File name: | VideoPad.exe |
Full analysis: | https://app.any.run/tasks/05c9c724-e153-45df-95cf-ac05612f813c |
Verdict: | Malicious activity |
Analysis date: | August 18, 2019, 08:43:02 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 1C216E1D05DB9514ADAD9318F300E012 |
SHA1: | C8157B8AEEB92F4928030482B88979579CBDCFEE |
SHA256: | 28ABDFC20A02F3EB0D5E3E7E46370B0687C661CB91E5E03BAE333CBAC991035D |
SSDEEP: | 98304:nNLSFO+haEIaMWjP/xsjxyj1qrNFrteB:nNSQ+haEIN0mjxy5qX |
.exe | | | InstallShield setup (38.9) |
---|---|---|
.exe | | | Win32 Executable MS Visual C++ (generic) (28.2) |
.exe | | | Win64 Executable (generic) (25) |
.exe | | | Win32 Executable (generic) (4) |
.exe | | | Generic Win/DOS Executable (1.8) |
OriginalFileName: | VideoPad.exe |
---|---|
InternalName: | VideoPad |
LegalCopyright: | NCH Software |
ProductName: | VideoPad |
ProductVersion: | 7.05+ |
FileVersion: | 7.05+ |
FileDescription: | VideoPad Video Editor |
CompanyName: | NCH Software |
CharacterSet: | Unicode |
LanguageCode: | English (Australian) |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x0017 |
ProductVersionNumber: | 0.0.0.0 |
FileVersionNumber: | 0.0.0.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | - |
OSVersion: | 4 |
EntryPoint: | 0x418fba |
UninitializedDataSize: | - |
InitializedDataSize: | 2290688 |
CodeSize: | 4390400 |
LinkerVersion: | 8 |
PEType: | PE32 |
TimeStamp: | 2019:04:01 08:48:21+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 01-Apr-2019 06:48:21 |
Detected languages: |
|
Debug artifacts: |
|
CompanyName: | NCH Software |
FileDescription: | VideoPad Video Editor |
FileVersion: | 7.05+ |
ProductVersion: | 7.05+ |
ProductName: | VideoPad |
LegalCopyright: | NCH Software |
InternalName: | VideoPad |
OriginalFilename: | VideoPad.exe |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000108 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 4 |
Time date stamp: | 01-Apr-2019 06:48:21 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0042FDAC | 0x0042FE00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.56525 |
.rdata | 0x00431000 | 0x000B16AA | 0x000B1800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.41437 |
.data | 0x004E3000 | 0x000556E4 | 0x00008000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.72545 |
.rsrc | 0x00539000 | 0x00175A88 | 0x00175C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.25247 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.14724 | 1648 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 2.25451 | 34 | Latin 1 / Western European | English - United States | RT_GROUP_CURSOR |
3 | 3.66172 | 1384 | Latin 1 / Western European | English - United States | RT_ICON |
4 | 4.6744 | 1128 | Latin 1 / Western European | English - United States | RT_ICON |
5 | 4.75565 | 1384 | Latin 1 / Western European | English - United States | RT_ICON |
6 | 1.3966 | 272 | Latin 1 / Western European | English - United States | RT_ICON |
7 | 1.77993 | 1128 | Latin 1 / Western European | English - United States | RT_ICON |
8 | 1.65506 | 1128 | Latin 1 / Western European | English - United States | RT_ICON |
9 | 0.364749 | 176 | Latin 1 / Western European | English - United States | RT_ICON |
10 | 0.303082 | 1344 | Latin 1 / Western European | English - United States | RT_ICON |
ADVAPI32.dll |
COMCTL32.dll |
DNSAPI.dll |
GDI32.dll |
KERNEL32.dll |
MSACM32.dll |
MSIMG32.dll |
NETAPI32.dll |
OLEAUT32.dll |
OPENGL32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3820 | "C:\Users\admin\AppData\Local\Temp\VideoPad.exe" | C:\Users\admin\AppData\Local\Temp\VideoPad.exe | — | explorer.exe |
User: admin Company: NCH Software Integrity Level: MEDIUM Description: VideoPad Video Editor Exit code: 0 Version: 7.05+ | ||||
3636 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | VideoPad.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3932 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3636 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2412 | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe | — | svchost.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Exit code: 0 Version: 26,0,0,131 | ||||
2224 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | — | VideoPad.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2528 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2224 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3820 | VideoPad.exe | C:\Users\admin\AppData\Roaming\NCH Software\VideoPad\BlurayDataDiscPresets\YouTube%20480p.dat | text | |
MD5:5CCEE930E8D38D3704E66D0DE7010F0D | SHA256:95DE98F2C841E0B491A0BBE048165374D9DFA0E2DD8A8F89F675514F187C570A | |||
3820 | VideoPad.exe | C:\Users\admin\AppData\Roaming\NCH Software\VideoPad\BlurayDataDiscPresets\TV%20NTSC.dat | text | |
MD5:E49AF7829E6B0BDBCCC66EEB87FBCD9A | SHA256:E3AC4C3829C9567FD0637E6DD0D2B65964895C64A7526511B5F56264223CEE0B | |||
3820 | VideoPad.exe | C:\Users\admin\AppData\Roaming\NCH Software\VideoPad\BlurayDataDiscPresets\YouTube%201440p%20%282K%29.dat | text | |
MD5:B2E5A821F2615E9DE2CCB7014B41A43F | SHA256:F82C5E19F0E6EBDD1F28B6B37363D08D981D16BEC00C132567595513A21FD0DD | |||
3820 | VideoPad.exe | C:\Users\admin\AppData\Roaming\NCH Software\VideoPad\BlurayDataDiscPresets\Widescreen%20TV.dat | text | |
MD5:2110DB19CB038EB20066443532B5D663 | SHA256:F74EDF12F797D6CB343A00F1AB78A7304364E7D8DB80B58ADA176F873B30EEF5 | |||
3820 | VideoPad.exe | C:\Users\admin\AppData\Roaming\NCH Software\VideoPad\BlurayDataDiscPresets\HD%202160p%20%284K%29.dat | text | |
MD5:94309D8ACB52B5873B0275195EF44802 | SHA256:EC975E8B01C60A1C6C1576E9F88C74C186FE687D120C8D72F1E73FA229AE6F54 | |||
3820 | VideoPad.exe | C:\Users\admin\AppData\Roaming\NCH Software\VideoPad\BlurayDataDiscPresets\YouTube%201080p%20HD.dat | text | |
MD5:8CE2DB39399C4B7D504A6B3D7EB72EFC | SHA256:7054AA3D056571FC91154B4E0E7C749A4A7EB77552054268CF037E6009031921 | |||
3820 | VideoPad.exe | C:\Users\admin\AppData\Roaming\NCH Software\VideoPad\BlurayDataDiscPresets\HD%201080p.dat | text | |
MD5:8CE2DB39399C4B7D504A6B3D7EB72EFC | SHA256:7054AA3D056571FC91154B4E0E7C749A4A7EB77552054268CF037E6009031921 | |||
3820 | VideoPad.exe | C:\Users\admin\AppData\Roaming\NCH Software\VideoPad\BlurayDataDiscPresets\Internet%20Video.dat | text | |
MD5:6258E44E2DD133B675DD0F8B568E7957 | SHA256:2EBD8179719AEFA66D6E9FE5F261E8D4624F075ACB10E87B9874C51734A560A5 | |||
3820 | VideoPad.exe | C:\Users\admin\AppData\Roaming\NCH Software\VideoPad\BlurayDataDiscPresets\Default.dat | text | |
MD5:8CE2DB39399C4B7D504A6B3D7EB72EFC | SHA256:7054AA3D056571FC91154B4E0E7C749A4A7EB77552054268CF037E6009031921 | |||
3820 | VideoPad.exe | C:\Users\admin\AppData\Roaming\NCH Software\VideoPad\BlurayDataDiscPresets\Facebook%20720p.dat | text | |
MD5:1A8C4C3BC9237B8F9E1566C3D81C7B1F | SHA256:EF0DA233FB01DD486F009B5D4F7AF87E008092125A30C4D20935E942BE965B67 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3636 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3636 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3932 | iexplore.exe | 66.117.15.144:443 | www.nchsoftware.com | InMotion Hosting, Inc. | US | suspicious |
2528 | iexplore.exe | 66.117.15.144:443 | www.nchsoftware.com | InMotion Hosting, Inc. | US | suspicious |
— | — | 192.249.118.22:443 | secure.nch.com.au | InMotion Hosting, Inc. | US | suspicious |
3932 | iexplore.exe | 216.58.201.238:443 | www.google-analytics.com | Google Inc. | US | whitelisted |
3932 | iexplore.exe | 192.249.118.22:443 | secure.nch.com.au | InMotion Hosting, Inc. | US | suspicious |
Domain | IP | Reputation |
---|---|---|
www.bing.com |
| whitelisted |
www.nchsoftware.com |
| malicious |
www.google-analytics.com |
| whitelisted |
secure.nch.com.au |
| suspicious |