Adobe Premiere Pro[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Adobe Premiere Pro.exe
Size

3.4MB
MD5

08dbb67079fca2d1b4e6820588cff715
SHA1

ab797e6fc8e3b978057900c8b78bbab684ad3e0a
SHA256

17083015095bb57d83a7e27f2863efa20b21a599a3bbfa35fa42c1d77f3220f7
SHA512

c7e8865f5930e61fe1220e46664500732b9ce1a4638c43e4b972460a5c463fd4537cbc4411ab79d82736b8d87444bff81e42ed96dbc2c9e99304014bc9bc634c
SSDEEP

3072:m2MxljzUitNVY6dR7kSCjijyVrKBtR4ayCAAE+v7MTgqwpBoMqm0Cwifp+CIRMyT:m2MxhzU8tCFijdIGRq+

Score

1^/10

Malware Config

Signatures

Files

Adobe Premiere Pro.exe
.exe windows x64

cda62566a01f006cf45f29b8fe56d4b0

Code Sign

0f:9b:76:16:5d:55:3f:b5:ae:2e:9b:e0:e7:32:4a:24
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12-09-2017 00:00

Not After

04-09-2019 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Premiere Pro\, AME\, After Effects\, Speedgrade,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

57:f1:ac:67:2f:71:60:ba:17:a5:86:73:3f:32:1f:9b:22:36:eb:bd:f8:38:5e:5c:90:e1:c3:73:5f:70:b5:1a
Signer

Actual PE Digest

57:f1:ac:67:2f:71:60:ba:17:a5:86:73:3f:32:1f:9b:22:36:eb:bd:f8:38:5e:5c:90:e1:c3:73:5f:70:b5:1a

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Premiere Pro\, AME\, After Effects\, Speedgrade,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

21-03-2018 11:34
Valid: true

Chain 1

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Premiere Pro\, AME\, After Effects\, Speedgrade,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

prm

?Initialize@PRM@@YAXW4ApplicationType@1@PEBD111_N@Z

aslfoundation

?Create@Module@ASL@@SAHPEAUHINSTANCE__@@AEAV?$shared_ptr@VModule@ASL@@@boost@@@Z

frontend

?Run@FE@@YAHAEBV?$shared_ptr@VModule@ASL@@@boost@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$STLAllocator@_W@SmallBlockAllocator@utility@dvacore@@@std@@H@Z

dvacore

?MainExecutableFile@commondirs@filesupport@dvacore@@YA?AVFile@23@XZ
?BeginMeasurementWithLogging@GlobalTimeMeasurement@debug@dvacore@@YAXPEBD0H@Z
?FullPath@File@filesupport@dvacore@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$STLAllocator@_W@SmallBlockAllocator@utility@dvacore@@@std@@XZ
??1File@filesupport@dvacore@@QEAA@XZ
?AsciiToUTF16@utility@dvacore@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$STLAllocator@_W@SmallBlockAllocator@utility@dvacore@@@std@@PEBD_K@Z
?Dispose@SmallBlockAllocator@utility@dvacore@@YAXPEAX_K@Z
?Allocate@SmallBlockAllocator@utility@dvacore@@YAPEAX_K@Z
?SetMaxMeasurementItems@GlobalTimeMeasurement@debug@dvacore@@YAXH@Z

kernel32

OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
DecodePointer
RaiseException
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
UnhandledExceptionFilter
RtlVirtualUnwind
EnterCriticalSection
LeaveCriticalSection
CloseHandle
SetEvent
ResetEvent
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
IsDebuggerPresent

user32

UnregisterClassW

oleaut32

SysFreeString

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

vcruntime140

memcpy
__CxxFrameHandler3
_CxxThrowException
memset
__vcrt_InitializeCriticalSectionEx
__C_specific_handler
__std_type_info_destroy_list
memmove
__std_terminate

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_recalloc
free

api-ms-win-crt-runtime-l1-1-0

_exit
exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
terminate
_configure_wide_argv
_set_app_type
_errno
_invalid_parameter_noinfo
_seh_filter_exe
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_c_exit
_initialize_onexit_table

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cda62566a01f006cf45f29b8fe56d4b0

Code Sign

0f:9b:76:16:5d:55:3f:b5:ae:2e:9b:e0:e7:32:4a:24Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6Certificate

Extended Key Usages

Key Usages

57:f1:ac:67:2f:71:60:ba:17:a5:86:73:3f:32:1f:9b:22:36:eb:bd:f8:38:5e:5c:90:e1:c3:73:5f:70:b5:1aSigner

Signature Validations

Verification

21-03-2018 11:34 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

prm

aslfoundation

frontend

dvacore

kernel32

user32

oleaut32

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 13KB - Virtual size: 12KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 1KB - Virtual size: 1KB

.gfids Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 3.4MB - Virtual size: 3.4MB

0f:9b:76:16:5d:55:3f:b5:ae:2e:9b:e0:e7:32:4a:24
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

57:f1:ac:67:2f:71:60:ba:17:a5:86:73:3f:32:1f:9b:22:36:eb:bd:f8:38:5e:5c:90:e1:c3:73:5f:70:b5:1a
Signer

21-03-2018 11:34
Valid: true

.text
Size: 13KB - Virtual size: 12KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 1KB - Virtual size: 1KB

.gfids
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 3.4MB - Virtual size: 3.4MB