AutoCAD_2020_Spanish_Win_64bit_r1_wi_es-ES_Setup_webinstall[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

AutoCAD_2020_Spanish_Win_64bit_r1_wi_es-ES_Setup_webinstall.exe
Size

1.1MB
MD5

be76f6ec4cb6cb99d18ee5b1a6b486b0
SHA1

be2f536a95664dcbd69f08a31995502ad98baf13
SHA256

d79f0dd6d0595bd0f1c99dc019c179ef6c489b68486cfa0d7920743b418670dd
SHA512

ab79ac1bf5249998f8d8d98e165238f1b39c9102b2208d158e8523f5c55cc38f687746f57529026d3a9fb44d5e5f0c0eea7fe6aa2b2d222f324678d8ebfe6d00
SSDEEP

24576:3tCUCBlxgBZEYCF5XaL/3Xjuy4lwqGIUKjCA:gjrxgBZEYKyj2iqGIUKOA

Score

1^/10

Malware Config

Signatures

Files

AutoCAD_2020_Spanish_Win_64bit_r1_wi_es-ES_Setup_webinstall.exe
.exe windows x86

d82d197c1086e942f90d52e00d511ab1

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:72:33:14:23:88:6b:06:cd:29:c7:dd:fc:93:50:db
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

17/01/2023, 00:00

Not After

16/01/2024, 23:59

Subject

CN=Autodesk\, Inc.,O=Autodesk\, Inc.,L=San Rafael,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a0:39:17:85:dd:4e:c9:c6:4a:1e:75:30:1f:12:47:6d:ab:e1:fe:6b:b9:a3:ba:d8:a7:fb:e1:a3:96:a8:d4:99
Signer

Actual PE Digest

a0:39:17:85:dd:4e:c9:c6:4a:1e:75:30:1f:12:47:6d:ab:e1:fe:6b:b9:a3:ba:d8:a7:fb:e1:a3:96:a8:d4:99

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Autodesk\, Inc.,O=Autodesk\, Inc.,L=San Rafael,ST=California,C=US

02/02/2023, 17:58
Valid: true

Chain 1

CN=Autodesk\, Inc.,O=Autodesk\, Inc.,L=San Rafael,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

InterlockedIncrement
LocaleNameToLCID
SetThreadLocale
SetThreadUILanguage
GetCurrentThreadId
LocalFree
SetLastError
OutputDebugStringA
OutputDebugStringW
FormatMessageW
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
FreeLibraryWhenCallbackReturns
GetThreadTimes
SwitchToThread
EnumSystemLocalesEx
IsValidLocaleName
LCMapStringEx
GetUserDefaultLocaleName
CompareStringEx
GetDateFormatEx
GetTimeFormatEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount64
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ReadConsoleW
GetTimeZoneInformation
WriteConsoleW
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetStartupInfoW
InitOnceExecuteOnce
GetFileType
AreFileApisANSI
GetModuleHandleExW
ExitProcess
GetOEMCP
InterlockedDecrement
IsValidCodePage
WriteFile
GetStdHandle
CreateTimerQueue
DeleteTimerQueueTimer
CreateTimerQueueTimer
TlsGetValue
ExitThread
CreateThread
GetCPInfo
RtlUnwind
GetCommandLineW
IsDebuggerPresent
GetLocaleInfoEx
GetSystemTimeAsFileTime
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
InterlockedExchange
EncodePointer
GetStringTypeW
GetCurrentThread
DuplicateHandle
DecodePointer
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
RaiseException
CloseThreadpoolTimer
FreeLibrary
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
SetCurrentDirectoryW
GetModuleFileNameW
GetExitCodeProcess
WaitForSingleObject
SetFilePointer
ReadFile
GetFileSize
CreateFileW
CloseHandle
CreateProcessW
ExpandEnvironmentStringsW
MulDiv
lstrcmpiW
GetProcAddress
FlushInstructionCache
GetCurrentProcess
GetModuleHandleW
lstrlenW
CompareStringW
GetVersionExW
HeapFree
GetProcessHeap
HeapAlloc
UnregisterWaitEx
ChangeTimerQueueTimer
GetNumaHighestNodeNumber
RegisterWaitForSingleObject
SetStdHandle
Sleep
WideCharToMultiByte
GetLastError
FindResourceExW
InterlockedPushEntrySList
InterlockedPopEntrySList
CreateProcessA
GetFileAttributesExW
SetEnvironmentVariableW
InitializeSListHead
TlsSetValue
InterlockedCompareExchange
InitializeCriticalSectionEx
HeapSize
FindResourceW
LoadResource
HeapReAlloc
HeapDestroy
LockResource
SizeofResource
MultiByteToWideChar
TlsFree
TlsAlloc
GetACP
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
FreeLibraryAndExitThread
GetModuleHandleA
SetEvent
CreateEventW
RemoveDirectoryW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
DeviceIoControl
DeleteFileW
MoveFileW
SetFileAttributesW
GetVolumeInformationW
GetDiskFreeSpaceExW
GetDriveTypeW
SetFileTime
CreateDirectoryW
ResetEvent
CreateSemaphoreW
InitializeCriticalSection
GetFileAttributesW
SetThreadPriority
GetCurrentProcessorNumber
GetTickCount
GetLogicalProcessorInformation
GetProcessAffinityMask
SetThreadAffinityMask
ReleaseSemaphore
CreateSemaphoreExW
InterlockedFlushSList
GetSystemTime
TzSpecificLocalTimeToSystemTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FileTimeToLocalFileTime
SetPriorityClass
GetCurrentProcessId
SetConsoleMode
FindNextFileW
FindFirstFileW
FindClose
GetCurrentDirectoryW
GetFullPathNameW
IsDBCSLeadByte
SignalObjectAndWait
FlushProcessWriteBuffers
SetEndOfFile
SetEnvironmentVariableA
UnregisterWait
GetThreadPriority
QueryDepthSList

user32

GetDlgItem
SetWindowTextW
GetParent
IsWindow
DrawTextW
UnregisterClassW
SendMessageW
CharLowerW
CharUpperW
OemToCharA
CharToOemA
MessageBeep
OffsetRect
GetWindowRect
ReleaseDC
OemToCharBuffA
CharToOemBuffW
IsRectEmpty
CreateDialogParamW
DialogBoxParamW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadIconW
GetDesktopWindow
MessageBoxW
SetRectEmpty
FillRect
IsWindowEnabled
GetSysColor
GetFocus
DrawFocusRect
SetFocus
SetCapture
GetCapture
ReleaseCapture
GetDlgCtrlID
GetCursorPos
ScreenToClient
PtInRect
UpdateWindow
GetActiveWindow
ShowWindow
PostMessageW
GetClassLongW
InflateRect
BringWindowToTop
GetSystemMetrics
CallWindowProcW
SetCursor
InvalidateRect
GetWindowDC
CopyRect
DefWindowProcW
EndDialog
GetClassNameW
LoadCursorW
SystemParametersInfoW
CreateWindowExW
GetWindowTextLengthW
GetWindowTextW
CharNextW
SetWindowLongW
DestroyWindow
EndPaint
BeginPaint
GetWindow
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
SetWindowPos
GetDC
GetClientRect
GetWindowLongW

gdi32

ExtTextOutW
SetBkColor
CombineRgn
CreateRectRgnIndirect
ExcludeClipRect
SetBkMode
SetTextColor
GetTextMetricsW
DPtoLP
GetDeviceCaps
GetStockObject
SelectObject
GetObjectW
DeleteObject
DeleteDC
CreateFontIndirectW

advapi32

CredWriteW
RegCloseKey
RegOpenKeyExW
SetFileSecurityW
CryptGetHashParam
CryptAcquireContextW
CryptReleaseContext
CryptCreateHash
CryptDestroyHash
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
CredFree
CredReadW
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
CryptHashData

shell32

CommandLineToArgvW
SHFileOperationW
ShellExecuteW
ShellExecuteExW
SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListW

ole32

CreateStreamOnHGlobal
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc

oleaut32

VarUI4FromStr

shlwapi

PathRemoveFileSpecW
PathAppendW
PathFileExistsW
PathCanonicalizeW

comctl32

_TrackMouseEvent

wintrust

WinVerifyTrust

crypt32

CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CryptMsgClose
CryptQueryObject

winhttp

WinHttpGetProxyForUrl
WinHttpSetOption
WinHttpGetDefaultProxyConfiguration
WinHttpCloseHandle
WinHttpOpen
WinHttpCrackUrl
WinHttpConnect
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryAuthSchemes
WinHttpSetCredentials
WinHttpGetIEProxyConfigForCurrentUser

bcrypt

BCryptDestroyKey
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptSetProperty
BCryptGenerateSymmetricKey
BCryptDecrypt

uxtheme

OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeInt
BufferedPaintInit
BufferedPaintUnInit
BeginBufferedPaint
EndBufferedPaint
EnableThemeDialogTexture

dwmapi

DwmExtendFrameIntoClientArea
DwmIsCompositionEnabled

gdiplus

GdipDeleteStringFormat
GdipCreateStringFormat
GdipDrawImageRect
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipSetStringFormatAlign
GdipAlloc
GdipSetStringFormatTrimming
GdipDeleteFont
GdipDrawImageRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdipSetStringFormatLineAlign
GdipCreateBitmapFromGraphics
GdipSetStringFormatHotkeyPrefix
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipMeasureString
GdipCreateSolidFill
GdipDeleteBrush
GdipDrawString
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipCreateFontFromDC
GdipCreatePath
GdipAddPathLineI
GdipAddPathArcI
GdipFillPath
GdipCreatePen1
GdipDeletePen
GdipDrawPath
GdipDeletePath
GdipCreateBitmapFromStream
GdipGetDpiX
GdipGetDpiY
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdiplusShutdown
GdiplusStartup
GdipFree

credui

CredUIPromptForCredentialsW
CredUIParseUserNameW

Exports

Exports

url_auth_version
urlauth_gen_URL
urlauth_gen_token

Sections

.text
Size: 781KB - Virtual size: 780KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d82d197c1086e942f90d52e00d511ab1

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

04:72:33:14:23:88:6b:06:cd:29:c7:dd:fc:93:50:dbCertificate

Extended Key Usages

Key Usages

a0:39:17:85:dd:4e:c9:c6:4a:1e:75:30:1f:12:47:6d:ab:e1:fe:6b:b9:a3:ba:d8:a7:fb:e1:a3:96:a8:d4:99Signer

Signature Validations

Verification

02/02/2023, 17:58 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

wintrust

crypt32

winhttp

bcrypt

uxtheme

dwmapi

gdiplus

credui

Exports

Exports

Sections

.text Size: 781KB - Virtual size: 780KB

.rdata Size: 138KB - Virtual size: 138KB

.data Size: 21KB - Virtual size: 108KB

.rsrc Size: 81KB - Virtual size: 81KB

.reloc Size: 87KB - Virtual size: 86KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

04:72:33:14:23:88:6b:06:cd:29:c7:dd:fc:93:50:db
Certificate

a0:39:17:85:dd:4e:c9:c6:4a:1e:75:30:1f:12:47:6d:ab:e1:fe:6b:b9:a3:ba:d8:a7:fb:e1:a3:96:a8:d4:99
Signer

02/02/2023, 17:58
Valid: true

.text
Size: 781KB - Virtual size: 780KB

.rdata
Size: 138KB - Virtual size: 138KB

.data
Size: 21KB - Virtual size: 108KB

.rsrc
Size: 81KB - Virtual size: 81KB

.reloc
Size: 87KB - Virtual size: 86KB