Trapcode Suite 15[.]1[.]8 Installer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Trapcode Suite 15.1.8 Installer.exe
Size

2.8MB
MD5

7117317ddc4389ce0d606d7b55d4546b
SHA1

35a33b82b93289cd0a0f4fb555e55c2849c6c8d9
SHA256

ecb04647c56d501be44aa29d36a8eeeea2c69250b60f27391c278f7cb8498dff
SHA512

2c81956a4b5a45e0d2485926f2cf42b312b1d3ffda60f0bb8247cfd104f07ebe42aab09050cd58e7952c0e22a67e2d7624b020baac2f55aea74b39619ae1cbf7
SSDEEP

49152:13EDU8KjssVJOQ/6EuVAbLTKENRMOPLXj4A0oE+/WWQy88G4YWsyc9LAl:p/fDVLq2B7v4A0oE+/dV7YV9LS

Score

1^/10

Malware Config

Signatures

Files

Trapcode Suite 15.1.8 Installer.exe
.exe windows:6 windows x64 arch:x64

e78e7845ad6206484e571031bc19d9cf

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

a4:23:c0:04:a9:c7:70:15:42:30:e5:d2:71:be:06:54
Certificate

Issuer

CN=SecureTrust CA,O=SecureTrust Corporation,C=US

Not Before

01/09/2016, 14:35

Not After

29/09/2024, 14:35

Subject

CN=Trustwave Code Signing SHA256 CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US,1.2.840.113549.1.9.1=#0c106361407472757374776176652e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:e5:84:f3:17:94:20:73:5d:88:7d:8e:11:5a:6c:3e:36:af:69
Certificate

Issuer

CN=Trustwave Code Signing SHA256 CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US,1.2.840.113549.1.9.1=#0c106361407472757374776176652e636f6d

Not Before

26/09/2018, 11:50

Not After

25/09/2020, 17:50

Subject

CN=Red Giant LLC,O=Red Giant LLC,L=Beaverton,ST=Oregon,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7f:47:72:81:da:1d:57:ac:23:16:7a:92:b7:30:f0:9d:03:25:1f:49
Signer

Actual PE Digest

7f:47:72:81:da:1d:57:ac:23:16:7a:92:b7:30:f0:9d:03:25:1f:49

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Jenkins\jobs\TrapcodeSuite_Installer_Win\workspace\stage\Trapcode Suite Installer.pdb

Imports

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

kernel32

CreateDirectoryW
CreateFileW
LocalFree
FreeLibrary
lstrcmpiW
FindResourceW
LoadLibraryExW
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FindClose
FindFirstFileA
FindNextFileA
OutputDebugStringA
lstrcpyA
lstrcatA
lstrlenA
SetThreadpoolTimer
CreateThreadpoolTimer
FreeLibraryWhenCallbackReturns
GetThreadTimes
SwitchToThread
OutputDebugStringW
EnumSystemLocalesEx
IsValidLocaleName
LCMapStringEx
CompareStringEx
GetDateFormatEx
GetTimeFormatEx
MoveFileExW
RaiseException
GetEnvironmentStringsW
GetTickCount64
HeapReAlloc
SetEnvironmentVariableA
SetStdHandle
FileTimeToSystemTime
GetDriveTypeW
FindFirstFileExW
FileTimeToLocalFileTime
DeleteFileW
SizeofResource
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetConsoleCP
GetOEMCP
GetACP
IsValidCodePage
SetFilePointerEx
SetFilePointer
GetStartupInfoW
InitOnceExecuteOnce
GetFileType
GetStdHandle
HeapSize
CreateTimerQueue
DeleteTimerQueueTimer
CreateTimerQueueTimer
ExitThread
CreateThread
GetSystemDefaultLocaleName
SetLastError
GetVersionExW
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
GetModuleHandleW
GetCurrentDirectoryA
GetModuleHandleA
GetModuleFileNameA
LockResource
FreeEnvironmentStringsW
LoadResource
FreeResource
FindResourceA
GetUserDefaultLocaleName
SetEvent
CreateEventA
CreatePipe
GetEnvironmentVariableA
CreateProcessA
WaitForSingleObject
SetHandleInformation
QueryPerformanceCounter
DeleteCriticalSection
EnterCriticalSection
GetProcAddress
GetCurrentDirectoryW
LeaveCriticalSection
GetFileAttributesA
LoadLibraryW
InitializeCriticalSection
SetNamedPipeHandleState
GetLastError
ReadFile
Sleep
WaitForThreadpoolTimerCallbacks
WriteFile
GetProcessHeap
HeapFree
WaitNamedPipeA
HeapAlloc
CreateFileA
RemoveDirectoryA
MultiByteToWideChar
WideCharToMultiByte
K32GetModuleFileNameExA
K32EnumProcessModules
K32EnumProcesses
GetCPInfo
GetTimeZoneInformation
RtlUnwindEx
RtlLookupFunctionEntry
ResumeThread
ResetEvent
OpenEventA
FormatMessageA
CopyFileW
CreateDirectoryExW
RtlPcToFileHeader
GetCommandLineW
AreFileApisANSI
CloseHandle
GetExitCodeProcess
DeviceIoControl
GetFileAttributesW
FindNextFileW
OpenProcess
FlushFileBuffers
GetModuleHandleExW
ExitProcess
ReadConsoleW
GetConsoleMode
FindFirstFileW
SignalObjectAndWait
FlushProcessWriteBuffers
UnregisterWait
GetThreadPriority
GetFileAttributesExW
SetEndOfFile
GetFullPathNameW
PeekNamedPipe
GetFileInformationByHandle
WriteConsoleW
RegisterWaitForSingleObject
GetNumaHighestNodeNumber
ChangeTimerQueueTimer
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
CreateSemaphoreExW
ReleaseSemaphore
SetThreadAffinityMask
GetProcessAffinityMask
GetLogicalProcessorInformation
GetTickCount
GetCurrentProcessorNumber
SetThreadPriority
CreateEventW
FreeLibraryAndExitThread
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
InitializeCriticalSectionEx
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
VirtualAlloc
VirtualFree
DecodePointer
DuplicateHandle
GetCurrentThread
GetExitCodeThread
EncodePointer
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
GetLocaleInfoEx
GetStringTypeW
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent

user32

PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CharNextW
SetTimer
EnableWindow
MessageBeep
MessageBoxA
LoadCursorW
GetClassInfoExW
RegisterClassExW
GetActiveWindow
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
UnregisterClassW
MapWindowPoints
SetWindowPos
SendMessageA
RedrawWindow
CreateWindowExW
ShowWindow
GetWindow
GetTopWindow
MoveWindow
KillTimer
GetWindowRect
PostQuitMessage
DestroyWindow
LoadIconW
CallWindowProcW
GetWindowLongPtrW
SetWindowLongPtrW
DefWindowProcW
EndPaint
BeginPaint
SetRect
SendMessageW
LoadBitmapW
FillRect
DrawTextA
CopyRect
IsWindowEnabled
InvalidateRect
GetClientRect
SendMessageTimeoutA
GetParent

gdi32

DeleteDC
CreateFontIndirectA
CreateSolidBrush
BitBlt
GetObjectW
DeleteObject
CreateCompatibleDC
SetTextColor
SetBkColor
SelectObject
SetBkMode

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

FreeSid
OpenProcessToken
GetTokenInformation
RegCreateKeyExA
RegOpenKeyExA
RegGetValueA
RegEnumKeyExA
RegSetValueExA
ReportEventA
RegisterEventSourceA
DeregisterEventSource
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
SetSecurityInfo
SetEntriesInAclW
AllocateAndInitializeSid
GetSecurityInfo
CloseServiceHandle
OpenServiceA
OpenSCManagerW
GetUserNameA
RegSetKeyValueA
RegCloseKey

shell32

SHGetFolderPathA
ShellExecuteA

ole32

CoTaskMemRealloc
CoTaskMemFree
CoInitialize
CoCreateInstance
OleInitialize
OleUninitialize
CoTaskMemAlloc

oleaut32

VarUI4FromStr

comctl32

InitCommonControlsEx

rpcrt4

UuidToStringA
UuidCreate
RpcStringFreeA

gdiplus

GdipDeletePath
GdipCreatePath
GdipSetPenMode
GdipFillPath
GdipCreatePen1
GdipResetPath
GdipCloneBrush
GdipDeleteBrush
GdipAlloc
GdipFree
GdipClosePathFigure
GdipFillRectangleI
GdipAddPathArcI
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetPageUnit
GdipDrawPath
GdipCreateSolidFill
GdiplusShutdown
GdiplusStartup
GdipDeletePen

ws2_32

gethostbyname
gethostbyaddr
socket
WSAStartup
inet_addr
htons
closesocket
WSACleanup
WSAGetLastError
sendto

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 377KB - Virtual size: 377KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 45KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e78e7845ad6206484e571031bc19d9cf

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

a4:23:c0:04:a9:c7:70:15:42:30:e5:d2:71:be:06:54Certificate

Extended Key Usages

Key Usages

06:e5:84:f3:17:94:20:73:5d:88:7d:8e:11:5a:6c:3e:36:af:69Certificate

Extended Key Usages

Key Usages

7f:47:72:81:da:1d:57:ac:23:16:7a:92:b7:30:f0:9d:03:25:1f:49Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

rpcrt4

gdiplus

ws2_32

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 377KB - Virtual size: 377KB

.data Size: 45KB - Virtual size: 80KB

.pdata Size: 69KB - Virtual size: 68KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 29KB - Virtual size: 29KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

a4:23:c0:04:a9:c7:70:15:42:30:e5:d2:71:be:06:54
Certificate

06:e5:84:f3:17:94:20:73:5d:88:7d:8e:11:5a:6c:3e:36:af:69
Certificate

7f:47:72:81:da:1d:57:ac:23:16:7a:92:b7:30:f0:9d:03:25:1f:49
Signer

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 377KB - Virtual size: 377KB

.data
Size: 45KB - Virtual size: 80KB

.pdata
Size: 69KB - Virtual size: 68KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 29KB - Virtual size: 29KB