4bde6f753437374009eddd10329fe53b327e13ef2f8e1f2fde2969379a151630

Sharing

Copy URL Twitter E-mail

General

Target

4bde6f753437374009eddd10329fe53b327e13ef2f8e1f2fde2969379a151630
Size

67KB
MD5

2ed8dc55c616520ea61a73a876f74d67
SHA1

ea733c53171a0a6e4714a962ca7bc18be195559d
SHA256

4bde6f753437374009eddd10329fe53b327e13ef2f8e1f2fde2969379a151630
SHA512

fc9ad531cb69b9f5b21c34fc704f8cdc466afaf08a0ba34f162a4debba07484921ff1d22eae78bee0f38dcb48bfe7f03de67c2bddc99d9460e7522906700bb3c
SSDEEP

768:t9YsyPeX+1DAyDGZYUO2wYWe+koHjO+koHjNIU3whx:uGXsLDI3O2Ye+koHjO+koHjNPghx

Score

1^/10

Malware Config

Signatures

Files

4bde6f753437374009eddd10329fe53b327e13ef2f8e1f2fde2969379a151630
.exe windows:6 windows x64 arch:x64

7238c9a349c1f521b9c84193f68b04a2

Code Sign

08:cf:d6:15:68:9d:9f:16:8f:01:b6:bc:b3:06:36:11
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/09/2017, 00:00

Not After

04/09/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=RoboHelp\, FrameMaker\, Captivate\, Contribute,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

f7:71:ac:c5:af:12:6b:5a:10:fd:13:27:85:55:f3:59:55:92:77:e8:18:e9:68:50:7b:d6:ba:7b:f0:85:0c:36
Signer

Actual PE Digest

f7:71:ac:c5:af:12:6b:5a:10:fd:13:27:85:55:f3:59:55:92:77:e8:18:e9:68:50:7b:d6:ba:7b:f0:85:0c:36

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Stage12_1\captivate\lecture_capture\12.1\dev\build\win\Release64\Adobe-Pr-VC.pdb

Imports

lecturecaptureuicore

?CPLCMainEntry@@YA?AW4CPErrorCodeEnum@@AEBVCPString@@AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@PEAVICPLCCmdUIBase@@@Z

cppublic

??0CPString@@QEAA@PEB_W@Z
?gCPLogger@@3PEAVCPLogger@@EA
?GetUTF8String@CPString@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??1CPString@@QEAA@XZ

cefhelper

?getInstance@PVXCefHelper@@SAPEAV1@XZ
?isMainBrowserProcess@PVXCefHelper@@QEAAHPEAUHINSTANCE__@@@Z
?initialize@PVXCefHelper@@QEAA_NXZ
?shutdown@PVXCefHelper@@QEAAXXZ

kernel32

GetCurrentProcessId
OutputDebugStringW
GetCommandLineW
InitializeCriticalSectionEx
GetLastError
DecodePointer
DeleteCriticalSection
QueryPerformanceCounter
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCurrentThreadId
EncodePointer
IsDebuggerPresent

shell32

CommandLineToArgvW

msvcp120

?_Syserror_map@std@@YAPEBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Winerror_map@std@@YAPEBDH@Z

msvcr120

memset
??2@YAPEAX_K@Z
_lock
_unlock
_calloc_crt
__dllonexit
__C_specific_handler
_onexit
_XcptFilter
__crtGetShowWindowMode
_amsg_exit
__wgetmainargs
__set_app_type
exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_wcmdln
_fmode
_commode
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCapturePreviousContext
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crtSetUnhandledExceptionFilter
_purecall
free
memmove
??3@YAXPEAX@Z
_exit
_CxxThrowException
__CxxFrameHandler3
memcpy

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7238c9a349c1f521b9c84193f68b04a2

Code Sign

08:cf:d6:15:68:9d:9f:16:8f:01:b6:bc:b3:06:36:11Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6Certificate

Extended Key Usages

Key Usages

f7:71:ac:c5:af:12:6b:5a:10:fd:13:27:85:55:f3:59:55:92:77:e8:18:e9:68:50:7b:d6:ba:7b:f0:85:0c:36Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

lecturecaptureuicore

cppublic

cefhelper

kernel32

shell32

msvcp120

msvcr120

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 876B

.rsrc Size: 41KB - Virtual size: 41KB

.reloc Size: 512B - Virtual size: 116B

08:cf:d6:15:68:9d:9f:16:8f:01:b6:bc:b3:06:36:11
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

f7:71:ac:c5:af:12:6b:5a:10:fd:13:27:85:55:f3:59:55:92:77:e8:18:e9:68:50:7b:d6:ba:7b:f0:85:0c:36
Signer

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 876B

.rsrc
Size: 41KB - Virtual size: 41KB

.reloc
Size: 512B - Virtual size: 116B