Capcut pro activator[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Capcut pro activator.exe
Size 22.0MB
Sample250622-snbpda1ry7
SHA256 6fdf2c47dd65f10d9cc7a7f13b89d58f0e07c4ed76b525fc2ac83b9503ece12c
MD5 d469cfa9e5a751073661b4720d729894
SHA1 92b58419c613eba44095ac14fb6aa2b651feb084
SHA512 d91d1f872ce852e3c07482c6e1255e25e215d4b64cdb8c8367c9fa56893f4505d0aae9b146a09e8c7a30487bbeafdf6b7f8939dbbf2ae5257024d8237c99d82e
SSDEEP 196608:9osodFvIJvyy1R/OznIx/lqCTnuZ2hcNZvE8ZCQPAs6AHf6mn+pagO0Tf7QNW0Do:9osWhy6znI33TKdGW3PAscnE00D
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

File Explorer

Capcut pro activator.exe

.exe 22.0MB

Capcut pro activator.exe

IMPHASH 842d365e767ab6867974e4e808b02716
SHA256 6fdf2c47dd65f10d9cc7a7f13b89d58f0e07c4ed76b525fc2ac83b9503ece12c
MD5 d469cfa9e5a751073661b4720d729894
SHA1 92b58419c613eba44095ac14fb6aa2b651feb084
SHA512 d91d1f872ce852e3c07482c6e1255e25e215d4b64cdb8c8367c9fa56893f4505d0aae9b146a09e8c7a30487bbeafdf6b7f8939dbbf2ae5257024d8237c99d82e
SSDEEP 196608:9osodFvIJvyy1R/OznIx/lqCTnuZ2hcNZvE8ZCQPAs6AHf6mn+pagO0Tf7QNW0Do:9osWhy6znI33TKdGW3PAscnE00D
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect

PE Signature issue

Digest

1f:5f:df:22:ed:65:13:9f:81:2f:77:07:12:ac:8d:df:9d:80:24:02:56:f7:c1:7d:66:80:cb:00:4c:ad:cb:eb

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,OU=SYS BG-PC BU-SW RD Ctr,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 1, 2022

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

Serial Number

04:f8:6c:94:51:84:95:19:44:26:a7:cd:ac:0d:ba:3c

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 4, 2021 - May 8, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

18931

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount64 UnmapViewOfFile FreeLibrary GetModuleHandleW VirtualAlloc VirtualProtect GetProcAddress LoadResource SizeofResource LoadLibraryA FindResourceA GetCurrentProcess InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent Sleep QueryPerformanceFrequency TerminateProcess

user32

FindWindowA

ntdll

RtlDllShutdownInProgress

ucrtbase

_cexit _initterm _initterm_e terminate _callnewh malloc _seh_filter_exe _set_app_type __setusermatherr _get_narrow_winmain_command_line exit _exit _set_fmode _c_exit _register_thread_local_exe_atexit_callback _configthreadlocale _set_new_mode __p__commode free _controlfp_s _register_onexit_function _crt_atexit _libm_sse2_pow_precise _libm_sse2_log10_precise _libm_sse2_cos_precise cbrt strtol _errno _invalid_parameter_noinfo_noreturn _initialize_onexit_table _except_handler4_common __current_exception_context __current_exception memset memmove memcpy memchr __CxxFrameHandler3 _CxxThrowException __std_exception_destroy __std_exception_copy _configure_narrow_argv ceil _initialize_narrow_environment

Name

.text

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.enigma1

Size

512B

Virtual Size

14B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.enigma2

Size

512B

Virtual Size

10B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

512B

Virtual Size

15B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

512B

Virtual Size

10B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.arch

Size

512B

Virtual Size

10B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xtls

Size

512B

Virtual Size

11B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dsstext

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Capcut pro activator.exe

PE Signature issue

kernel32

user32

ntdll

ucrtbase

generic