R2R.zip
- SHA256 7d07b6bbdd3499752723d261cc73c47dbeb2b5dfd5aba93c5fc80e71f5ea604c
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
R2R/ScriptPortal.Vegas.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
R2R/ScriptPortal.Vegas.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
R2R/VEGAS_Pro_23.0.0.302_x64.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
25 signatures
900 seconds
Behavioral task
behavioral4
Sample
R2R/VEGAS_Pro_23.0.0.302_x64.exe
Resource
win11-20260513-en
windows11-21h2-x64
24 signatures
900 seconds
General
- Target R2R.zip
- Size 656.6MB
- Sample260804-dbkdes1apg
- SHA256 7d07b6bbdd3499752723d261cc73c47dbeb2b5dfd5aba93c5fc80e71f5ea604c
- MD5 563623f6d5c14e27d52832c7f87b00dc
- SHA1 d4a1724f4f7a1f115b0731ef3d6770ff007ccc39
- SHA512 c3bcd92645e436177b97d215149484b5750231d899c9cc98dba0691999d35d89b69cc3cd2e5ff8771b5699fe770249a054dc36845c0b1739a0846f497b0623aa
- SSDEEP 12582912:Huenx2/ehMwmZ8ftkO9oVxhCuNxiN1LyDSUTc6vbw3zJiPzxMpP63+mPkDQgGnBg:HuenxG8MzZ8fmNxw1L6tgwqyzypi3+mc
- TLSH T17469333EFCDD99E2AC9CAD1D2BCD624371003930351F09A9D7B858FBA23C5D66D60A64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/R2R/ScriptPortal.Vegas.dll
File Explorer
-
R2R.zip.zip 656.6MB
-
R2R/R2R.txt152B
-
R2R/ScriptPortal.Vegas.dll.dll 594KB
-
R2R/VEGAS_Pro_23.0.0.302_x64.exe.exe 658.4MB
R2R/R2R.txt
- SHA256 450afffea9babe9e8e71b25f3f42b6e4ac4efe3664d7199d3b8767b5193c6179
- MD5 93b1abbe76c7435fcda4b3d31684ef3c
- SHA1 9544a44da10ae8e6e10f480d0ff5a179e243403d
- SHA512 732b049cb10d82c6065ca7163941c289425ca4abb0a608740b76e320951abe570190b6931866e6d25202f76aebf7ff591175300030ffc10551ae8349b8199570
- TLSH T11BC08CA01810A33538024B8F9E0E89D6F70890993E03564A76B68C843202A26234B19B
- MD5 SHA1 SHA512 TLSH
R2R/ScriptPortal.Vegas.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 90495c4e9febef6c95442206b33bd1844bc2dc68d88219a0da0d996af656d1ee
- MD5 4f77bf4b2080addef37d3a6a8ffa03b7
- SHA1 6364adec34b32d118b3b1a7992656058d47f77a5
- SHA512 c3e468e24e9f2d092437678bd3bc7069fd823b8c44bba09d45d1e4e7f26a22fe6aa9fb26cee49a87715ee5c40d034777f5033e89aaff4c4b8eef7abdcad43240
- SSDEEP 6144:MQXAmoxKJHkvvyNcUMgtR2HkpYsDp6ejGY/rIQPy6jXKRmOK5bTiQGqRvWV3cbew:YKlnjPBCukdK5j
- TLSH T14DD4171237F9672BF4EB1778B872497086BAF91AA506E35F0510695C2CA3B90CC11FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
613406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
591KB
Virtual Size
591KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
R2R/VEGAS_Pro_23.0.0.302_x64.exe
- IMPHASH 1710735971f0dd353f9d31e780cdac1b
- SHA256 2b7d2e0cecf79a67de90a57870a1bd25d73741db1ea4cd7093581a41009247b4
- MD5 0d3beaa032fda96e63869232e58bf474
- SHA1 18eef6ed11cbde8a8c7967750fd1719f98fa75a7
- SHA512 7660163c330a160fbb2a091099c84532ef7f7721256ddcd4190e3e3521cf113c4b73235704507eaef3c9331962c9dccd11af3c98ed43e88584d085ad494498ac
- SSDEEP 12582912:ZWI336PytUMEjQ3Pi8NYFFXSeP9kqxPaxa3IAdUWjlUnFgobqM5S5VeZaGh4voCa:ZWI338gU5jQ34P9kOSxkV6K+nqMI50Z1
- TLSH T16A6933257F0A41AEE44102F189A6D31A22249D6413FD01E3EB9DF76693774D2EBF1B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
16:82:63:2b:e0:51:16:26:ac:c5:14:9c:cb:f5:91:52:d7:51:1d:e2:1e:39:01:58:5d:b8:72:1d:a8:c4:cc:27
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=MAGIX Software GmbH,O=MAGIX Software GmbH,L=Berlin,C=DE
Chains
Sep 27, 2025
CN=MAGIX Software GmbH,O=MAGIX Software GmbH,L=Berlin,C=DE
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=MAGIX Software GmbH,O=MAGIX Software GmbH,L=Berlin,C=DE
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=MAGIX Software GmbH,O=MAGIX Software GmbH,L=Berlin,C=DE
Serial Number
02:7d:e3:d8:45:44:11:80:5d:bf:c9:db:d0:f5:12:b5
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 27, 2023 - Apr 26, 2026
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
5
Entry point
653031
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\Repos\dev\MxMSI_Master\_MsiBuildSystem\bin\SfxMaker\stub_Release_Win32_v120_xp.pdb
kernel32
GetCurrentThread
LoadLibraryExW
GlobalDeleteAtom
lstrcmpA
lstrcmpW
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
GlobalAddAtomW
LoadLibraryA
EncodePointer
GlobalFindAtomW
GetFileSizeEx
GetFileTime
SystemTimeToFileTime
GetFullPathNameW
GetVolumeInformationW
LockFile
UnlockFile
DuplicateHandle
GetStringTypeExW
GetThreadLocale
GlobalFlags
CompareStringW
GetSystemDefaultUILanguage
SetErrorMode
GetUserDefaultLCID
RtlUnwind
CreateThread
ExitThread
GetCPInfo
GetSystemTimeAsFileTime
ExitProcess
GetModuleHandleExW
AreFileApisANSI
IsDebuggerPresent
IsProcessorFeaturePresent
SetStdHandle
GetFileType
HeapQueryInformation
GetSystemInfo
VirtualProtect
VirtualQuery
GetStartupInfoW
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
FreeResource
TerminateProcess
IsValidCodePage
GetOEMCP
GetStringTypeW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
ReadConsoleW
OutputDebugStringW
GetDateFormatW
GetTimeFormatW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
WriteConsoleW
SetEnvironmentVariableA
LocalReAlloc
LocalAlloc
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
CreateWaitableTimerA
SetWaitableTimer
OpenEventA
WaitForMultipleObjectsEx
CreateSemaphoreA
CreateEventA
WaitForSingleObjectEx
FormatMessageA
GetStringTypeExA
LCMapStringA
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LocalFree
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
OutputDebugStringA
GetACP
MulDiv
GetVersion
FindResourceExW
lstrlenA
CreateProcessW
GetEnvironmentVariableW
LoadLibraryW
FreeLibrary
EnumResourceNamesW
SetFilePointerEx
FlushFileBuffers
ResumeThread
SuspendThread
GetThreadPriority
SetThreadPriority
GetDriveTypeW
GetCommandLineW
FormatMessageW
GetLongPathNameW
InitializeCriticalSectionAndSpinCount
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
DecodePointer
Sleep
GetExitCodeProcess
GetDiskFreeSpaceExW
MapViewOfFileEx
GetFileAttributesExW
GetFileAttributesW
GetModuleFileNameW
CreateFileMappingW
UnmapViewOfFile
GetCurrentProcess
GetUserDefaultLangID
GetUserDefaultUILanguage
GetLocaleInfoW
FindResourceW
SizeofResource
LoadResource
LockResource
WaitForMultipleObjects
GetStdHandle
GetFileInformationByHandle
SetFilePointer
SetEndOfFile
ReadFile
WriteFile
GetFileSize
FindNextFileW
FindFirstFileW
GetModuleHandleA
GetLogicalDriveStringsW
FindClose
MoveFileW
DeleteFileW
SetFileAttributesW
CreateFileW
RemoveDirectoryW
CreateDirectoryW
GetCurrentDirectoryW
GetTempPathW
GetSystemDirectoryW
GetModuleHandleW
SetFileTime
SetLastError
GetProcAddress
FileTimeToLocalFileTime
CreateSemaphoreW
CreateEventW
CloseHandle
WaitForSingleObject
ReleaseSemaphore
ResetEvent
SetEvent
InitializeCriticalSection
GetLastError
GetVersionExW
VirtualFree
VirtualAlloc
FileTimeToSystemTime
WideCharToMultiByte
MultiByteToWideChar
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
DeleteCriticalSection
LeaveCriticalSection
SetUnhandledExceptionFilter
EnterCriticalSection
user32
IntersectRect
GetSysColorBrush
DestroyMenu
SetWindowTextW
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetClassLongW
SetWindowLongW
EqualRect
AdjustWindowRectEx
RemovePropW
GetPropW
SetPropW
SetForegroundWindow
UpdateWindow
SetMenu
GetMenu
GetCapture
GetDlgCtrlID
GetClassInfoExW
GetClassInfoW
CallWindowProcW
DefWindowProcW
RealChildWindowFromPoint
GetMessagePos
GetWindowTextLengthW
SetFocus
IsDialogMessageW
GetTopWindow
MessageBeep
GetNextDlgGroupItem
IsChild
SetWindowContextHelpId
WindowFromPoint
CharUpperW
LoadStringW
LoadStringA
GetLastActivePopup
MessageBoxW
PostQuitMessage
CallNextHookEx
SetWindowsHookExW
ValidateRect
DispatchMessageW
TranslateMessage
GetMessageW
GetDesktopWindow
SetActiveWindow
IsWindowEnabled
GetActiveWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
DestroyWindow
LoadBitmapW
SetMenuItemInfoW
CharNextW
OffsetRect
SetCapture
ReleaseCapture
CopyAcceleratorTableW
InvalidateRgn
SetRect
RegisterClipboardFormatW
PostThreadMessageW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
ClientToScreen
GetMessageTime
DestroyIcon
EnableWindow
SendMessageW
PostMessageW
GetSystemMetrics
LoadImageW
RegisterWindowMessageW
ReplyMessage
RegisterClassW
MoveWindow
DefDlgProcW
GetDC
ReleaseDC
GetWindowRect
LoadCursorW
LoadIconW
MapDialogRect
UnregisterClassW
PeekMessageW
MsgWaitForMultipleObjects
GetClassNameW
GetWindowThreadProcessId
AllowSetForegroundWindow
IsWindow
SetWindowPos
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
GetDlgItem
GetClientRect
ScreenToClient
TrackMouseEvent
GetFocus
RedrawWindow
CopyRect
InflateRect
SetDlgItemTextW
GetKeyState
SetTimer
KillTimer
GetSystemMenu
DeleteMenu
InvalidateRect
SystemParametersInfoW
GetSysColor
FillRect
EndPaint
BeginPaint
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
UnhookWindowsHookEx
GetMenuItemCount
GetMenuItemID
GetSubMenu
SendDlgItemMessageA
IsWindowVisible
PtInRect
IsRectEmpty
DrawFrameControl
ShowCaret
HideCaret
GetCursorPos
SetCursor
GetWindow
GetParent
GetWindowLongW
MapWindowPoints
GetWindowTextW
GetForegroundWindow
FlashWindowEx
CreateWindowExW
gdi32
CreateRectRgnIndirect
GetMapMode
GetBkColor
GetTextColor
ScaleWindowExtEx
ScaleViewportExtEx
SetWindowExtEx
SetViewportExtEx
ExtTextOutW
TextOutW
SetTextColor
GetRgnBox
SetMapMode
SetBkColor
ExtSelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetClipBox
ExcludeClipRect
Escape
DeleteDC
CreateBitmap
OffsetViewportOrgEx
SetViewportOrgEx
CreateFontIndirectW
GetDeviceCaps
GetObjectW
SelectObject
CreateSolidBrush
DeleteObject
winspool.drv
OpenPrinterW
ClosePrinter
DocumentPropertiesW
advapi32
RegDeleteValueW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegSetValueExW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
shell32
SHOpenFolderAndSelectItems
SHParseDisplayName
SHGetSpecialFolderPathW
SHCreateItemFromParsingName
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
ord165
ShellExecuteW
comctl32
ord413
ord410
InitCommonControlsEx
ord412
shlwapi
UrlCreateFromPathW
PathCreateFromUrlAlloc
UrlIsW
PathFindExtensionW
PathFindFileNameW
PathIsUNCW
PathStripToRootW
ole32
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
OleInitialize
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoCreateGuid
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CoCreateInstance
CoUninitialize
OleUninitialize
CoRevokeClassObject
StgCreateDocfileOnILockBytes
OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter
CoInitialize
oleaut32
VariantCopy
VariantInit
VariantChangeType
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantClear
OleCreateFontIndirect
SysAllocStringLen
SysAllocString
SysFreeString
oledlg
OleUIBusyW
msi
ord118
ord48
ord171
ord32
ord159
ord160
ord8
ord92
oleacc
CreateStdAccessibleObject
LresultFromObject
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
275KB
Virtual Size
274KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
47KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
2B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=704, id=1, productName=Unmarked objects,
count=133, id=225, productName=VS2013 build 21005, version=21005,
count=41, id=223, productName=VS2013 build 21005, version=21005,
count=253, id=224, productName=VS2013 build 21005, version=21005,
count=121, id=225, version=20806,
count=17, id=224, productName=VS2013 UPD5 build 40629, version=40629,
count=159, id=225, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,