04e409d394fe8e9f9b6
SHA512 9bcae9fb724b6b343e9c34d19449fce6d4f6f8a5582dfe75af58fda6802d2f0cd986923c0defc4eba77e9bcfabd4f41f76914116f9e7bdf71a2910eff93825ad
SSDEEP 393216:MSbaMhKwoIgPJJwzr0Db4/4Zotknc4Q5yznDzgr60XDCdbEk2+4SUK:pbaMhKwoIJ9eotB8DztuTt+4SU
TLSH
T178D73A12B75A546ED1A6C4B083064A336B3434DF1B36ADFF50E552383FBAAB45B38319
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37461600

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

horizon_launcher.pdb

kernel32

LCMapStringW CompareStringW LoadLibraryExW GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage UnhandledExceptionFilter HeapSize IsProcessorFeaturePresent GetCommandLineA WriteFile DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsGetValue RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead SetStdHandle GetStdHandle AttachConsole IsDebuggerPresent CloseHandle FlsSetValue IsThreadAFiber FlsAlloc FlsFree FreeLibrary GetModuleHandleExW GetFileType GetFileAttributesW SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar ReadConsoleW GetModuleFileNameW SetEnvironmentVariableW GetEnvironmentVariableW DeleteFileW DeviceIoControl WaitForMultipleObjects HeapFree CreateSymbolicLinkW GetFinalPathNameByHandleW GetTempPathW WaitForSingleObjectEx FindNextFileW SwitchToThread ExitProcess FindClose FindFirstFileExW RemoveDirectoryW GetCommandLineW PowerSetRequest PowerCreateRequest GetCurrentDirectoryW SetThreadStackGuarantee UnmapViewOfFile GetCurrentProcessId GetEnvironmentStringsW GetProcessHeap TerminateProcess CreateProcessW CloseThreadpoolTimer GetWindowsDirectoryW GetCurrentThreadId GetSystemDirectoryW CreateMutexA SetFileTime CancelIo GetSystemTimePreciseAsFileTime UnlockFile GetCurrentProcess GetOverlappedResult CreateThreadpoolTimer SetThreadpoolTimer TrySubmitThreadpoolCallback RtlCaptureContext RtlLookupFunctionEntry QueryPerformanceFrequency GlobalFree GlobalUnlock WriteFileEx GlobalAlloc GlobalLock SleepEx ReadFileEx WaitForSingleObject CreateThread QueryPerformanceCounter HeapReAlloc CreateHardLinkW CopyFileExW GlobalSize CreateFileW SetFileInformationByHandle GetFullPathNameW SetLastError FreeEnvironmentStringsW CompareStringOrdinal RegisterWaitForSingleObject GetProcAddress LoadLibraryA GetTimeZoneInformationForYear LocaleNameToLCID ReleaseMutex GetUserDefaultLocaleName PowerClearRequest GetFileInformationByHandle GetConsoleMode SetConsoleMode SetConsoleTextAttribute GetConsoleScreenBufferInfo ProcessIdToSessionId GetSystemInfo VirtualProtect CreateFileMappingW DuplicateHandle FlushFileBuffers OpenProcess GetExitCodeProcess GetNativeSystemInfo GetShortPathNameW GetSystemTimeAsFileTime MoveFileExW SetThreadPriority GetCurrentThread SetFileAttributesW GetUserPreferredUILanguages CreateDirectoryW GetModuleHandleA GetLastError GetBinaryTypeW UnregisterWaitEx FormatMessageW RtlVirtualUnwind LoadLibraryExA WideCharToMultiByte CreateEventW Sleep GetModuleHandleW HeapAlloc GetCurrentPackageFullName ReadFile GlobalMemoryStatusEx MapViewOfFile SetHandleInformation LockFileEx GetSystemPowerStatus GetFileInformationByHandleEx lstrlenW SetFilePointerEx AddVectoredExceptionHandler

user32

MessageBoxW ClientToScreen PostQuitMessage RedrawWindow DefWindowProcW EnumDisplaySettingsW PostMessageW PeekMessageW RegisterClipboardFormatW GetClipboardFormatNameW GetClipboardData EnumClipboardFormats CountClipboardFormats EnumDisplayMonitors SetWindowLongPtrW TranslateMessage OpenClipboard SetClipboardData RegisterClassW DispatchMessageW SetWindowTextW GetProcessWindowStation GetForegroundWindow MessageBeep SetWindowPos GetWindowLongPtrW MonitorFromPoint KillTimer EnumThreadWindows GetClassNameW GetClientRect GetWindowPlacement SetTimer EmptyClipboard GetDoubleClickTime GetSystemMetrics GetPointerType GetMonitorInfoW SetCapture TrackMouseEvent ReleaseCapture ToUnicode GetKeyboardState IsZoomed GetDpiForWindow EnableWindow IsWindowEnabled MonitorFromWindow GetFocus ScreenToClient GetCursorPos GetUserObjectInformationW MapVirtualKeyW SetForegroundWindow SendInput SetFocus SetActiveWindow ShowWindowAsync SetWindowPlacement FlashWindowEx GetKeyboardLayoutNameW SetPropW RemovePropW GetWindowRect IsIconic IsWindowVisible ValidateRect SystemParametersInfoW DestroyWindow UnregisterPowerSettingNotification GetSystemMetricsForDpi UnregisterSuspendResumeNotification SendMessageW GetMessageW SetCursor LoadImageW RegisterPowerSettingNotification CreateWindowExW RegisterSuspendResumeNotification GetActiveWindow CloseClipboard GetKeyState

advapi32

CredFree CredReadW CredWriteW RegDeleteKeyExW SetFileSecurityW GetFileSecurityW RegOpenKeyExW RegCreateKeyTransactedW RegCreateKeyExW RegCloseKey RegOpenKeyTransactedW RegQueryValueExW RegQueryInfoKeyW RegSetValueExW CredDeleteW SystemFunction036

bcryptprimitives

ProcessPrng

ws2_32

select WSAGetLastError getaddrinfo accept getsockname WSARecv WSASend ioctlsocket WSAStartup getsockopt recv send bind listen freeaddrinfo getpeername WSADuplicateSocketW setsockopt connect WSASocketW closesocket

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

combase

CoTaskMemFree CoCreateFreeThreadedMarshaler CoIncrementMTAUsage

ole32

ReleaseStgMedium RevokeDragDrop PropVariantClear CoInitializeEx CoUninitialize OleUninitialize OleInitialize RegisterDragDrop CoCreateInstance

comctl32

TaskDialogIndirect

dwrite

DWriteCreateFactory

imm32

ImmGetCompositionStringW ImmSetCandidateWindow ImmSetCompositionWindow ImmNotifyIME ImmAssociateContextEx ImmReleaseContext ImmGetContext

icuuc

u_strlen

dcomp

DCompositionCreateDevice

shell32

SHCreateItemFromParsingName SHGetKnownFolderPath SHOpenFolderAndSelectItems ShellExecuteW SHGetDesktopFolder DragQueryFileW SetCurrentProcessExplicitAppUserModelID

gdi32

CreateSolidBrush

winmm

timeEndPeriod timeBeginPeriod

dxgi

CreateDXGIFactory2

d3d11

D3D11CreateDevice

dwmapi

DwmSetWindowAttribute DwmGetCompositionTimingInfo DwmFlush

ntdll

RtlNtStatusToDosError NtOpenFile NtReadFile NtCreateNamedPipeFile RtlGetVersion NtWriteFile

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

uiautomationcore

UiaGetReservedMixedAttributeValue UiaHostProviderFromHwnd UiaRaiseAutomationPropertyChangedEvent UiaGetReservedNotSupportedValue UiaRaiseAutomationEvent UiaLookupId UiaReturnRawElementProvider

oleaut32

SetErrorInfo GetErrorInfo SafeArrayPutElement SafeArrayCreateVector VariantClear SysAllocStringLen SysFreeString SysStringLen

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

iphlpapi

GetAdaptersAddresses

bcrypt

BCryptGenRandom

userenv

GetUserProfileDirectoryW

Name

.text

Size

36.4MB

Virtual Size

36.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20.5MB

Virtual Size

20.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

263KB

Virtual Size

266KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

horizon-launcher.exe

kernel32

user32

advapi32

bcryptprimitives

ws2_32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-l1-1-0

combase

ole32

comctl32

dwrite

imm32

icuuc

dcomp

shell32

gdi32

winmm

dxgi

d3d11

dwmapi

ntdll

api-ms-win-shcore-scaling-l1-1-1

uiautomationcore

oleaut32

api-ms-win-core-winrt-error-l1-1-0

iphlpapi

bcrypt

userenv

generic