ALM Client Launcher 3[.]1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ALM Client Launcher 3.1.exe
Size

2.0MB
MD5

8d1b4ef74c17b397f10ca9ca777d4b91
SHA1

b62fea651642afa34f959532ab1b914e98868753
SHA256

486880fcbfb39f66ec3a004e0ece2a217190e351c5632a490be9221b7b83a37d
SHA512

f9f12691f2b69a19ded0f5ef95b23e2b397b007086dcc51ab4b4ad58ee52d98a099e1c76710f943aed6d13def84f5e7a1da070ae1356e4eccc9da33d681d1492
SSDEEP

24576:c4yEAVWNg9lGCUIxzIeOrSTqtiKNZ9PAvr49MIhk:kRgolGCBUMC9MIy

Score

1^/10

Malware Config

Signatures

Files

ALM Client Launcher 3.1.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

0b:0e:c2:c0:13:bd:32:2e:ef:b2:3c:f3:4b:78:62:79
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/02/2020, 00:00

Not After

27/02/2021, 23:59

Subject

CN=Micro Focus Group Limited,O=Micro Focus Group Limited,POSTALCODE=RG14 1QN,STREET=The Lawn\, 22-30 Old Bath Road,L=Newbury,ST=Berkshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:63:de:f8
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

24/12/1999, 17:50

Not After

24/07/2029, 14:15

Subject

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

22/07/2015, 19:02

Not After

22/06/2029, 19:32

Subject

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4
Certificate

Issuer

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

22/07/2020, 15:33

Not After

29/12/2030, 16:29

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

c3:67:b0:bb:d8:c5:e5:62:bc:e5:b9:f4:07:b9:88:d6:ec:46:73:76:7e:75:df:67:0c:f6:31:d3:d0:55:27:77
Signer

Actual PE Digest

c3:67:b0:bb:d8:c5:e5:62:bc:e5:b9:f4:07:b9:88:d6:ec:46:73:76:7e:75:df:67:0c:f6:31:d3:d0:55:27:77

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Jenkins\workspace\ALMClientLauncher_build\ClientServer\ALMLauncher\obj\Debug\ALMClientLauncher.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

0b:0e:c2:c0:13:bd:32:2e:ef:b2:3c:f3:4b:78:62:79Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

38:63:de:f8Certificate

Key Usages

58:da:13:ff:00:00:00:00:51:ce:0d:f7Certificate

Extended Key Usages

Key Usages

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4Certificate

Extended Key Usages

Key Usages

c3:67:b0:bb:d8:c5:e5:62:bc:e5:b9:f4:07:b9:88:d6:ec:46:73:76:7e:75:df:67:0c:f6:31:d3:d0:55:27:77Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rsrc Size: 236KB - Virtual size: 236KB

.reloc Size: 512B - Virtual size: 12B

0b:0e:c2:c0:13:bd:32:2e:ef:b2:3c:f3:4b:78:62:79
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

38:63:de:f8
Certificate

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4
Certificate

c3:67:b0:bb:d8:c5:e5:62:bc:e5:b9:f4:07:b9:88:d6:ec:46:73:76:7e:75:df:67:0c:f6:31:d3:d0:55:27:77
Signer

.text
Size: 1.8MB - Virtual size: 1.8MB

.rsrc
Size: 236KB - Virtual size: 236KB

.reloc
Size: 512B - Virtual size: 12B