alterware-launcher[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

alterware-launcher.exe
Size

2.5MB
MD5

4c54b91cce2838569fed48856159c6de
SHA1

f88fd673b1518b1edbd1fc2702119568fdf4b9f5
SHA256

7a45b13151d7b36d667105cf471ca88a7894183bd78c8559c87626c21dd7005a
SHA512

446f5c7caa914beb2e5869ba2a2a1de27768f1efe4f62dc11cb0325b954322cede30323ec67e00ecc2ad5bf6d1e43c7ae207340bb41297966b8c0641c343a3f5
SSDEEP

49152:2Wbu0p8D+sGp8CrPEbx1tt10DLhIEwPL+1qZHuoiPuy4wbG:eCUL0hwy4k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
alterware-launcher.exe

Files

alterware-launcher.exe
.exe windows:6 windows x64 arch:x64

2225fcbfc9872b2c71545e43c70fddfb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\alterware-launcher\alterware-launcher\target\x86_64-pc-windows-msvc\release\deps\alterware_launcher.pdb

Imports

ntdll

NtWriteFile
RtlNtStatusToDosError
NtDeviceIoControlFile
NtCancelIoFileEx
NtCreateFile
RtlCaptureContext
NtReadFile
RtlVirtualUnwind
RtlLookupFunctionEntry

kernel32

SetHandleInformation
GetSystemInfo
SleepConditionVariableSRW
AcquireSRWLockShared
ReleaseSRWLockShared
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
ExitProcess
CreateProcessA
LocalFree
SetFileCompletionNotificationModes
GetStdHandle
GetConsoleMode
SetConsoleMode
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
GetFileInformationByHandleEx
SetConsoleTextAttribute
GetCurrentThreadId
GetTimeZoneInformationForYear
Sleep
GetModuleHandleA
GetProcAddress
DeleteFileW
WaitForSingleObject
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
IsProcessorFeaturePresent
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceCounter
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetCommandLineW
GetModuleFileNameW
SetFileInformationByHandle
DuplicateHandle
GetCurrentProcessId
WriteFileEx
SleepEx
GetExitCodeProcess
WakeAllConditionVariable
WakeConditionVariable
QueryPerformanceFrequency
HeapFree
GetCurrentProcess
HeapReAlloc
ReleaseMutex
GetProcessHeap
HeapAlloc
FindNextFileW
FindClose
GetFileInformationByHandle
CreateDirectoryW
FindFirstFileW
MoveFileExW
GetFinalPathNameByHandleW
CopyFileExW
GetFileType
CreateFileW
GetModuleHandleW
FormatMessageW
SetCurrentDirectoryW
GetFullPathNameW
ReleaseSRWLockExclusive
CreateNamedPipeW
ReadFileEx
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
CloseHandle
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ReadConsoleW
CreateThread
GetCurrentThread
GetSystemTimeAsFileTime
GetTempPathW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

shell32

CommandLineToArgvW

advapi32

RegQueryValueExW
RegOpenKeyExW
SystemFunction036
RegCloseKey

ws2_32

connect
WSASocketW
getpeername
getsockname
ioctlsocket
shutdown
recv
send
WSASend
getsockopt
closesocket
setsockopt
WSAIoctl
WSAGetLastError
WSAStartup
WSACleanup
freeaddrinfo
getaddrinfo
bind

secur32

DeleteSecurityContext
DecryptMessage
FreeCredentialsHandle
AcceptSecurityContext
InitializeSecurityContextW
FreeContextBuffer
QueryContextAttributesW
EncryptMessage
ApplyControlToken
AcquireCredentialsHandleA

crypt32

CertFreeCertificateChain
CertDuplicateCertificateChain
CertFreeCertificateContext
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertOpenStore
CertDuplicateStore
CertCloseStore
CertVerifyCertificateChainPolicy
CertGetCertificateChain

bcrypt

BCryptGenRandom

vcruntime140

__C_specific_handler
memcpy
memmove
__current_exception_context
memset
memcmp
__current_exception
__CxxFrameHandler3

api-ms-win-crt-convert-l1-1-0

_wtoi64

api-ms-win-crt-math-l1-1-0

truncf
trunc
__setusermatherr
pow
round
ceil

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
exit
_exit
__p___argc
_configure_narrow_argv
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
_initialize_narrow_environment
_register_onexit_function
_initialize_onexit_table
_get_initial_narrow_environment
_cexit
_set_app_type
_seh_filter_exe
_crt_atexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 744KB - Virtual size: 744KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 106KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2225fcbfc9872b2c71545e43c70fddfb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

kernel32

shell32

advapi32

ws2_32

secur32

crypt32

bcrypt

vcruntime140

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 744KB - Virtual size: 744KB

.data Size: 9KB - Virtual size: 10KB

.pdata Size: 56KB - Virtual size: 55KB

.rsrc Size: 106KB - Virtual size: 105KB

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 744KB - Virtual size: 744KB

.data
Size: 9KB - Virtual size: 10KB

.pdata
Size: 56KB - Virtual size: 55KB

.rsrc
Size: 106KB - Virtual size: 105KB

.reloc
Size: 20KB - Virtual size: 19KB