home

audition_7_ls20.exe

Adobe Extractor

Adobe Systems Incorporated

This is a setup program which is used to install the application. The file has been seen being downloaded from mega.nz and multiple other hosts.
Publisher:
Adobe Systems Incorporated  (signed and verified)

Product:
Adobe Extractor

Version:
1.0.5.1

MD5:
7e6c6b9eb6e65fe9073322fc1a716a1a

SHA-1:
d1a4fc5a544de44f04f09fedd3e1e4f7e5add8a3

SHA-256:
f9b502e59287e16841610a648be239f4eb0f44f9a8f3b287c05477293e162684

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/16/2024 9:09:33 AM UTC  (today)

File size:
293 MB (307,218,576 bytes)

Product version:
1.02

Copyright:
Copyright(c) 2012 Adobe, Inc.; 7-ZIP DLL Copyright(c) 2012 Igor Pavlov

File type:
Executable application (Win32 EXE)

Digital Signature
Signed by:
Adobe Systems Incorporated

Authority:
Symantec Corporation

Valid from:
1/14/2014 2:00:00 AM

Valid to:
1/8/2016 1:59:59 AM

Subject:
CN=Adobe Systems Incorporated, OU="Audition,Encore,Dynamic Link Media Server", O=Adobe Systems Incorporated, L=San Jose, S=California, C=US, SERIALNUMBER=2748129, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US

Issuer:
CN=Symantec Class 3 Extended Validation Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
0496250D747E948B13C90F16617262F9

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
6291456:xoSW/lzxeaurXvYZrYlvT/hakMC0ybtEY4f1jyEZXJhzsMI7DPy:xo3/ldCXvYtYlvl30ybGYA1TZZ2Jvy

Entry address:
0xDFB0C

Entry point:
55, 8B, EC, B9, 3E, 00, 00, 00, 6A, 00, 6A, 00, 49, 75, F9, 51, 53, 56, 57, B8, 7C, F3, 4D, 00, E8, 0B, 6D, F2, FF, 33, C0, 55, 68, 12, 10, 4E, 00, 64, FF, 30, 64, 89, 20, B8, 00, 01, 00, 00, E8, 03, 91, F9, FF, A3, D8, 15, 50, 00, A1, D8, 15, 50, 00, 50, 68, FF, 00, 00, 00, E8, 22, 71, F2, FF, 8D, 55, E4, A1, D8, 15, 50, 00, E8, CD, 92, F9, FF, 8B, 55, E4, A1, 08, 82, 4E, 00, E8, 70, 4E, F2, FF, A1, C8, 7D, 4E, 00, 8B, 15, 08, 82, 4E, 00, 8B, 12, E8, 5E, 4E, F2, FF, E8, 81, 2F, F2, FF, A1, C8, 7D, 4E, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
898.5 KB (920,064 bytes)

The file audition_7_ls20.exe has been seen being distributed by the following 7 URLs.

https://mega.nz/persistent/.../kp1RCKCY

https://doc-08-8s-docs.googleusercontent.com/docs/securesc/qgumljm057nk95bsjuvme2ae641qri1h/hsat852u9mk71tu20vfmoo76qnnfvivh/1473069600000/07664946124486529320/.../0B3-UpBjpr_EuZTB3enlGUWtjbFE?e=download

http://trials3.adobe.com/AdobeProducts/AUDT/7/.../Audition_7_LS20.exe

http://www.emjcd.com/77104shqp9/hot/65A5857E/76AEEEC/5/CCBC5788D5C657CBE9/7Bg8ABBBkfhg66j8D55CD9DkBED8jfh8?k=pG61=rF6y9GR&IF9=5HHD%RY%Qd%QdHF6y9GR.y1Cz2.0CA%QdY1Cz2nFC1I0HG%QdYsbr%QdV%QdK6BUS%QdYI16H6CB_V_jqQO.2L2<07C!HTWG-VURSEyD<5HHD://KKK.71CEC0M.0CA:WO/09608-QPTXXXV-POTOROQX<<e<5HHD://H52D6FyH2zyM.G2/HCFF2BH/.../Y1Cz2_nFC1I0HG_aa_QOPS_nyH05_ny6BH2p_CB9M_[a56B4j6I]<

http://cj.dotomi.com/ls72efon5/fmr/4383635C/548CCCA/3/3/3?g=evlg=Wuldov6&xuo=kwwsm%5I%5Iwuldov6.dgreh.frp%5IDgrehSurgxfwv%5IDXGW%5IA%5Izlq97%5IDxglwlrq_A_OV53.h0h<<kwws://zzz.mgrtrf1.frp:B3/folfn-548CCCA-4383635C<<J<kwws://wkhsludwhed1.vh/wruuhqw/.../Dgreh_Surgxfwv_FF_5347_Sdwfk_SdlqwhU_rqo1_[FklqjOlx]<

http://www.jdoqocy.com/click-2159997-10503029?sid=Trials3&url=http://trials3.adobe.com/AdobeProducts/AUDT/7/.../Audition_7_LS20.exe

http://prodesigntools.com/trials3/AdobeProducts/AUDT/7/.../Audition_7_LS20.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.