MAXON-Start[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
MAXON-Start.exe
Size 2.9MB
Sample260806-s5h5saag47
SHA256 bf40c1bad3698eacd3596a889d85eb2c9ed2e92c309ca79b38917e9bc5f8936b
MD5 02d92c37f57f7582bfaa9de0543d5a94
SHA1 919b550500ee3efeba22f990758fac9edc3467ec
SHA512 b569213a1f50e8bd50e4da0308fe04dea6627a968cc370dfed112ce9b98329a129491ece84a57fdaadb4876168ec58c1cd25eca031bea44fc3febd983142ba63
SSDEEP 49152:quGZXq3kVT89t+HyjCoWU4o3I2cewUbSnUO7vvjEEEZrFVXv0Wje1Je:q1pQjtwvr7vvjEEkFVXv0A
TLSH
T1BFE57C4FEAAC56D1D0778274C906824BE7B1FC212A73C74F0169664A2FB73725E4E326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

MAXON-Start.exe

.exe 2.9MB

MAXON-Start.exe

IMPHASH 8f7628555d17ef9eaf97d9f26d1010b7
SHA256 bf40c1bad3698eacd3596a889d85eb2c9ed2e92c309ca79b38917e9bc5f8936b
MD5 02d92c37f57f7582bfaa9de0543d5a94
SHA1 919b550500ee3efeba22f990758fac9edc3467ec
SHA512 b569213a1f50e8bd50e4da0308fe04dea6627a968cc370dfed112ce9b98329a129491ece84a57fdaadb4876168ec58c1cd25eca031bea44fc3febd983142ba63
SSDEEP 49152:quGZXq3kVT89t+HyjCoWU4o3I2cewUbSnUO7vvjEEEZrFVXv0Wje1Je:q1pQjtwvr7vvjEEkFVXv0A
TLSH
T1BFE57C4FEAAC56D1D0778274C906824BE7B1FC212A73C74F0169664A2FB73725E4E326
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

9d:e7:e1:20:0f:60:4f:cd:4d:19:92:6f:0d:7a:33:bd:d3:be:5f:a7:8d:10:83:95:f2:63:26:2a:ac:b0:50:0b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=MAXON Computer GmbH,OU=SOFTWARE DEVELOPMENT,O=MAXON Computer GmbH,L=Friedrichsdorf,ST=Hessen,C=DE

Chains

Jun 30, 2018

CN=MAXON Computer GmbH,OU=SOFTWARE DEVELOPMENT,O=MAXON Computer GmbH,L=Friedrichsdorf,ST=Hessen,C=DE

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Digest

cc:80:b2:a0:c6:f8:f1:95:3e:05:df:84:aa:f9:6b:97:09:8e:9d:a7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=MAXON Computer GmbH,OU=SOFTWARE DEVELOPMENT,O=MAXON Computer GmbH,L=Friedrichsdorf,ST=Hessen,C=DE

Chains

Jun 30, 2018

CN=MAXON Computer GmbH,OU=SOFTWARE DEVELOPMENT,O=MAXON Computer GmbH,L=Friedrichsdorf,ST=Hessen,C=DE

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=MAXON Computer GmbH,OU=SOFTWARE DEVELOPMENT,O=MAXON Computer GmbH,L=Friedrichsdorf,ST=Hessen,C=DE

Serial Number

5d:5d:8d:bf:75:68:b5:f5:84:7f:c6:22:ee:71:b1:ca

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 30, 2018 - Jul 7, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

1736484

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Perforce\j_gaspe_Joeys_MacBook-Pro-Win10\release\20.0_dev_installer\modules\onlineupdater\RestartCinema\Win\x64\Release\MAXON-Start.pdb

kernel32

SetFilePointerEx GetConsoleMode GetConsoleCP GetTimeZoneInformation GetDriveTypeW LCMapStringW GetStringTypeW GetACP ExitProcess FindFirstFileExW GetCPInfo SetStdHandle QueryPerformanceFrequency VirtualQuery VirtualAlloc GetSystemInfo HeapQueryInformation FreeLibraryAndExitThread ExitThread CreateThread GetCommandLineA RtlUnwindEx RtlPcToFileHeader OutputDebugStringW IsValidCodePage GetStdHandle GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent Sleep SearchPathW GetProfileIntW GetTickCount GetTempPathW GetTempFileNameW VerifyVersionInfoW VerSetConditionMask FindResourceExW GetWindowsDirectoryW SetErrorMode GetFileTime GetFileSizeEx GetFileAttributesExW GetFileAttributesW lstrcpyW VirtualProtect GlobalGetAtomNameW GlobalFlags GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW CompareStringW GetCurrentDirectoryW LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection lstrcmpiW GetCurrentProcess DuplicateHandle WriteFile UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetVolumeInformationW GetFullPathNameW GetFileSize FlushFileBuffers DeleteFileW CreateFileW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime FindNextFileW FindFirstFileW FindClose FileTimeToLocalFileTime LeaveCriticalSection EnterCriticalSection GlobalFindAtomW GetSystemDirectoryW EncodePointer GetCurrentProcessId GlobalAddAtomW WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW ResumeThread SetThreadPriority CreateEventW WaitForSingleObject SetEvent CloseHandle QueryActCtxW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW LoadLibraryW GetModuleHandleExW FreeResource OutputDebugStringA SetLastError CopyFileW FormatMessageW MulDiv GlobalFree GlobalUnlock GlobalSize WideCharToMultiByte lstrcmpW lstrcmpA GlobalDeleteAtom GlobalLock GlobalAlloc LoadLibraryExW GetModuleFileNameW FreeLibrary GetVersionExW GetCurrentThreadId GetCurrentThread GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount HeapFree MultiByteToWideChar GetProcAddress GetCommandLineW GetModuleHandleW FindResourceW LoadResource LockResource SizeofResource LocalFree GetFileType WriteConsoleW

user32

LoadAcceleratorsW BringWindowToTop IntersectRect LoadImageW TrackMouseEvent MapDialogRect GetAsyncKeyState DestroyIcon GetSysColorBrush InvalidateRect KillTimer SetTimer RealChildWindowFromPoint DeleteMenu CopyImage LoadCursorW WindowFromPoint ReleaseCapture SetCapture WaitMessage FillRect ClientToScreen ReleaseDC GetWindowDC GetDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW CharUpperW SystemParametersInfoW InflateRect GetMenuItemInfoW DestroyMenu OffsetRect SetRectEmpty SendDlgItemMessageA IsDialogMessageW SetWindowTextW CheckDlgButton SetDlgItemTextW MoveWindow ShowWindow GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo UnhookWindowsHookEx GetWindow GetTopWindow GetClassNameW GetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW PtInRect EqualRect CopyRect GetSysColor MapWindowPoints ScreenToClient AdjustWindowRectEx GetWindowTextLengthW GetWindowTextW RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow RedrawWindow EndPaint BeginPaint SetForegroundWindow GetForegroundWindow TrackPopupMenu SetMenu GetMenu GetCapture SetFocus GetDlgCtrlID EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement SetWindowPos IsChild IsMenu CreateWindowExW TranslateAcceleratorW CreatePopupMenu InsertMenuItemW EnableWindow LoadIconW GetSystemMenu AppendMenuW SendMessageW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos RegisterWindowMessageW GetLastActivePopup GetWindowThreadProcessId MessageBoxW SetCursor ShowOwnedPopups CallNextHookEx SetWindowsHookExW UnpackDDElParam ReuseDDElParam GetMenuDefaultItem GetNextDlgGroupItem DrawFocusRect IsRectEmpty DrawIconEx GetIconInfo MessageBeep EnableScrollBar HideCaret InvertRect NotifyWinEvent MapVirtualKeyW GetKeyNameTextW SetLayeredWindowAttributes EnumDisplayMonitors SetClassLongPtrW SetWindowRgn SetParent OpenClipboard CloseClipboard UpdateWindow IsIconic GetSystemMetrics GetClientRect DrawIcon UnregisterClassW PostMessageW PostQuitMessage GetMenuStringW GetMenuState GetSubMenu GetMenuItemID GetMenuItemCount InsertMenuW RemoveMenu IsWindow DestroyWindow CreateDialogIndirectParamW EndDialog GetDlgItem GetNextDlgTabItem GetActiveWindow IsWindowEnabled SetActiveWindow GetWindowLongW GetDesktopWindow GetParent LoadMenuW GetWindowRect GetFocus CheckMenuItem EnableMenuItem SetMenuItemBitmaps GetMenuCheckMarkDimensions GetComboBoxInfo SetMenuItemInfoW LoadBitmapW GetMessageW TranslateMessage DispatchMessageW PeekMessageW IsWindowVisible GetKeyState ValidateRect GetCursorPos PostThreadMessageW GetKeyboardLayout IsCharLowerW MapVirtualKeyExW ToUnicodeEx GetKeyboardState CreateAcceleratorTableW DestroyAcceleratorTable CopyAcceleratorTableW SetRect LockWindowUpdate SetMenuDefaultItem GetDoubleClickTime ModifyMenuW RegisterClipboardFormatW CharUpperBuffW IsClipboardFormatAvailable GetUpdateRect DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel SubtractRect CreateMenu GetWindowRgn DestroyCursor MonitorFromPoint UpdateLayeredWindow UnionRect FrameRect CopyIcon SetCursorPos IsZoomed DrawFrameControl DrawEdge DrawStateW EmptyClipboard SetClipboardData

gdi32

CreatePatternBrush CreateRectRgn CreateSolidBrush DeleteObject Escape ExcludeClipRect GetClipBox GetObjectType GetPixel GetStockObject GetViewportExtEx GetWindowExtEx IntersectClipRect LineTo PtVisible RectVisible RestoreDC SaveDC SelectClipRgn ExtSelectClipRgn SelectObject SelectPalette SetBkMode SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetTextAlign MoveToEx TextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx GetTextMetricsW CreatePen CreateRectRgnIndirect PatBlt SetRectRgn DPtoLP CreateCompatibleBitmap EnumFontFamiliesExW CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries RealizePalette GetBkColor CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo SetPixel StretchBlt CreateDIBSection SetDIBColorTable CreateEllipticRgn Ellipse GetTextColor CreatePolygonRgn Polygon Polyline CreateRoundRectRgn LPtoDP Rectangle GetRgnBox OffsetRgn RoundRect FillRgn FrameRgn GetBoundsRect PtInRegion ExtFloodFill SetPaletteEntries SetPixelV GetWindowOrgEx GetViewportOrgEx GetTextFaceW CreateHatchBrush ExtTextOutW GetTextExtentPoint32W CreateFontIndirectW CreateCompatibleDC BitBlt GetObjectW SetTextColor SetBkColor CreateBitmap GetDeviceCaps CreateDCW CombineRgn DeleteDC CopyMetaFileW

msimg32

TransparentBlt AlphaBlend

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

RegEnumKeyExW RegEnumValueW RegQueryValueW RegEnumKeyW RegSetValueExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

CommandLineToArgvW ShellExecuteW SHGetFileInfoW SHAppBarMessage SHBrowseForFolderW SHGetDesktopFolder SHGetSpecialFolderLocation SHGetPathFromIDListW DragFinish DragQueryFileW

shlwapi

PathFindFileNameW PathIsUNCW PathStripToRootW PathRemoveFileSpecW StrFormatKBSizeW PathFindExtensionW

uxtheme

GetCurrentThemeName GetWindowTheme DrawThemeText DrawThemeParentBackground OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor IsAppThemed IsThemeBackgroundPartiallyTransparent GetThemePartSize GetThemeSysColor

ole32

OleLockRunning OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleGetClipboard DoDragDrop CoInitializeEx CoDisconnectObject CoInitialize CoCreateInstance ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc CoCreateGuid CoUninitialize CreateStreamOnHGlobal

oleaut32

LoadTypeLi VarBstrFromDate VariantCopy VariantTimeToSystemTime SysStringLen VariantChangeType VariantClear VariantInit SysAllocStringLen SysFreeString SysAllocString SystemTimeToVariantTime

oleacc

LresultFromObject AccessibleObjectFromWindow CreateStdAccessibleObject

gdiplus

GdipSetInterpolationMode GdipCreateFromHDC GdipDrawImageRectI GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree GdipAlloc GdipCreateBitmapFromHBITMAP GdiplusShutdown

imm32

ImmGetContext ImmGetOpenStatus ImmReleaseContext

winmm

PlaySoundW

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

629KB

Virtual Size

628KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.giats

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

180KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

MAXON-Start.exe

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

oleacc

gdiplus

imm32

winmm

generic