LittleAlterBoy[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

LittleAlterBoy.dll
Size

13.5MB
MD5

ae966cb150cc0c74fbbcf0aa42a06339
SHA1

dfb64456808bafb86781100b2ff9a3a7f9007400
SHA256

362b0a519ca6e4f470b7e7063139c73c959789bfce5ae66bbe58210ef86c839b
SHA512

90d0adc360acc0c6ffcf1f5273f5ef62b5909de39070361fe5b677b40197f0ca3f3ba8e6a44f52cbe7c6ccb77f2b433a5fd90189a69aba2941465b2c9dbd6404
SSDEEP

393216:c7B54a6ZZYmUvkrhtJh/52T3O0OtEAjQBO/:c7B54/YmwOtJrs3ODEYD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LittleAlterBoy.dll

Files

LittleAlterBoy.dll
.dll windows:4 windows x64 arch:x64

dda9a9f162261e7bcebb63690dc1b6f7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

SetThreadContext
GetThreadContext
Thread32Next
ResumeThread
SuspendThread
OpenThread
CloseHandle
Thread32First
GetCurrentProcessId
CreateToolhelp32Snapshot
GetCurrentThread
OutputDebugStringA
CreateThread
DeleteCriticalSection
VirtualAlloc
CreateMutexA
InitializeCriticalSection
Sleep
CreateEventA
SetEvent
EnterCriticalSection
LeaveCriticalSection
TlsFree
PostQueuedCompletionStatus
GetLastError
TlsAlloc
LocalFree
FormatMessageA
OpenEventA
ResetEvent
WTSGetActiveConsoleSessionId
LoadLibraryW
MultiByteToWideChar
GetSystemTimeAsFileTime
SetEndOfFile
CreateFileW
DeviceIoControl
GetFileAttributesW
GetCurrentDirectoryW
GetFileAttributesExW
SetLastError
InitializeCriticalSectionAndSpinCount
SleepEx
CreateEventW
GetModuleHandleA
TlsSetValue
SetWaitableTimer
CancelIo
GetOverlappedResult
WriteFile
ReadFile
CreateIoCompletionPort
QueueUserAPC
TerminateThread
WaitForMultipleObjects
GetQueuedCompletionStatus
CreateWaitableTimerW
TerminateProcess
GetCurrentProcess
GetStdHandle
GetExitCodeProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
CreateProcessA
CreateFileA
GetTickCount
QueryPerformanceFrequency
QueryPerformanceCounter
FlushFileBuffers
WaitNamedPipeA
GetSystemInfo
GetThreadTimes
PeekNamedPipe
SetErrorMode
GetVolumeInformationA
GetDriveTypeA
GetLogicalDriveStringsA
GetLogicalDrives
GetSystemDirectoryA
GetComputerNameW
GetVersionExW
GetUserDefaultLCID
GetStringTypeExA
FreeLibrary
LCMapStringA
LCMapStringW
LoadLibraryA
WideCharToMultiByte
GetModuleFileNameA
GetProcAddress
__C_specific_handler
GetProcessHeap
HeapAlloc
HeapFree
VirtualProtect
GetVersionExA
GetCurrentThreadId
WaitForSingleObject
TlsGetValue
SetEnvironmentVariableA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetFileAttributesA
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
GetACP
SetFilePointer
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoA
SetHandleCount
GetSystemTime
FindFirstFileA
GetFileType
SetStdHandle
CreateDirectoryA
GetFileSize
ReplaceFileA
GetTempFileNameA
GetTempPathA
FindNextFileA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
LockResource
GetConsoleMode
GetConsoleCP
RtlVirtualUnwind
HeapSize
FlsAlloc
FlsFree
FlsGetValue
GetStringTypeW
GetStringTypeA
CompareStringW
CompareStringA
GetCPInfo
ExitThread
GetTimeFormatA
GetDateFormatA
HeapReAlloc
GetCommandLineA
FlsSetValue
HeapDestroy
HeapCreate
HeapSetInformation
ExitProcess
RtlCaptureContext
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlPcToFileHeader
RaiseException
RtlUnwindEx
RtlLookupFunctionEntry
GetLocaleInfoA
FindResourceA
SizeofResource
LoadResource
GetEnvironmentVariableA

user32

MessageBoxA
SetCapture
ReleaseCapture
SetTimer
GetWindowInfo
GetDesktopWindow
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
LoadStringA
LoadCursorA
GetSysColorBrush
RegisterClassA
CreateWindowExA
SetParent
GetWindowLongPtrA
DefWindowProcA
BeginPaint
EndPaint
SetFocus
GetParent
GetWindowRect
KillTimer
SetWindowPos
GetDC
SetWindowLongPtrA
DestroyWindow
UnregisterClassA
InvalidateRect
GetAsyncKeyState
SystemParametersInfoA
GetCapture

advapi32

CryptAcquireContextW
CryptGenRandom
CryptReleaseContext

shell32

ShellExecuteA
Shell_NotifyIconW
SHGetFolderPathA

ole32

CreateStreamOnHGlobal

ws2_32

WSACleanup
htons
ntohs
WSASetLastError
ntohl
htonl
WSAStartup

setupapi

SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiGetDeviceInterfaceDetailA
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstanceIdA

gdiplus

GdipFree
GdipAlloc
GdipDeleteBrush
GdipSetSolidFillColor
GdipCreatePen1
GdipDeletePen
GdipCreatePath
GdipGetImageHorizontalResolution
GdipGetImageVerticalResolution
GdipDeletePath
GdipCreateFontFamilyFromName
GdipCreateFont
GdipCreateSolidFill
GdipSetPenWidth
GdipSetPenMode
GdipSetPenColor
GdipResetPath
GdiplusStartup
GdipAddPathArc
GdipGetImageGraphicsContext
GdipDrawLineI
GdipDrawPath
GdipGraphicsClear
GdipFillRectangle
GdipFillEllipse
GdipFillPath
GdipDrawImageRectRect
GdipSetClipRectI
GdipGetEmHeight
GdipGetCellAscent
GdipClosePathFigure
GdiplusShutdown
GdipGetCellDescent
GdipCloneBrush
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipDeleteGraphics
GdipDisposeImage
GdipGetImageWidth
GdipCreateBitmapFromStream
GdipDrawImagePointRect
GdipCreateFromHDC
GdipCloneImage
GdipDrawImageI
GdipSetImageAttributesColorMatrix
GdipCreateBitmapFromScan0
GdipBitmapGetPixel
GdipBitmapSetResolution
GdipGetImageHeight

comdlg32

GetSaveFileNameA

wininet

InternetGetConnectedState

imagehlp

ImageEnumerateCertificates
ImageGetCertificateHeader
ImageGetCertificateData
ImageAddCertificate

wintrust

WinVerifyTrust

Exports

Exports

?BadCodeHostFnPtr_03b20d07_mfort6317_@@3PAP6A_KXZA
?BadCodeHostFnPtr_38bdae05_mfort6317_@@3PAP6A_KXZA
?BadCodeHostFnPtr_3c5f1ffa_mfort6317_@@3PAP6A_KXZA
?BadCodeHostFnPtr_5044bd55_mfort6317_@@3PAP6A_KXZA
?BadCodeHostFnPtr_55492fd7_mfort6317_@@3PAP6A_KXZA
?BadCodeHostFnPtr_55571850_mfort6317_@@3PAP6A_KXZA
?BadCodeHostFnPtr_71a2f5b6_mfort6317_@@3PAP6A_KXZA
?BadCodeHostFnPtr_7e262280_mfort6317_@@3PAP6A_KXZA
?BadCodeHostFnPtr_8f530432_mfort6317_@@3PAP6A_KXZA
?BadCodeHostFnPtr_b1c74e32_mfort6317_@@3PAP6A_KXZA
?BadCodeHostFnPtr_e33d9fa9_mfort6317_@@3PAP6A_KXZA
?__pace_fusion_license_callback_0xecddca48_AuthCBFnPtr_mfort6317_@@3PAP6A_K_K@ZA
BadCodeHostFnPtr_DefaultBadCode_mfort6317_
VSTPluginMain
main

Sections

.text
Size: 2.7MB - Virtual size: 7.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 273KB - Virtual size: 796KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 335KB - Virtual size: 18.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mfrt
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.oldrel
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc64
Size: 207KB - Virtual size: 206KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.utopia
Size: 2.7MB - Virtual size: 8.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.auPack
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

dda9a9f162261e7bcebb63690dc1b6f7

Headers

File Characteristics

Imports

version

kernel32

user32

advapi32

shell32

ole32

ws2_32

setupapi

gdiplus

comdlg32

wininet

imagehlp

wintrust

Exports

Exports

Sections

.text Size: 2.7MB - Virtual size: 7.1MB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.data Size: 273KB - Virtual size: 796KB

.pdata Size: 335KB - Virtual size: 18.7MB

.mfrt Size: 512B - Virtual size: 12B

.tls Size: 512B - Virtual size: 13B

.rsrc Size: 5.8MB - Virtual size: 5.8MB

.oldrel Size: 150KB - Virtual size: 149KB

.reloc64 Size: 207KB - Virtual size: 206KB

.utopia Size: 2.7MB - Virtual size: 8.6MB

.auPack Size: 4KB - Virtual size: 4KB

.text
Size: 2.7MB - Virtual size: 7.1MB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 273KB - Virtual size: 796KB

.pdata
Size: 335KB - Virtual size: 18.7MB

.mfrt
Size: 512B - Virtual size: 12B

.tls
Size: 512B - Virtual size: 13B

.rsrc
Size: 5.8MB - Virtual size: 5.8MB

.oldrel
Size: 150KB - Virtual size: 149KB

.reloc64
Size: 207KB - Virtual size: 206KB

.utopia
Size: 2.7MB - Virtual size: 8.6MB

.auPack
Size: 4KB - Virtual size: 4KB