29af9f0cebe7e163497e42a673ae11cedd7f1aa47206a1240c588b7b519b7483

Sharing

Copy URL

Twitter E-mail

General

Target

29af9f0cebe7e163497e42a673ae11cedd7f1aa47206a1240c588b7b519b7483
Size

1.4MB
MD5

4dbdd1fcd7050a9b6a235c97d32c8217
SHA1

f36968820c3c8f21c274dbe7d14e8fdc5eb258ec
SHA256

29af9f0cebe7e163497e42a673ae11cedd7f1aa47206a1240c588b7b519b7483
SHA512

ac3295b383edb57dcedd4777c1621f8845cbbcf0824638be210849768c27f19e21af593e7f3e9f079b45038cc5fabe81158bd6ef7892901e24d35e2daae02949
SSDEEP

3072:R8Em9gTPxAWrn9LM3q2t+UkNr2xPxEGYhhP7QAfDJnw9M2RINY6b6ut+22etOjMr:2viTJgDpdFjsY1WApoT0jmpt/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29af9f0cebe7e163497e42a673ae11cedd7f1aa47206a1240c588b7b519b7483

Files

29af9f0cebe7e163497e42a673ae11cedd7f1aa47206a1240c588b7b519b7483
.exe windows:6 windows x64 arch:x64

e3494364978a10d9086c8135a38f89d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\main\dva\build\mb\msvs_win32_x64\Release\x64\build\dva_mp\Audition\Audition\Adobe Audition (Beta).pdb

Imports

kernel32

FreeLibrary
GetModuleFileNameW
LoadLibraryExW
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
LoadLibraryW
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
Sleep
CreateMutexW
GetLastError
CloseHandle
GetCurrentProcess
GetCommandLineW
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSListHead

user32

IsIconic
ShowWindow
SendMessageW
SetForegroundWindow
FindWindowW

shlwapi

PathAppendW
PathRemoveFileSpecW

dvacore

?LimitedDLLHijackFix@config@dvacore@@YAXXZ
?AsciiToUTF16@string@dvacore@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@PEBD_K@Z
?Recycle@MemoryRecycler@allocator@dvacore@@YAXPEAX_K@Z
?Allocate@MemoryRecycler@allocator@dvacore@@YAPEAX_KAEA_K@Z

aubackend

?GetMainWindowClass@AppConstants@abe@@SAAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@XZ
?GetFullAppName@AppConstants@abe@@SAAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@XZ

auui

?AudWinMain@@YAHPEAUHINSTANCE__@@0AEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@H@Z
?AudWinHeadlessAppAlreadyRunning@@YA_NAEA_N0@Z

msvcp140

?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
_Mbrtowc

vcruntime140

__std_exception_destroy
memcpy
memmove
__std_terminate
__std_type_info_destroy_list
__current_exception_context
__current_exception
__C_specific_handler
_CxxThrowException
memset
__std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_c_exit
_invalid_parameter_noinfo_noreturn
_exit
_seh_filter_dll
exit
_initterm
_register_thread_local_exe_atexit_callback
_initterm_e
_configure_narrow_argv
_set_app_type
_seh_filter_exe
terminate
_cexit
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_get_narrow_winmain_command_line

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free
calloc
_set_new_mode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e3494364978a10d9086c8135a38f89d1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shlwapi

dvacore

aubackend

auui

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

Sections

.text Size: 17KB - Virtual size: 16KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.reloc Size: 512B - Virtual size: 136B

.text
Size: 17KB - Virtual size: 16KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

.reloc
Size: 512B - Virtual size: 136B