SodaMusic-v3[.]2[.]1-official-win32_x64_exe

Sharing

Copy URL Twitter E-mail

General

Target
SodaMusic-v3.2.1-official-win32_x64_exe
Size 155.5MB
Sample260629-hayxmsgz2p
SHA256 ed838d996c985bbd3f091e33ea2242a9e217c3032828f92e44030932ece4b2d9
MD5 87f07358b7ed705080514d532f8a4e35
SHA1 3c29d768d7ceae5065da4a06e0899c087750a0b0
SHA512 19d2cc2244cd436a4ad06702db90e298bdbdb784273e0d11389510538005c96b0a32b5b4a4506510b1df3bb859e656fa0ca8b8f54784a98f6c24779acd81efdc
SSDEEP 3145728:h0FlQWBz4z0wyYZThz8h66B9+QnrGZZjxocJVZpkgffGdaZ8kmPQWxtiz4kDsEhh:OVMzmY/C6sabjmcTZpkg3GdPjPvtIsEX
TLSH
T18E7833C80E96EB45D4B942B37484E2B9FD4E6608505E9C885FE19CBEF142DE34E3943B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
SodaMusic-v3.2.1-official-win32_x64_exe
unpack001/$PLUGINSDIR/DcryptDll.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/nsExec.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

SodaMusic-v3.2.1-official-win32_x64_exe

.exe 155.5MB
$APPDATA/comain_ev2f79/$R1

1.6MB
$PLUGINSDIR/DcryptDll.dll

.dll 18KB
$PLUGINSDIR/InstallOptions.dll

.dll 14KB
$PLUGINSDIR/ioSpecial.ini

211B
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsExec.dll

.dll 6KB

SodaMusic-v3.2.1-official-win32_x64_exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 ed838d996c985bbd3f091e33ea2242a9e217c3032828f92e44030932ece4b2d9
MD5 87f07358b7ed705080514d532f8a4e35
SHA1 3c29d768d7ceae5065da4a06e0899c087750a0b0
SHA512 19d2cc2244cd436a4ad06702db90e298bdbdb784273e0d11389510538005c96b0a32b5b4a4506510b1df3bb859e656fa0ca8b8f54784a98f6c24779acd81efdc
SSDEEP 3145728:h0FlQWBz4z0wyYZThz8h66B9+QnrGZZjxocJVZpkgffGdaZ8kmPQWxtiz4kDsEhh:OVMzmY/C6sabjmcTZpkg3GdPjPvtIsEX
TLSH
T18E7833C80E96EB45D4B942B37484E2B9FD4E6608505E9C885FE19CBEF142DE34E3943B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12885

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/DcryptDll.dll

IMPHASH 77b2cc378553d4809fcdee16eff40346
SHA256 92f89f2de4fc04f8c2702b34241a83cf16db32ebf1abb17f2850c4962af2f41a
MD5 f1eeabe27bc130c8ac224749c133c99a
SHA1 43fb139e13d3ec4d2335c2231668990e59065b2a
SHA512 0d71b57636ae821469bcf3062398719137d2963520a5e6a47c41723926166b02f535a4fce961b32e1c81bedcf57e07e875a2c80522ca643add3ea9f448801490
SSDEEP 384:zOU2E25y4n862yBmVq6nmWRJTpCLXXCCQMWfyq:zOUzz4n8ZyBmVVVpCLXSCQMWR
TLSH
T183820B01C9E0447CF2B1333976B6A916DCBD7D711476C20FFE99059F0A74A472A4A772
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

9116

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 44c822afaa4cc7cb95390eaa0ada076d280d3455870569f0cde03637257d9899
MD5 0285eac59530ff5cc91fe2634b4ed78e
SHA1 241c12aefca0740e776362f30aa1edffd66d6bdc
SHA512 1007fbfb82d4e6c04bd5fefb32cd81f4406022ceef4d409eda0f0ddeb8b1f124a2baec86498bc119778e0c241fc41b0c2440d8a8f6731a63ede936be94f81297
SSDEEP 192:8nK6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+MTgK72dwF7dBEnbok:8K6UdHXcIiY535zBtMTg+BEnbo
TLSH
T172622A11778888F3DB92013EB4533707AF9D5126B4929ED2CA271FCA6D2B19D3EB1306
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/nsExec.dll

IMPHASH d83f71e61ee459ee63ca3e829966a9dc
SHA256 ad42bf2210a6856c8903745b6d6f23f730a7aaca4e621e3b7d182ff3536e854f
MD5 a773979ae108641e5e39236467cfcba3
SHA1 c48c77054b6016122924e976480f0f63661e2527
SHA512 6972c0430d1b80696379de7b2ea26f6053f9578592b3cfdb0c9f748554c920e8ab91697d11812596f97722a59026555d83f43a9b1c7f51631d83463236886a81
SSDEEP 96:I7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3trCUTMxVXS32E:yKgfwgcr8zylsB49lrCUTMxVXN
TLSH
T18DD10A3DA6C33DB3D54ACE763C65292F1B78C9260BA40210AB5716C274D5AE3FD29382
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SodaMusic-v3.2.1-official-win32_x64_exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$APPDATA/comain_ev2f79/$R1

$PLUGINSDIR/DcryptDll.dll

kernel32

user32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic