alexwin_install.exe

Active Library Explorer for Windows

Ericsson

The file alexwin_install.exe, “ALEX for Windows installation” has been detected as malware by 2 anti-virus scanners. The file has been seen being downloaded from cpistore.internal.ericsson.com.
Publisher:
Ericsson

Product:
Active Library Explorer for Windows

Description:
ALEX for Windows installation

Version:
17.0.0.1

MD5:
a3a9a535d8ef1b0686d8da4fe33f4542

SHA-1:
11ce46f97b71fc0a9a28969640c96caf4b91d7ae

SHA-256:
994c9c920e6c2d920ed9dd9739cdba5def93500fdbcd81f238295a79867e4b98

Scanner detections:
2 / 68

Status:
Malware

Analysis date:
1/5/2025 9:39:56 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
W32/Virut.Gen
7.11.30.172

ESET NOD32
Detection.Undefined
7.0.302.0

File size:
4.4 MB (4,590,409 bytes)

Product version:
CNAH 118 015/6 R17B

Copyright:
© Ericsson AB 1997-2015. All rights reserved.

Original file name:
Alexwin_Install.exe

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\alexwin_install.exe.mojq4vp.partial

File PE Metadata
Compilation timestamp:
5/5/2015 1:39:52 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
98304:oskkQc60Tv+0Z5ycrkUhhSgXJhviJW23aCYEXewdaSZ2pAnBq81TkX4:oL0Tv+G5hkUh8gZhW3azwQSZWwpT24

Entry address:
0x8B4C

Entry point:
E8, 5E, 67, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 51, 56, 8B, 75, 0C, 56, E8, C4, 24, 00, 00, 89, 45, 0C, 8B, 46, 0C, 59, A8, 82, 75, 17, E8, 73, 0F, 00, 00, C7, 00, 09, 00, 00, 00, 83, 4E, 0C, 20, 83, C8, FF, E9, 2F, 01, 00, 00, A8, 40, 74, 0D, E8, 58, 0F, 00, 00, C7, 00, 22, 00, 00, 00, EB, E3, 53, 33, DB, A8, 01, 74, 16, 89, 5E, 04, A8, 10, 0F, 84, 87, 00, 00, 00, 8B, 4E, 08, 83, E0, FE, 89, 0E, 89, 46, 0C, 8B, 46, 0C, 83, E0, EF, 83, C8, 02, 89, 46, 0C, 89, 5E, 04, 89, 5D, FC, A9, 0C, 01, 00...
 
[+]

Entropy:
7.6772

Code size:
71 KB (72,704 bytes)

The file alexwin_install.exe has been seen being distributed by the following URL.

Remove alexwin_install.exe - Powered by Reason Core Security