trial_vegaspro14[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
trial_vegaspro14.exe
Size 4.1MB
Sample261029-ypeqbaev41
SHA256 9584c07341d36b617820a78a7581e99c6b2197dd74c37a604f4655d17e73dfd7
MD5 9f69442541fdc2bca8a73b5cf5dd671a
SHA1 ba4a50e5ef172841a5055d421578995c9f7e4fcf
SHA512 855c5fc2f79eeee047462ac389600ea0f99ebf13a7dd5351e7eae6bb8467b554de6a7c779173b90911e7c302e5522fea74e845f4dda57d4fc86c5ec3dea66956
SSDEEP 98304:aPqi1CiXvwxm3Y1jbJMIaZ6VKmYJslnrcUY4Q2oHxkkvqHcgEBAnhqsN2:XiXpo1Za1PEnQFx2N8gEqhqb
TLSH
T12916F12236EA4032F5B38771787991720AFA7D719D75820F32C1EB1E0971BA15E2A737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

trial_vegaspro14.exe

.exe 4.1MB

trial_vegaspro14.exe

IMPHASH ff020f82da8d55419116224d86c295c0
SHA256 9584c07341d36b617820a78a7581e99c6b2197dd74c37a604f4655d17e73dfd7
MD5 9f69442541fdc2bca8a73b5cf5dd671a
SHA1 ba4a50e5ef172841a5055d421578995c9f7e4fcf
SHA512 855c5fc2f79eeee047462ac389600ea0f99ebf13a7dd5351e7eae6bb8467b554de6a7c779173b90911e7c302e5522fea74e845f4dda57d4fc86c5ec3dea66956
SSDEEP 98304:aPqi1CiXvwxm3Y1jbJMIaZ6VKmYJslnrcUY4Q2oHxkkvqHcgEBAnhqsN2:XiXpo1Za1PEnQFx2N8gEqhqb
TLSH
T12916F12236EA4032F5B38771787991720AFA7D719D75820F32C1EB1E0971BA15E2A737
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

bb:66:9f:69:a5:58:be:31:eb:ec:ee:2b:1f:55:ca:a0:4e:f9:10:8e:89:a8:86:d6:b2:9c:4e:7c:01:52:63:80

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=MAGIX Software GmbH,O=MAGIX Software GmbH,L=Berlin,ST=Berlin,C=DE

Chains

Sep 12, 2016

CN=MAGIX Software GmbH,O=MAGIX Software GmbH,L=Berlin,ST=Berlin,C=DE

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

41:01:59:1a:7e:3f:b7:21:61:a3:85:75:d8:8f:7f:61:7e:0f:ac:7a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=MAGIX Software GmbH,O=MAGIX Software GmbH,L=Berlin,ST=Berlin,C=DE

Chains

Sep 12, 2016

CN=MAGIX Software GmbH,O=MAGIX Software GmbH,L=Berlin,ST=Berlin,C=DE

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=MAGIX Software GmbH,O=MAGIX Software GmbH,L=Berlin,ST=Berlin,C=DE

Serial Number

22:10:a5:53:16:8b:79:96:48:13:c2:c4:64:64:fe:46

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 5, 2015 - Mar 6, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G1,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Apr 11, 2027

Minor OS version

Major OS version

Entry point

317437

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\work\msi\trunk\_MsiBuildSystem\bin\SfxMaker\stub.pdb

kernel32

lstrcmpW LoadLibraryA GlobalAddAtomW GlobalFindAtomW TlsAlloc TlsGetValue TlsSetValue TlsFree GlobalReAlloc GlobalHandle LocalAlloc LocalReAlloc GetCurrentThread lstrcmpA GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW GetFileSizeEx GetFileTime FlushFileBuffers GetFullPathNameW GetVolumeInformationW LockFile UnlockFile DuplicateHandle GetThreadLocale GlobalFlags CompareStringW GetSystemDefaultUILanguage SetErrorMode RtlUnwind CreateThread ExitThread GlobalDeleteAtom IsProcessorFeaturePresent GetSystemTimeAsFileTime ExitProcess GetModuleHandleExW GetCPInfo SetStdHandle GetFileType HeapQueryInformation GetSystemInfo VirtualProtect VirtualQuery GetStartupInfoW GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsValidCodePage GetOEMCP GetStringTypeW GetTimeZoneInformation GetConsoleCP GetConsoleMode ReadConsoleW SetFilePointerEx OutputDebugStringW GetDateFormatW GetTimeFormatW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW WriteConsoleW SetEnvironmentVariableA LoadLibraryExW FreeResource EncodePointer LocalFree GlobalFree GlobalUnlock GlobalLock GlobalAlloc OutputDebugStringA GetACP MulDiv GetVersion lstrlenA CreateProcessW GetCurrentProcess EnumResourceNamesW LoadLibraryW FreeLibrary ResumeThread SuspendThread SetThreadPriority GetDriveTypeW GetCommandLineW GetModuleFileNameW FormatMessageW InitializeCriticalSectionAndSpinCount RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc DecodePointer Sleep GetExitCodeProcess MapViewOfFileEx GetFileAttributesExW FindResourceExW CreateFileMappingW UnmapViewOfFile GetFileAttributesW GetDiskFreeSpaceExW GetUserDefaultLangID GetUserDefaultUILanguage GetLocaleInfoW FindResourceW SizeofResource LoadResource LockResource WaitForMultipleObjects GetStdHandle GetFileInformationByHandle SetFilePointer SetEndOfFile ReadFile WriteFile GetFileSize FindNextFileW FindFirstFileW GetModuleHandleA GetLogicalDriveStringsW FindClose MoveFileW DeleteFileW SetFileAttributesW CreateFileW RemoveDirectoryW CreateDirectoryW GetCurrentDirectoryW GetTempPathW GetSystemDirectoryW GetModuleHandleW SetFileTime SetLastError GetProcAddress FileTimeToLocalFileTime CreateEventW CloseHandle WaitForSingleObject ResetEvent SetEvent InitializeCriticalSection GetLastError GetVersionExW VirtualFree VirtualAlloc FileTimeToSystemTime WideCharToMultiByte MultiByteToWideChar QueryPerformanceCounter EnterCriticalSection GetTickCount GetCurrentThreadId GetCurrentProcessId DeleteCriticalSection LeaveCriticalSection IsDebuggerPresent

user32

GetClassNameW SetWindowLongW GetWindowLongW EqualRect CopyRect MapWindowPoints MessageBoxW AdjustWindowRectEx GetWindowTextLengthW GetWindowTextW RemovePropW GetPropW SetPropW RedrawWindow ValidateRect GetForegroundWindow SetActiveWindow UpdateWindow SetMenu GetMenu GetCapture GetKeyState SetFocus GetDlgCtrlID IsWindowVisible DestroyWindow IsChild CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos DispatchMessageW LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetFocus GetTopWindow EndPaint GetWindowDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW GetMenuItemCount GetMenuItemID GetSubMenu GetParent SendDlgItemMessageA PtInRect IsRectEmpty DrawFrameControl SystemParametersInfoW FillRect GetSysColor InvalidateRect ReleaseDC GetDC ScreenToClient GetClientRect CharUpperW GetDlgItem EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPos IsWindow GetWindowThreadProcessId MsgWaitForMultipleObjects PeekMessageW UnregisterClassW MapDialogRect GetWindowRect SetForegroundWindow ReplyMessage RegisterWindowMessageW DestroyIcon LoadIconW GetLastActivePopup GetWindow SetWindowsHookExW UnhookWindowsHookEx PostThreadMessageW RegisterClipboardFormatW SetRect InvalidateRgn CopyAcceleratorTableW LoadImageW GetSystemMetrics ReleaseCapture SetCapture OffsetRect CharNextW KillTimer ClientToScreen SetTimer EnableWindow SendMessageW PostMessageW DestroyMenu RealChildWindowFromPoint IntersectRect LoadCursorW GetSysColorBrush MessageBeep GetNextDlgGroupItem SetWindowContextHelpId SetCursor PostQuitMessage GetCursorPos TranslateMessage GetMessageW GetDesktopWindow GetActiveWindow GetNextDlgTabItem EndDialog CreateDialogIndirectParamW IsDialogMessageW SetWindowTextW IsWindowEnabled SetDlgItemTextW MoveWindow ShowWindow GetMonitorInfoW MonitorFromWindow WinHelpW BeginPaint CallNextHookEx GetClassLongW

gdi32

GetViewportExtEx GetWindowExtEx PtVisible RectVisible RestoreDC SaveDC ExtSelectClipRgn SelectObject SetBkColor SetMapMode SetTextColor GetStockObject ExtTextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx OffsetViewportOrgEx ScaleViewportExtEx ScaleWindowExtEx CreateRectRgnIndirect GetMapMode GetBkColor GetTextColor GetRgnBox GetClipBox Escape DeleteObject DeleteDC CreateBitmap CreateSolidBrush TextOutW GetObjectW GetDeviceCaps CreateFontIndirectW

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

RegEnumValueW RegQueryValueW RegEnumKeyW RegSetValueExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

ShellExecuteW ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW ord165

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionW PathFindFileNameW PathIsUNCW PathStripToRootW

uxtheme

OpenThemeData CloseThemeData DrawThemeBackground

ole32

CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CoGetClassObject CLSIDFromProgID CLSIDFromString CoCreateGuid OleInitialize CoTaskMemAlloc CoTaskMemFree OleUninitialize CoFreeUnusedLibraries CoCreateInstance CoUninitialize CoInitialize CoRevokeClassObject OleFlushClipboard OleIsCurrentClipboard CoRegisterMessageFilter

oleaut32

SysAllocStringLen SysAllocString SysFreeString VariantChangeType SysStringLen SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy VariantClear OleCreateFontIndirect VariantCopy VariantInit

oledlg

OleUIBusyW

oleacc

LresultFromObject CreateStdAccessibleObject

Sharing

General

Malware Config

Signatures

File Explorer

trial_vegaspro14.exe

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

oleacc

generic