MAXON-Inst[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

MAXON-Inst.exe
Size

8.0MB
MD5

7629cb37c6bc4456ba1eecf791041139
SHA1

7d65ddeaf9619f28ba9feaadceb55393577519fc
SHA256

12139b11ec805f9a8059473c4fce19452b42bae356c21c63d7d0096125d42541
SHA512

7d3ba64db525341bf86f7e6c2660e5addc7ab6de584057eb94a951f717603bebc21083e4ee923a59a9d46bc1ceb31bdc59bb3e21cdf136b2b48c7e639319e95c
SSDEEP

49152:jjJUk0+KEpNteU26MyDJa8RLy3GL3UIColOrSOegXL5ZjGvhKmbmSCC8uR62yZAB:s30CzSSIhq7Af6aC1W53aF2YYJg/A

Score

1^/10

Malware Config

Signatures

Files

MAXON-Inst.exe
.exe windows:6 windows x64 arch:x64

a519b3db192a1b0badd7803871b7ebea

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5d:5d:8d:bf:75:68:b5:f5:84:7f:c6:22:ee:71:b1:ca
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

30/05/2018, 00:00

Not After

07/07/2021, 23:59

Subject

CN=MAXON Computer GmbH,OU=SOFTWARE DEVELOPMENT,O=MAXON Computer GmbH,L=Friedrichsdorf,ST=Hessen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:5d:8d:bf:75:68:b5:f5:84:7f:c6:22:ee:71:b1:ca
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

30/05/2018, 00:00

Not After

07/07/2021, 23:59

Subject

CN=MAXON Computer GmbH,OU=SOFTWARE DEVELOPMENT,O=MAXON Computer GmbH,L=Friedrichsdorf,ST=Hessen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4e:5e:30:94:29:e9:09:c3:06:ad:f0:1c:5f:ed:7e:5d:af:07:84:c7:7e:4f:7b:89:95:92:c6:b6:b1:69:b1:47
Signer

Actual PE Digest

4e:5e:30:94:29:e9:09:c3:06:ad:f0:1c:5f:ed:7e:5d:af:07:84:c7:7e:4f:7b:89:95:92:c6:b6:b1:69:b1:47

Digest Algorithm

sha256

PE Digest Matches

true

86:46:a2:ac:2d:d8:21:e3:1a:70:6d:2c:fb:cf:b5:3d:1d:24:4c:ac
Signer

Actual PE Digest

86:46:a2:ac:2d:d8:21:e3:1a:70:6d:2c:fb:cf:b5:3d:1d:24:4c:ac

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

p:\c4d_perforce_work\release\20.0_dev_installer\application\project\_obj\application\x64_Intel\application_Intel_64bit.pdb

Imports

imagehlp

UnDecorateSymbolName
ImageUnload
ImageLoad
SymCleanup
SymGetSymFromAddr64
SymInitialize

psapi

GetModuleFileNameExW
EnumProcessModules
GetProcessMemoryInfo

rpcrt4

UuidToStringA
UuidCreate
UuidFromStringA
RpcStringFreeA

kernel32

SetEvent
CreateEventW
GetCurrentThreadId
GetModuleFileNameW
TerminateProcess
Sleep
GetExitCodeProcess
GetLocalTime
DeleteFileW
LocalFree
GetCommandLineW
IsDebuggerPresent
OutputDebugStringA
RtlCaptureStackBackTrace
GetEnvironmentStringsW
lstrcmpA
GetCurrentProcess
TlsGetValue
VirtualProtect
VirtualAlloc
GetSystemInfo
WideCharToMultiByte
MultiByteToWideChar
SetConsoleOutputCP
SetConsoleCP
SetConsoleMode
SetConsoleCtrlHandler
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetConsoleWindow
GetConsoleScreenBufferInfo
SetConsoleTitleW
AllocConsole
AttachConsole
GetStartupInfoW
OutputDebugStringW
ReadConsoleA
DuplicateHandle
GetCurrentThread
TlsSetValue
TlsAlloc
TlsFree
OpenProcess
GetCurrentProcessId
GlobalMemoryStatusEx
GetComputerNameW
GetProductInfo
GetNativeSystemInfo
GetTempPathW
ExpandEnvironmentStringsW
IsWow64Process
FindFirstFileW
FindClose
FindNextFileW
LocalAlloc
FormatMessageW
GetLogicalDriveStringsW
GetVolumeInformationW
SetThreadErrorMode
WaitForSingleObject
CreateThread
CloseHandle
Thread32First
Thread32Next
ResumeThread
SetThreadContext
GetThreadContext
SuspendThread
OpenThread
SetDllDirectoryW
RemoveDllDirectory
VerifyVersionInfoW
VerSetConditionMask
AddDllDirectory
SetDefaultDllDirectories
FreeLibrary
GetFileAttributesW
FileTimeToSystemTime
GetFileTime
CreateFileW
GetFinalPathNameByHandleW
SetFileTime
RemoveDirectoryW
SetFileAttributesW
CreateDirectoryW
CopyFileW
MoveFileExW
DisconnectNamedPipe
PeekNamedPipe
ReadFile
ConnectNamedPipe
WriteFile
CreateNamedPipeW
CreatePipe
CreateProcessW
GetProcessId
Process32FirstW
Process32NextW
QueryFullProcessImageNameW
WaitForMultipleObjects
GetUserPreferredUILanguages
FlsAlloc
FlsSetValue
FlsFree
SetThreadPriority
RaiseException
SetProcessPriorityBoost
CreateTimerQueue
CreateTimerQueueTimer
DeleteTimerQueueTimer
QueryPerformanceCounter
QueryPerformanceFrequency
DeleteTimerQueue
SwitchToThread
DeleteCriticalSection
WakeConditionVariable
WakeAllConditionVariable
LeaveCriticalSection
EnterCriticalSection
InitializeConditionVariable
InitializeCriticalSection
ResetEvent
SleepConditionVariableCS
GetLastError
GetConsoleTitleW
GetStdHandle
GetEnvironmentVariableA
GetConsoleMode
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
FormatMessageA
LoadLibraryA
GetThreadLocale
LoadLibraryExA
GetModuleHandleExA
CreateToolhelp32Snapshot

user32

SetTimer
KillTimer
PostThreadMessageW
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
MonitorFromWindow
GetSystemMetrics

advapi32

RegOpenKeyExW
SetServiceObjectSecurity
CloseServiceHandle
OpenServiceW
DeleteService
StartServiceW
StartServiceCtrlDispatcherW
ControlService
SetServiceStatus
RegisterServiceCtrlHandlerW
CreateServiceW
OpenSCManagerW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetUserNameW
RegCloseKey
RegQueryValueExW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
ChangeServiceConfig2W

shell32

ShellExecuteExW
SHGetDiskFreeSpaceExW
ShellExecuteW
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathA
CommandLineToArgvW
SHGetFolderPathW

ole32

OleUninitialize
CoUninitialize
CoInitializeEx
CoTaskMemFree
OleInitialize

oleaut32

VariantClear
VariantTimeToSystemTime

msvcp140

_Mtx_init_in_situ
_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
_Mtx_destroy_in_situ

libmmd

floor

vcruntime140

memcpy
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memset
__vcrt_InitializeCriticalSectionEx
__C_specific_handler
wcsstr
_purecall
__CxxFrameHandler3
strstr
memmove

api-ms-win-crt-string-l1-1-0

tolower
strncpy
islower
strlen
toupper
_wcsicmp
wcslen
wcscmp
wcscpy
wcscpy_s
wcscat
strncat
strcat_s
_wcslwr
wcsncpy

api-ms-win-crt-heap-l1-1-0

calloc
_set_new_mode
realloc
malloc
free
_callnewh

api-ms-win-crt-stdio-l1-1-0

fwrite
feof
setvbuf
_close
setbuf
_wfdopen
_wsopen_s
_fseeki64
fflush
fputs
_ftelli64
fopen
_set_fmode
freopen
fclose
__stdio_common_vfwprintf
_wfopen
_getcwd
fseek
__stdio_common_vswprintf_s
__stdio_common_vfprintf
ftell
fread
__acrt_iob_func
__stdio_common_vsscanf
__stdio_common_vswprintf
__stdio_common_vsprintf
__stdio_common_vfscanf
__p__commode

api-ms-win-crt-runtime-l1-1-0

_c_exit
terminate
_seh_filter_exe
_set_app_type
_beginthread
_register_onexit_function
_initialize_onexit_table
_crt_atexit
_configure_narrow_argv
_clearfp
_controlfp
_get_narrow_winmain_command_line
_exit
exit
_initialize_narrow_environment
_initterm_e
_register_thread_local_exe_atexit_callback
strerror
_errno
_cexit
_initterm

api-ms-win-crt-time-l1-1-0

_tzset
_time64
_gmtime64_s
_localtime64_s
strftime

api-ms-win-crt-filesystem-l1-1-0

_wrename

api-ms-win-crt-math-l1-1-0

_fdtest
_dtest
__setusermatherr

api-ms-win-crt-convert-l1-1-0

atol
strtod
wcstombs

api-ms-win-crt-environment-l1-1-0

_wgetenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

ServiceHandler
ServiceMain
g_CpuYieldDelegate
g_privateBinary

Sections

.text
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1007KB - Virtual size: 1006KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 166KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 428KB - Virtual size: 428KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data1
Size: 478KB - Virtual size: 477KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a519b3db192a1b0badd7803871b7ebea

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

5d:5d:8d:bf:75:68:b5:f5:84:7f:c6:22:ee:71:b1:caCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

5d:5d:8d:bf:75:68:b5:f5:84:7f:c6:22:ee:71:b1:caCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

4e:5e:30:94:29:e9:09:c3:06:ad:f0:1c:5f:ed:7e:5d:af:07:84:c7:7e:4f:7b:89:95:92:c6:b6:b1:69:b1:47Signer

86:46:a2:ac:2d:d8:21:e3:1a:70:6d:2c:fb:cf:b5:3d:1d:24:4c:acSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

imagehlp

psapi

rpcrt4

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp140

libmmd

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 5.8MB - Virtual size: 5.8MB

.rdata Size: 1007KB - Virtual size: 1006KB

.data Size: 166KB - Virtual size: 1.1MB

.pdata Size: 428KB - Virtual size: 428KB

.data1 Size: 478KB - Virtual size: 477KB

.tls Size: 512B - Virtual size: 13B

.gfids Size: 512B - Virtual size: 64B

_RDATA Size: 4KB - Virtual size: 4KB

.rsrc Size: 180KB - Virtual size: 180KB

.reloc Size: 34KB - Virtual size: 33KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

5d:5d:8d:bf:75:68:b5:f5:84:7f:c6:22:ee:71:b1:ca
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

5d:5d:8d:bf:75:68:b5:f5:84:7f:c6:22:ee:71:b1:ca
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

4e:5e:30:94:29:e9:09:c3:06:ad:f0:1c:5f:ed:7e:5d:af:07:84:c7:7e:4f:7b:89:95:92:c6:b6:b1:69:b1:47
Signer

86:46:a2:ac:2d:d8:21:e3:1a:70:6d:2c:fb:cf:b5:3d:1d:24:4c:ac
Signer

.text
Size: 5.8MB - Virtual size: 5.8MB

.rdata
Size: 1007KB - Virtual size: 1006KB

.data
Size: 166KB - Virtual size: 1.1MB

.pdata
Size: 428KB - Virtual size: 428KB

.data1
Size: 478KB - Virtual size: 477KB

.tls
Size: 512B - Virtual size: 13B

.gfids
Size: 512B - Virtual size: 64B

_RDATA
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 180KB - Virtual size: 180KB

.reloc
Size: 34KB - Virtual size: 33KB