adobe_licutil[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

adobe_licutil.exe
Size

2.6MB
MD5

47801795130b3b8626c8ac021d7db865
SHA1

763740ecef7ad55646133cb59f251edc2dd596c6
SHA256

9f6eb27c61d3c4636fe623fed948c371674dfbe719dd5819c48853283971bd55
SHA512

49cbee539db04d7d3bffcf0ea1748bad4c2c016028f35fdec9bf2884092a09bdbabb2c6c1fc167c4da42ceef31d12a7a22b6434ff1f96fec13ba7dbe61c1222d
SSDEEP

49152:a8AQuxMoBgC2osQdTSkXo3e+6iwGHeCtRZ3Rh64oXe2w+gebyz:QQuxaC26We+oG+YZBoc

Score

1^/10

Malware Config

Signatures

Files

adobe_licutil.exe
.exe windows:5 windows x86 arch:x86

Password: infected

778168a519a069f93b25fb49d241b898

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:d5:e3:7b:93:a5:33:d3:e2:b7:a1:40:7b:55:be:b6
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/05/2022, 00:00

Not After

01/05/2024, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Photoshop Elements\, Premier Elements\, Photoshop Express,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:8c:83:17:b2:c2:28:e2:97:e8:9f:93:7a:7d:eb:13:ba:15:c5:8e:cb:8d:15:55:8b:46:8f:2d:e9:3f:d5:65
Signer

Actual PE Digest

15:8c:83:17:b2:c2:28:e2:97:e8:9f:93:7a:7d:eb:13:ba:15:c5:8e:cb:8d:15:55:8b:46:8f:2d:e9:3f:d5:65

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

adobe_licutil.pdb

Imports

winhttp

WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpSetStatusCallback
WinHttpOpenRequest
WinHttpOpen
WinHttpReadData
WinHttpConnect
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpCloseHandle
WinHttpAddRequestHeaders
WinHttpQueryAuthSchemes
WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSetCredentials
WinHttpSendRequest

setupapi

SetupDiGetDeviceInstanceIdW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status

kernel32

DecodePointer
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GlobalFree
GetComputerNameExW
InterlockedIncrement
InterlockedDecrement
GetVersionExW
GetLocaleInfoA
SetEnvironmentVariableA
ReadFile
CreateProcessW
SetEvent
WaitForMultipleObjects
CreateEventW
GetTimeZoneInformation
OutputDebugStringA
QueryPerformanceFrequency
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateMutexW
LocalAlloc
ReleaseMutex
LocalFree
GetCurrentProcessId
GetTempPathW
GetLocalTime
GetTimeFormatW
GetDateFormatW
WriteFile
SetFilePointer
CreateFileW
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
FindClose
FindFirstFileW
FindNextFileW
GetUserDefaultLangID
GetUserDefaultUILanguage
GetModuleHandleW
ResetEvent
GetFileSizeEx
OpenMutexW
SetFileAttributesW
GetFileAttributesW
CreateDirectoryW
AreFileApisANSI
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
GetProcAddress
GetFullPathNameA
SetEndOfFile
UnlockFileEx
UnmapViewOfFile
HeapValidate
GetTempPathA
FormatMessageW
CreateSemaphoreW
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileA
DeleteFileW
GetSystemInfo
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
GetFileSize
SystemTimeToFileTime
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
GetTickCount
FlushFileBuffers
ResumeThread
CreateThread
SwitchToThread
IsDBCSLeadByteEx
GetStdHandle
GetFileType
GetModuleHandleA
GlobalMemoryStatus
FlushConsoleInputBuffer
CreateSymbolicLinkW
SetLastError
TerminateProcess
OpenProcess
MoveFileExW
CopyFileW
GetExitCodeProcess
SetErrorMode
WriteConsoleW
DuplicateHandle
CreatePipe
CreateEventA
GetModuleFileNameA
CreateProcessA
GetCommandLineA
GetTempFileNameA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetConsoleMode
SetConsoleCtrlHandler
GetModuleHandleExW
ExitProcess
TzSpecificLocalTimeToSystemTime
SetFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
CloseHandle
WaitForSingleObject
ReleaseSemaphore
Sleep
MultiByteToWideChar
LoadLibraryW
FreeLibrary
WideCharToMultiByte
GetEnvironmentVariableA
GetModuleFileNameW
ReadConsoleInputA
SetConsoleMode
SetStdHandle
GetCommandLineW
GetACP
ReadConsoleW
GetConsoleCP
GetDiskFreeSpaceA
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
GetCurrentDirectoryW
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetLastError
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
LockFile
DebugBreak
GetFileInformationByHandle
GetDriveTypeW
LoadLibraryExW
InterlockedPushEntrySList
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
WaitForSingleObjectEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
GetStringTypeW

user32

MessageBoxW
wsprintfW
GetProcessWindowStation
MessageBoxA
GetUserObjectInformationW

advapi32

ReportEventA
RegisterEventSourceA
DeregisterEventSource
RegQueryValueExA
RegOpenKeyA
RegDeleteKeyA
RegCreateKeyA
RegDeleteKeyW
SetSecurityInfo
SetNamedSecurityInfoW
GetNamedSecurityInfoW
CreateWellKnownSid
EqualSid
GetTokenInformation
OpenThreadToken
OpenProcessToken
SetSecurityDescriptorDacl
AllocateAndInitializeSid
SetEntriesInAclW
FreeSid
InitializeSecurityDescriptor
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
GetUserNameW

shell32

SHGetFolderPathW
ShellExecuteA
SHCreateDirectoryExW
SHGetKnownFolderPath
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetFolderLocation

ole32

CoTaskMemFree
CoInitialize
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance

oleaut32

SysAllocString
SysStringLen
SysAllocStringByteLen
VariantClear
SysFreeString

shlwapi

PathAppendW
PathRemoveFileSpecW
PathFindFileNameW
PathRemoveExtensionW
PathAddExtensionW
PathIsFileSpecW
PathFileExistsW
PathIsDirectoryW
PathRenameExtensionW

Exports

Exports

GetAsnVersion
IAL_ActivateLicense
IAL_CheckSubscription
IAL_CloseSession
IAL_CreateSession
IAL_DeactivateLicense
IAL_GetAULData
IAL_GetEntitledSerialData
IAL_GetEntitlementsForLEIDS
IAL_GetLEIDForSerial
IAL_GetPackagePoolData
IAL_GetPackagePools
IAL_GetSLConfigData
IAL_GetType2aOfflineException
IAL_GetVersion
IAL_SendAppUsageData
IAL_SendEnrolTrialRequest
IAL_SetCaller
IAL_SetEULAStatus
IAL_SetLicensingLEID
IAL_SetLoggingMethod
IAL_SetProxyDetails
IAL_ValidateSerial
asnInst_InstallerProductInfo_constructor
asnInst_getAsnProductInfo
asnInst_getAsnProductInfoInMem
asn_exit
asn_info
asn_init
asn_makePrivate
asn_makePrivateEx

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 493KB - Virtual size: 492KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 672B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

778168a519a069f93b25fb49d241b898

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

09:d5:e3:7b:93:a5:33:d3:e2:b7:a1:40:7b:55:be:b6Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

15:8c:83:17:b2:c2:28:e2:97:e8:9f:93:7a:7d:eb:13:ba:15:c5:8e:cb:8d:15:55:8b:46:8f:2d:e9:3f:d5:65Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

winhttp

setupapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 493KB - Virtual size: 492KB

.data Size: 26KB - Virtual size: 53KB

.gfids Size: 1024B - Virtual size: 672B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 26KB - Virtual size: 26KB

.reloc Size: 97KB - Virtual size: 97KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

09:d5:e3:7b:93:a5:33:d3:e2:b7:a1:40:7b:55:be:b6
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

15:8c:83:17:b2:c2:28:e2:97:e8:9f:93:7a:7d:eb:13:ba:15:c5:8e:cb:8d:15:55:8b:46:8f:2d:e9:3f:d5:65
Signer

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 493KB - Virtual size: 492KB

.data
Size: 26KB - Virtual size: 53KB

.gfids
Size: 1024B - Virtual size: 672B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 26KB - Virtual size: 26KB

.reloc
Size: 97KB - Virtual size: 97KB