CapCut_4_0_0_1539_capcutpc_0_creatortool[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
CapCut_4_0_0_1539_capcutpc_0_creatortool.exe
Size 545.4MB
Sample260705-ythmrsft9x
SHA256 ac392fb0cea189e3d6022cf442211823224da96e678c2a998104f5fb0bb99f8c
MD5 a3782c6c5e77a88525b3881128435452
SHA1 3a18e3a1a81745778c4c4c69b0e0a67749f2b2e4
SHA512 833a93ab2fa6c48faee0e82394951bb4e097990a124f251b6bd594c11b4e562cedd057fd85e1acadfe6d7a34ebaee6eec76b62283a102d339af34295be1f2b3c
SSDEEP 12582912:lXlI0tdNQYfAbM+QZNatcKQcP7Qz5bLngFcK0DMj0o8C/EuCoxJ/I:l607Nt+MLYP7QlbbgFcZDMyClI
TLSH
T1EC593320BD80DA72F657053F0976ABA5653DBC62433509C391C8767D5A32AD33F3AA83
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

CapCut_4_0_0_1539_capcutpc_0_creatortool.exe

.exe 545.4MB

CapCut_4_0_0_1539_capcutpc_0_creatortool.exe

IMPHASH 81586486f0aad41ecd3427e366729e58
SHA256 ac392fb0cea189e3d6022cf442211823224da96e678c2a998104f5fb0bb99f8c
MD5 a3782c6c5e77a88525b3881128435452
SHA1 3a18e3a1a81745778c4c4c69b0e0a67749f2b2e4
SHA512 833a93ab2fa6c48faee0e82394951bb4e097990a124f251b6bd594c11b4e562cedd057fd85e1acadfe6d7a34ebaee6eec76b62283a102d339af34295be1f2b3c
SSDEEP 12582912:lXlI0tdNQYfAbM+QZNatcKQcP7Qz5bLngFcK0DMj0o8C/EuCoxJ/I:l607Nt+MLYP7QlbbgFcZDMyClI
TLSH
T1EC593320BD80DA72F657053F0976ABA5653DBC62433509C391C8767D5A32AD33F3AA83
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

b0:bc:a5:cf:c0:dd:2a:0a:a2:ef:a3:bd:50:c9:45:ad:47:94:7a:36:b9:f1:ac:65:fc:eb:a1:ea:2b:7b:9e:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=201923456H,CN=Bytedance Pte. Ltd.,O=Bytedance Pte. Ltd.,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Chains

Jun 13, 2024

SERIALNUMBER=201923456H,CN=Bytedance Pte. Ltd.,O=Bytedance Pte. Ltd.,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=201923456H,CN=Bytedance Pte. Ltd.,O=Bytedance Pte. Ltd.,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=201923456H,CN=Bytedance Pte. Ltd.,O=Bytedance Pte. Ltd.,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=201923456H,CN=Bytedance Pte. Ltd.,O=Bytedance Pte. Ltd.,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Serial Number

06:df:4d:93:8e:75:e6:3d:64:8a:be:02:29:5c:d3:3c

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Jul 30, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

432922

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\code\bytedance\installer\LVInstallerCC\VideofusionInstaller\build\CC_RELEASE\JYInstaller.pdb

kernel32

GetLocaleInfoW GetUserDefaultLCID GetEnvironmentVariableW GetDiskFreeSpaceExW GetVolumeInformationW GetCurrentProcessId TerminateProcess GetLocalTime GetTickCount GetSystemDirectoryW lstrcmpW CopyFileW MoveFileExW TerminateThread GetPrivateProfileStringA WritePrivateProfileStringA MoveFileW MapViewOfFile InitializeCriticalSection SetEvent ResetEvent CreateEventW CreateMutexW ReleaseMutex GetStdHandle GetFileType GetNativeSystemInfo FindFirstFileExW OutputDebugStringA GetUserDefaultLangID SetEndOfFile SetFilePointerEx FlushFileBuffers QueryPerformanceCounter GetSystemTimeAsFileTime FlushInstructionCache IsDebuggerPresent GetModuleHandleExW TlsGetValue TlsSetValue TlsAlloc TlsFree FreeEnvironmentStringsW GetEnvironmentStringsW ReadConsoleW GetTimeZoneInformation GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter ExitProcess SetStdHandle GetConsoleMode GetConsoleCP GetCPInfo RtlUnwind GetStringTypeW EncodePointer VirtualFree VirtualAlloc IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead OutputDebugStringW LoadLibraryExA CreateProcessW lstrcmpiW UnmapViewOfFile GetCurrentThreadId CreateThread Sleep LeaveCriticalSection EnterCriticalSection SetFilePointer GetCurrentProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot FreeLibrary OpenProcess WaitForSingleObject LocalFree GetVersionExW SetLastError SetFileAttributesW MultiByteToWideChar ReadFile GetFileSize WideCharToMultiByte CloseHandle MapViewOfFileEx CreateFileMappingW SetErrorMode GetCommandLineW LoadLibraryExW ProcessIdToSessionId WriteFile CreateFileW GetModuleFileNameW InitializeCriticalSectionAndSpinCount RemoveDirectoryW GetFileAttributesW FindNextFileW FindFirstFileW FindClose CreateDirectoryW FindResourceW LoadLibraryW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW FindResourceExW DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer GetTempPathW DeleteFileW WriteConsoleW SetEnvironmentVariableA

user32

GetParent GetClientRect MonitorFromWindow MapWindowPoints SetWindowPos SetTimer KillTimer PostQuitMessage DefWindowProcW SendMessageW DispatchMessageW TranslateMessage GetMessageW GetDesktopWindow GetDC UnregisterClassW DestroyWindow GetSystemMetrics GetWindowRect GetCursorPos GetWindowLongW SetWindowLongW LoadCursorW MessageBoxW PeekMessageW PostMessageW ShowWindow IsWindowVisible IsIconic CharNextW SetFocus SetForegroundWindow GetWindow LoadImageW GetWindowDC ReleaseDC SetWindowTextW GetWindowPlacement OffsetRect UpdateLayeredWindow ScreenToClient CreateDialogParamW wsprintfW SetCursor EnableWindow IsWindow BringWindowToTop GetMonitorInfoW

gdi32

CreateDIBSection DeleteDC GetDeviceCaps DeleteObject GetStockObject CreateCompatibleDC SelectObject GetObjectA

advapi32

RegSetValueExW AccessCheck RegDeleteValueW RegQueryInfoKeyW RegEnumKeyExW RegDeleteKeyExW LookupPrivilegeValueW AdjustTokenPrivileges GetTokenInformation DuplicateTokenEx OpenProcessToken SetNamedSecurityInfoW GetNamedSecurityInfoW IsValidSid InitializeSid InitializeAcl GetSidSubAuthority GetSidLengthRequired GetLengthSid GetAclInformation GetAce CopySid AddAce RegOpenKeyExW RegDeleteKeyW RegCreateKeyExW RegCloseKey DuplicateToken GetFileSecurityW InitializeSecurityDescriptor MapGenericMask SetSecurityDescriptorDacl RegOpenKeyW RegQueryValueExW SetEntriesInAclW BuildExplicitAccessWithNameW

shell32

SHGetPathFromIDListW SHBrowseForFolderW CommandLineToArgvW SHFileOperationW ShellExecuteExW SHGetFolderPathW SHChangeNotify ShellExecuteW

ole32

PropVariantClear CoInitializeEx CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoInitialize CoCreateInstance CoUninitialize

oleaut32

VariantClear SysFreeString VarUI4FromStr SysAllocStringLen SysAllocString

shlwapi

ord12 SHStrDupW ord176 SHSetValueW SHGetValueW PathIsDirectoryW PathGetDriveNumberW PathFindExtensionW PathIsNetworkPathW StrStrIW PathAppendW PathFileExistsW PathRemoveFileSpecW

comctl32

InitCommonControlsEx _TrackMouseEvent

gdiplus

GdipCreateStringFormat GdipDeleteStringFormat GdipMeasureString GdipSetStringFormatTrimming GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetTextRenderingHint GdipSetImageAttributesColorMatrix GdipCreateBitmapFromScan0 GdipGetImageGraphicsContext GdipDrawImagePointRectI GdipSetSolidFillColor GdipDrawImage GdipAlloc GdiplusShutdown GdiplusStartup GdipDisposeImageAttributes GdipCreateImageAttributes GdipTranslateWorldTransform GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipDeleteFont GdipCloneImage GdipDisposeImage GdipDeleteGraphics GdipCreateFromHDC GdipGraphicsClear GdipSetClipRectI GdipRestoreGraphics GdipSaveGraphics GdipDrawImageRectRectI GdipFillRectangleI GdipSetSmoothingMode GdipGetImageHeight GdipGetImageWidth GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipDrawString GdipFree

Name

.text

Size

551KB

Virtual Size

551KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

115KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

CapCut_4_0_0_1539_capcutpc_0_creatortool.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

generic