File name:

SKlauncher 3-beta.10.exe

Full analysis: https://app.any.run/tasks/439fbd2e-f299-48f5-8d59-203012caa022
Verdict: Malicious activity
Analysis date: July 15, 2019, 23:54:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5:

1CA75E4CDCDBA11DC8152FE31D8F35C8

SHA1:

E9CCAEA87130CF19E1455A82D056109F908894F8

SHA256:

109E69706268BF4FAC32E6BF7AD648F6F9BF611ACEF60C01D772C50675A5C385

SSDEEP:

6144:Ri6CBxAXouqxoOekSp0hZgZS64V7gyfIXTi2m9nvzrsnxQGIp:I6sxAXEoQSqZgE6NAum9rInxw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executes JAVA applets

      • SKlauncher 3-beta.10.exe (PID: 3028)
      • javaw.exe (PID: 3720)

    • Creates files in the user directory

      • javaw.exe (PID: 3720)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • javaw.exe (PID: 3720)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (41)
.exe | Win64 Executable (generic) (36.3)
.dll | Win32 Dynamic Link Library (generic) (8.6)
.exe | Win32 Executable (generic) (5.9)
.exe | Win16/32 Executable Delphi generic (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:05:24 16:35:43+02:00
PEType: PE32
LinkerVersion: 2.22
CodeSize: 19968
InitializedDataSize: 60416
UninitializedDataSize: 36864
EntryPoint: 0x1290
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.0.0.0
ProductVersionNumber: 3.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Windows NT
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Mojang
FileDescription: The Minecraft Launcher
FileVersion: 3.0.beta.10
InternalName: SKlauncher
LegalCopyright: Mojang
LegalTrademarks: -
OriginalFileName: SKlauncher 3.0.beta.10.exe
ProductName: SKlauncher
ProductVersion: 3.0.beta.10

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 24-May-2019 14:35:43
Detected languages:
  • English - United States
  • Process Default Language
CompanyName: Mojang
FileDescription: The Minecraft Launcher
FileVersion: 3.0.beta.10
InternalName: SKlauncher
LegalCopyright: Mojang
LegalTrademarks: -
OriginalFilename: SKlauncher 3.0.beta.10.exe
ProductName: SKlauncher
ProductVersion: 3.0.beta.10

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 24-May-2019 14:35:43
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_DEBUG_STRIPPED
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00004CE0
0x00004E00
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.03278
.data
0x00006000
0x00000040
0x00000200
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.163808
.rdata
0x00007000
0x00000680
0x00000800
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.92317
.bss
0x00008000
0x00008E30
0x00000000
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.idata
0x00011000
0x00000AA8
0x00000C00
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.65099
.rsrc
0x00012000
0x0000D4B0
0x0000D600
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.62166

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.27728
776
UNKNOWN
Process Default Language
RT_VERSION
2
2.72548
9
UNKNOWN
Process Default Language
RT_RCDATA
3
2.64644
10
UNKNOWN
Process Default Language
RT_RCDATA
4
6.30866
9640
UNKNOWN
Process Default Language
RT_ICON
5
7.97926
34399
UNKNOWN
Process Default Language
RT_ICON
10
3.61687
17
UNKNOWN
Process Default Language
RT_RCDATA
17
2.32193
5
UNKNOWN
Process Default Language
RT_RCDATA
18
1
2
UNKNOWN
Process Default Language
RT_RCDATA
20
1.58496
3
UNKNOWN
Process Default Language
RT_RCDATA
21
3.93775
31
UNKNOWN
Process Default Language
RT_RCDATA

Imports

ADVAPI32.DLL
KERNEL32.dll
SHELL32.DLL
USER32.dll
msvcrt.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sklauncher 3-beta.10.exe no specs javaw.exe java.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3028"C:\Users\admin\AppData\Local\Temp\SKlauncher 3-beta.10.exe" C:\Users\admin\AppData\Local\Temp\SKlauncher 3-beta.10.exe—explorer.exe
User:
admin
Company:
Mojang
Integrity Level:
MEDIUM
Description:
The Minecraft Launcher
Exit code:
0
Version:
3.0.beta.10
Modules
Images
c:\users\admin\appdata\local\temp\sklauncher 3-beta.10.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3564"C:\Program Files\Java\jre1.8.0_92\bin\java.exe" -versionC:\Program Files\Java\jre1.8.0_92\bin\java.exe—javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
Modules
Images
c:\program files\java\jre1.8.0_92\bin\java.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3720"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -Xms32m -Xmx256m -jar "C:\Users\admin\AppData\Local\Temp\SKlauncher 3-beta.10.exe"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe
SKlauncher 3-beta.10.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
Modules
Images
c:\program files\java\jre1.8.0_92\bin\javaw.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
16
Read events
15
Write events
1
Delete events
0

Modification events

(PID) Process:(3720) javaw.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
javaw.exe
Executable files
16
Suspicious files
21
Text files
28
Unknown types
205

Dropped files

PID
Process
Filename
Type
3720javaw.exeC:\Users\admin\AppData\Roaming\.minecraft\sklauncher\sklauncher.pack —
MD5:—
SHA256:—
3720javaw.exeC:\Users\admin\AppData\Roaming\.minecraft\sklauncher\sklauncher.jsontext
MD5:—
SHA256:—
3720javaw.exeC:\Users\admin\AppData\Roaming\.minecraft\sklauncher-fx.jarcompressed
MD5:—
SHA256:—
3720javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:—
SHA256:—
3720javaw.exeC:\Users\admin\AppData\Roaming\.minecraft\sklauncher\sklauncher.datatext
MD5:—
SHA256:—
3720javaw.exeC:\Users\admin\AppData\Local\Temp\+JXF110880531692378069.tmpttf
MD5:—
SHA256:—
3720javaw.exeC:\Users\admin\AppData\Local\Temp\+JXF8448032085585718881.tmpttf
MD5:—
SHA256:—
3720javaw.exeC:\Users\admin\AppData\Local\Temp\+JXF1300293372235815552.tmpttf
MD5:—
SHA256:—
3720javaw.exeC:\Users\admin\AppData\Roaming\.minecraft\launcher_profiles.jsontext
MD5:—
SHA256:—
3720javaw.exeC:\Users\admin\AppData\Local\Temp\+JXF4360580175227896.tmpttf
MD5:EECB234B5E1BF2F9A351E0402EDD36F3
SHA256:05748EC7BD14F2CB0F0A58D69CA42A3D16248A93B394E1FF4BF7F17C3A8BF906
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
238
TCP/UDP connections
43
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3720
javaw.exe
GET
301
104.31.75.141:80
http://s1.hapel.pl/launcher/3.0/data
US
html
245 b
suspicious
3720
javaw.exe
GET
200
104.31.80.246:80
http://api.skmedix.pl/launcher/3.0/
US
text
229 b
malicious
3720
javaw.exe
GET
200
104.31.80.246:80
http://api.skmedix.pl/launcher/3.0/
US
text
229 b
malicious
3720
javaw.exe
GET
200
104.31.75.141:80
http://s1.hapel.pl/launcher/3.0/data/
US
text
655 b
suspicious
3720
javaw.exe
GET
200
104.31.75.141:80
http://s1.hapel.pl/launcher/3.0/data/
US
text
655 b
suspicious
3720
javaw.exe
GET
301
104.31.75.141:80
http://s1.hapel.pl/launcher/3.0/data
US
html
245 b
suspicious
3720
javaw.exe
GET
200
104.31.75.141:80
http://s1.hapel.pl/launcher/3.0/files/stable/launcher.comp.pack
US
xz
7.76 Mb
suspicious
3720
javaw.exe
GET
200
104.31.80.246:80
http://api.skmedix.pl/v2/avatar/asd
US
image
12.3 Kb
malicious
3720
javaw.exe
GET
200
54.230.202.159:80
http://resources.download.minecraft.net/e3/e3c89469737be4b109f0737f76b1ec97e41a8693
US
text
17.8 Kb
shared
3720
javaw.exe
GET
200
54.230.202.159:80
http://resources.download.minecraft.net/7c/7c6d3020a1a11e34e722cc7e5283de54ca8cae19
US
ogg
13.8 Kb
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3720
javaw.exe
104.31.80.246:443
api.skmedix.pl
Cloudflare Inc
US
shared
—
—
104.31.80.246:80
api.skmedix.pl
Cloudflare Inc
US
shared
—
—
104.31.80.246:443
api.skmedix.pl
Cloudflare Inc
US
shared
3720
javaw.exe
104.31.80.246:80
api.skmedix.pl
Cloudflare Inc
US
shared
3720
javaw.exe
104.31.75.141:80
s1.hapel.pl
Cloudflare Inc
US
shared
3720
javaw.exe
104.31.75.141:443
s1.hapel.pl
Cloudflare Inc
US
shared
3720
javaw.exe
54.239.168.146:443
launchermeta.mojang.com
Amazon.com, Inc.
US
unknown
3720
javaw.exe
54.192.203.17:443
libraries.minecraft.net
Amazon.com, Inc.
US
unknown
3720
javaw.exe
54.230.202.159:80
resources.download.minecraft.net
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
api.skmedix.pl
  • 104.31.80.246
  • 104.31.81.246
malicious
s1.hapel.pl
  • 104.31.75.141
  • 104.31.74.141
suspicious
skmedix.pl
  • 104.31.80.246
  • 104.31.81.246
malicious
launchermeta.mojang.com
  • 54.239.168.146
whitelisted
libraries.minecraft.net
  • 54.192.203.17
shared
launcher.mojang.com
  • 54.239.168.146
whitelisted
resources.download.minecraft.net
  • 54.230.202.159
  • 54.230.202.121
  • 54.230.202.241
  • 54.230.202.187
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SKlauncher 3-beta.10.exe