Cinema 4D[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Cinema 4D.exe
Size 11.0MB
Sample260723-ffmepa1dng
SHA256 5da7c2b840e86b8e991d06291abaf7a164e9ae0b8ceaf27b1a9ea5c08e5a05eb
MD5 4722b314ba21f9753deb89e1457217c6
SHA1 04db542c44dc2016150a46ee47d0d09af78edcaa
SHA512 5f962549c1a97b3b748395bef6b38b7416df501905a5487298a4793a7ba62482a5b08857921f522080d093bc20616646da053a976625014541a1343b108e3f8c
SSDEEP 196608:cTEf9mYgDn7D9+gyczO/nF/ZQDD4rM/FeEn0YduDMTxhs0FSPkGzEn3q:cTQc5Dnf9+q4F/ZQDUQ/oEwMSPkG83q
TLSH
T177C633AA337455FBE4925674C431E548D773B2896701F28F80318BF2EF17A989E35BA0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Cinema 4D.exe

File Explorer

Cinema 4D.exe

.exe 11.0MB

Cinema 4D.exe

IMPHASH d3bbfd624fcfeb095c7bf0242b723cee
SHA256 5da7c2b840e86b8e991d06291abaf7a164e9ae0b8ceaf27b1a9ea5c08e5a05eb
MD5 4722b314ba21f9753deb89e1457217c6
SHA1 04db542c44dc2016150a46ee47d0d09af78edcaa
SHA512 5f962549c1a97b3b748395bef6b38b7416df501905a5487298a4793a7ba62482a5b08857921f522080d093bc20616646da053a976625014541a1343b108e3f8c
SSDEEP 196608:cTEf9mYgDn7D9+gyczO/nF/ZQDD4rM/FeEn0YduDMTxhs0FSPkGzEn3q:cTQc5Dnf9+q4F/ZQDUQ/oEwMSPkG83q
TLSH
T177C633AA337455FBE4925674C431E548D773B2896701F28F80318BF2EF17A989E35BA0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

127052

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

ord17

shell32

ShellExecuteW SHBrowseForFolderW ShellExecuteExW SHGetPathFromIDListW SHGetFileInfoW SHGetSpecialFolderPathW SHGetMalloc

gdi32

CreateCompatibleDC CreateFontIndirectW DeleteObject DeleteDC GetCurrentObject StretchBlt GetDeviceCaps CreateCompatibleBitmap SelectObject SetStretchBltMode GetObjectW

advapi32

FreeSid AllocateAndInitializeSid CheckTokenMembership

user32

EnableMenuItem IsWindow EnableWindow MessageBeep LoadIconW LoadImageW SetWindowsHookExW PtInRect CallNextHookEx DefWindowProcW CallWindowProcW DrawIconEx DialogBoxIndirectParamW GetWindow ClientToScreen GetDC DrawTextW SystemParametersInfoW GetSystemMetrics SetFocus UnhookWindowsHookEx GetWindowLongPtrW SetWindowLongPtrW GetClientRect GetDlgItem GetKeyState GetSystemMenu DestroyWindow GetSysColor SetWindowTextW GetWindowTextLengthW GetWindowTextW wsprintfA GetClassNameA GetWindowLongW GetMenu GetWindowDC ReleaseDC CopyImage GetParent ScreenToClient CreateWindowExW GetDesktopWindow GetWindowRect SetWindowPos SetTimer GetMessageW CreateWindowExA KillTimer CharUpperW SendMessageW DispatchMessageW ShowWindow BringWindowToTop wsprintfW MessageBoxW wvsprintfW MessageBoxA EndDialog

ole32

CreateStreamOnHGlobal CoInitialize CoCreateInstance

oleaut32

SysFreeString VariantClear SysAllocStringLen OleLoadPicture SysAllocString

kernel32

GetFileInformationByHandle WaitForMultipleObjects VirtualAlloc SetUnhandledExceptionFilter QueryPerformanceCounter GetTickCount VirtualFree SetEndOfFile SetFileTime ReadFile SetFilePointer GetFileSize LeaveCriticalSection EnterCriticalSection DeleteCriticalSection FormatMessageW lstrcpyW LocalFree IsBadReadPtr SuspendThread TerminateThread GetSystemDirectoryW GetCurrentThreadId InitializeCriticalSection ResetEvent SetEvent CreateEventW GetVersionExW GetModuleFileNameW GetCurrentProcess SetProcessWorkingSetSize SetEnvironmentVariableW GetDriveTypeW CreateFileW LoadLibraryA SetThreadLocale GetSystemTimeAsFileTime ExpandEnvironmentStringsW CompareFileTime WideCharToMultiByte GetTempPathW GetCurrentDirectoryW FindFirstFileW lstrcmpW DeleteFileW FindNextFileW FindClose RemoveDirectoryW SetCurrentDirectoryW GetEnvironmentVariableW lstrcmpiW GetLocaleInfoW MultiByteToWideChar GetUserDefaultUILanguage GetSystemDefaultUILanguage GetSystemDefaultLCID lstrcmpiA GlobalAlloc GlobalFree MulDiv FindResourceExA SizeofResource LoadResource LockResource GetProcAddress GetModuleHandleW GetStdHandle WriteFile lstrlenA CreateDirectoryW GetFileAttributesW lstrlenW GetLocalTime SystemTimeToFileTime CreateThread GetExitCodeThread Sleep ExitProcess lstrcatW AddVectoredExceptionHandler RemoveVectoredExceptionHandler CloseHandle WaitForSingleObject GetExitCodeProcess GetQueuedCompletionStatus ResumeThread SetInformationJobObject CreateIoCompletionPort AssignProcessToJobObject CreateJobObjectW GetLastError CreateProcessW GetStartupInfoW GetCommandLineW SetLastError GetDiskFreeSpaceExW SetFileAttributesW GetCurrentProcessId

msvcrt

__CxxFrameHandler ??3@YAXPEAX@Z memset _wtol _purecall memcmp ??2@YAPEAX_K@Z _wcsnicmp memmove memcpy strncpy wcsncpy wcsncmp strncmp ?_set_new_handler@@YAP6AH_K@ZP6AH0@Z@Z _beginthreadex wcscmp _CxxThrowException wcsstr free malloc __C_specific_handler _unlock __dllonexit _lock _onexit ??1type_info@@UEAA@XZ __getmainargs _XcptFilter _exit _ismbblead _cexit exit _acmdln _initterm _amsg_exit __setusermatherr _commode _fmode __set_app_type ?terminate@@YAXXZ