VueScan Pro 9.8.55 (x64) Multilingual [FileCR].zip
- SHA256 8c95efd9b5118535b84c8c4b24544cddd04d9d9c6e16fca0dd4b84baf8adf497
Password
123
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VueScan Pro 9.8.55 (x64) Multilingual [FileCR].zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
VueScan Pro 9.8.55 (x64) Multilingual [FileCR].zip
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
General
- Target VueScan Pro 9.8.55 (x64) Multilingual [FileCR].zip
- Size 59.6MB
- Sample260627-3psdmad18s
- SHA256 8c95efd9b5118535b84c8c4b24544cddd04d9d9c6e16fca0dd4b84baf8adf497
- MD5 2f9e0bad52a3e7d0bb56cda623e8ac49
- SHA1 1ac92220974afa5d514f4c7bf7012c77b59420c3
- SHA512 4184852f2b4b913f50476c37b42b0685fa346c23abc997dbc81d4d22cfead198d9aed06e285aae75980625de74fd77893c1d06b5efe0544be85161befc7d984b
- SSDEEP 1572864:Kw4ixp46Nva39QjyeIhyAUsvhKdSuKxmNvJgOPTQE:Kw4c1va3EyVzUYRummNBgO7
- TLSH T158D73348225391CF84EFEBE31C061390ECDA58A7804FD76E9CB59D1CDD931C0AE6B666
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/VueScan KeyGen v1.1.exe unpack002/VueScan x64 v9.8.50.04 Patcher v1.0.exe
File Explorer
-
VueScan Pro 9.8.55 (x64) Multilingual [FileCR].zip.zip 59.6MB
-
VueScan Pro 9.8.55 (x64) Multilingual/Patcher v1.0.zip.zip 83KB
-
ReadMe.txt478B
-
VueScan KeyGen v1.1.exe.exe 20KB
-
VueScan x64 v9.8.50.04 Patcher v1.0.exe.exe 80KB
-
VueScan Pro 9.8.55 (x64) Multilingual/vuex6498.exe.exe 59.7MB
VueScan Pro 9.8.55 (x64) Multilingual/Patcher v1.0.zip
- SHA256 101820a75ca93a75a065900a5414eb8a08683dad73169249043d783fa098bc57
- MD5 392b45abb7b8d67c2c50e3c9e3ca9a0a
- SHA1 e1f8da3a1bfae7fc54d97cdf588625708baeb891
- SHA512 5d5fdc37d5538fc24727ca9b0f114900f84449e5b08452642a255a6c9c542c1adb67fbd5b8af65e87d7b8bf00c0a75af85bf00cc8e260f10480cd5c1e3db718b
- SSDEEP 1536:7laC2fwNXfiJTrYYVLm0sf5xOG+BnuugLiHablxXwo9yv2Hi5clm6g1C2YMx/:7laFwNPifYYVLgTUBuugLiHalxXzyUiP
- TLSH T125830296E6387E08D022A2B7701228E50CEC4A24CF8CF973597E39C1A5BF979359D761
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
123
ReadMe.txt
- SHA256 68e8965cd695422895b9ffb8b5aea2dd42a3d61a57ada087a9a1a14f4f196e25
- MD5 2af96719db26f8ab76a497829e3624fc
- SHA1 c1710dea72602c644e797dffa7093dab7de1483b
- SHA512 33d825a7b8e444781df4b49fa29d74d6cd1f1e86f3b748248314fb87d9e27477a0a2ae06c40a39e19ed316b16ce351fde00b08c9b82b0b517ec2f40c6887af70
- TLSH T111F059DB9B575337334203C6467F9880FB6294DDC325411A389E161412A08E607B2EDF
- MD5 SHA1 SHA512 TLSH
VueScan KeyGen v1.1.exe
- IMPHASH 0fb3a72786eae7bf4b8332a2390f76cd
- SHA256 61196bc0fa83764e1faded3f63a5f36f4caf8d721695980f8f8057ba82a9437c
- MD5 6f043ad3e167edb6ac261374e1b8bfa8
- SHA1 8dccdbe627d70b3a56974dd3bbae58278f07b024
- SHA512 91dda6b0e2248c9c54ed9e55f36a736ea60c99b9333627a05c24c962543b1832fcd714394b13fc0ea84cb6511cc3b9e3171a1cd02cbdc21c200774f949d60934
- SSDEEP 384:uwTMhz9Mh8JmwYVwnrGcdz+xlnJaMWqGfPTO1eU5Bg:uxN9Mhmm0rbd6xbahht
- TLSH T1F7925B82ABE824D5E6B40537247BC1764D22BD654B35879F35CC3E0F3FB12D28A72A25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
5
Entry point
5040
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleHandleA
ExitProcess
GetSystemTimeAsFileTime
user32
SetDlgItemInt
IsDlgButtonChecked
GetDlgItemTextA
CheckDlgButton
SendDlgItemMessageA
SendMessageA
LoadIconA
EndDialog
DialogBoxParamA
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=12, id=1, productName=Unmarked objects,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=149, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
VueScan x64 v9.8.50.04 Patcher v1.0.exe
- IMPHASH dc73a9bd8de0fd640549c85ac4089b87
- SHA256 b48c24ac602e4adbba8533bbbce356320142202dcba05f6d5153e6fbde6e9c17
- MD5 5111ff0f448f1d2a866e0c29ba4c76ef
- SHA1 88852507749508b686800c6b5ec6b83c580b2213
- SHA512 6a628aa658b79f65e8f7ae19877d485b941cb72b7c4fb384d943af61d44726dc325da5ffa45a61a47806535b19f0d399355664465b0a8a220e7016be3f260e08
- SSDEEP 1536:WhN0rbd6++yal60VHJ5fa4A1vOTuugLiHablxXwo9yv2Hi5clm6g1C2YlYev:Who6ByMPVe51vOTuugLiHalxXzyUiUmd
- TLSH T1E783F143B9492CC5CA60643160DF04FA0E3C9C3686AD9A6B378E7DCBBFF191206B5675
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
5
Entry point
4139
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
DeleteFileA
ExitProcess
FindResourceA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
RtlMoveMemory
SizeofResource
VirtualAlloc
lstrcatA
CloseHandle
CreateFileA
FlushFileBuffers
WriteFile
Name
.text
Size
512B
Virtual Size
502B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
472B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
77KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
82B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=18, version=8444,
count=3, id=156, productName=VS2010 build 30319, version=30319,
count=17, id=1, productName=Unmarked objects,
count=1, id=158, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
VueScan Pro 9.8.55 (x64) Multilingual/vuex6498.exe
- IMPHASH 8523c511b5c63adcb06364330de1e39a
- SHA256 11a877fb9d1f21b846ca6b6e7d53bbe17c8f03ad341fcec415f0e360b09a62d1
- MD5 e0cff1f8001ad1a55bce50908ef21993
- SHA1 2577475b27e0f6ec455ccaf7f7214a0341f422a4
- SHA512 112c5422c6d14c7b22dab91e618a9c528ab89fa5944649089226edd6a4b80e36b06c88c894e5cd86f4c0d2a35eea069563bfdaf7d001ad649e9a477119fe1226
- SSDEEP 1572864:s7DS+TAPCUhi7j7YX0MP66/ZkEtbDCiv/tNaX076Uv:8DS++fk7+P66/ZtvCCtNak2G
- TLSH T1C8D733182D84CE96ED97413F96716003E0787C217A76E89F718A227CDA36B73ED34B85
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
123
Digest
4c:9f:57:5b:ef:8f:b1:9c:14:03:fb:b7:fe:2b:c4:8c:81:34:8e:34:33:3a:8e:80:a0:8c:8e:b0:de:67:d6:64
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Hamrick Software,O=Hamrick Software,L=Sunny Isles Beach,ST=Florida,C=US
Chains
Jun 13, 2026
CN=Hamrick Software,O=Hamrick Software,L=Sunny Isles Beach,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Hamrick Software,O=Hamrick Software,L=Sunny Isles Beach,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Hamrick Software,O=Hamrick Software,L=Sunny Isles Beach,ST=Florida,C=US
Serial Number
03:59:36:25:0c:a6:64:16:35:d0:2d:e6:3f:ac:64:52
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 13, 2025 - Feb 8, 2029
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
6
Entry point
31080
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
EnumDesktopWindows
MessageBoxA
GetWindowTextA
PostMessageA
advapi32
GetTokenInformation
OpenProcessToken
shell32
SHGetFolderPathW
ShellExecuteExW
SHFileOperationW
kernel32
WriteConsoleW
GetTimeZoneInformation
HeapSize
HeapReAlloc
SetFilePointerEx
FlushFileBuffers
GetProcessHeap
GetStringTypeW
CloseHandle
WaitForSingleObject
Sleep
GetCurrentProcess
CreateProcessW
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
GetFileAttributesExW
GetFullPathNameW
GetTempFileNameW
GetTempPathW
GetVersion
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
SetEnvironmentVariableW
RtlUnwindEx
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
MoveFileExW
CreateFileW
GetFileType
ReadFile
GetConsoleMode
ReadConsoleW
WriteFile
GetConsoleOutputCP
RtlUnwind
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
DeleteFileW
CreateDirectoryW
GetStdHandle
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetProcAddress
SetEndOfFile
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
HeapAlloc
VirtualProtect
LoadLibraryExW
CompareStringW
LCMapStringW
SetStdHandle
GetCurrentDirectoryW
GetFileSizeEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
Name
.text
Size
134KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=172, id=261, version=33145,
count=12, id=260, version=33145,
count=9, id=259, version=33145,
count=5, id=253, version=35403,
count=9, id=259, version=35403,
count=17, id=260, version=35403,
count=39, id=261, version=35403,
count=9, id=257, version=33145,
count=115, id=1, productName=Unmarked objects,
count=1, id=261, version=35719,
count=5, id=260, version=35719,
count=1, id=255, version=35719,
count=1, id=258, version=35719,