alterware-launcher-x86[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

alterware-launcher-x86.exe
Size

2.3MB
MD5

a5bed91432dbd14ab7d0d3cc66d09937
SHA1

cb67c4f37172f2d4495c852114f7fdbc111f845c
SHA256

f6e9bb9778fbf48d398a2b9f0fab7969e2e33b6a10d1d30e2a01ff3093eac8f2
SHA512

660e09802d2da6840cade0d49cec3ad7affa414701e13ad777c5668363a69efe4b1c127516d0b05e4fe5089b4071f68b1b841f1ad581943f87ea4b50c29991de
SSDEEP

24576:b6yBzvV2iAL/fhsCXZm3xRxtCAWSgxMm0BiSznTaA/Qw6CLuO8ghdWmpjfmdD73j:cX+CT0VQZAuZ11zGhLke28c

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
alterware-launcher-x86.exe

Files

alterware-launcher-x86.exe
.exe windows:6 windows x86 arch:x86

Password: infected

61fe9111452f462b30a476d0720b59a0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

alterware_launcher.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WaitOnAddress
WakeByAddressAll

ntdll

NtWriteFile
NtReadFile
NtDeviceIoControlFile
RtlNtStatusToDosError
NtCancelIoFileEx
NtCreateFile
RtlUnwind
RtlCaptureContext

kernel32

InitializeSListHead
GetSystemTimeAsFileTime
GetSystemInfo
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
GetExitCodeProcess
SetFileCompletionNotificationModes
GetStdHandle
GetConsoleMode
SetConsoleMode
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
GetFileInformationByHandleEx
GetCurrentThreadId
SetConsoleTextAttribute
GetTimeZoneInformationForYear
Sleep
GetModuleHandleA
GetProcAddress
EncodePointer
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
CreateWaitableTimerExW
QueryPerformanceCounter
ReleaseMutex
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
ExitProcess
SetFileInformationByHandle
ReadFileEx
SleepEx
CreateProcessA
GetCurrentProcessId
WriteFileEx
TerminateProcess
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
HeapFree
LocalFree
HeapReAlloc
WaitForSingleObjectEx
LoadLibraryA
lstrlenW
CreateMutexA
GetProcessHeap
HeapAlloc
FindNextFileW
FindClose
GetFileInformationByHandle
CreateDirectoryW
FindFirstFileW
MoveFileExW
GetFinalPathNameByHandleW
CopyFileExW
GetFileType
DeleteFileW
GetModuleHandleW
FormatMessageW
SetCurrentDirectoryW
CreateNamedPipeW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ReadConsoleW
CreateThread
GetFullPathNameW
GetTempPathW
WaitForSingleObject
GetCommandLineW
GetModuleFileNameW
DuplicateHandle
GetCurrentProcess
SetHandleInformation
CreateFileW
CloseHandle
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
SetWaitableTimer
RaiseException

shell32

CommandLineToArgvW
ShellExecuteExW

ole32

CoInitializeEx

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

ws2_32

connect
WSASocketW
getpeername
getsockname
ioctlsocket
shutdown
recv
send
WSASend
closesocket
getsockopt
setsockopt
WSAIoctl
WSAGetLastError
WSAStartup
WSACleanup
freeaddrinfo
getaddrinfo
bind

secur32

FreeCredentialsHandle
QueryContextAttributesW
DeleteSecurityContext
AcceptSecurityContext
InitializeSecurityContextW
FreeContextBuffer
DecryptMessage
EncryptMessage
ApplyControlToken
AcquireCredentialsHandleA

crypt32

CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
CertCloseStore
CertFreeCertificateChain
CertDuplicateCertificateChain
CertDuplicateStore
CertOpenStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertAddCertificateContextToStore

api-ms-win-crt-convert-l1-1-0

_wtoi64

api-ms-win-crt-string-l1-1-0

wcsncmp
strcpy_s

api-ms-win-crt-math-l1-1-0

__setusermatherr
truncf
trunc
ceil
pow
round

api-ms-win-crt-runtime-l1-1-0

exit
_initterm_e
_initterm
_seh_filter_exe
_get_initial_narrow_environment
_set_app_type
__p___argc
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
_initialize_narrow_environment
abort
_configure_narrow_argv
__p___argv
_exit
_register_thread_local_exe_atexit_callback
_c_exit
_initialize_onexit_table
_cexit

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

malloc
calloc
_set_new_mode
free

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 598KB - Virtual size: 598KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 106KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

61fe9111452f462b30a476d0720b59a0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

kernel32

shell32

ole32

advapi32

ws2_32

secur32

crypt32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 598KB - Virtual size: 598KB

.data Size: 5KB - Virtual size: 6KB

.rsrc Size: 106KB - Virtual size: 105KB

.reloc Size: 61KB - Virtual size: 61KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 598KB - Virtual size: 598KB

.data
Size: 5KB - Virtual size: 6KB

.rsrc
Size: 106KB - Virtual size: 105KB

.reloc
Size: 61KB - Virtual size: 61KB