notepad++[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

notepad++.exe
Size

2.7MB
MD5

40c4de71c760467cb9a02b446177f1bf
SHA1

c74727774450c4e770de461137a92b3c9fb11744
SHA256

822dbe60421ceaf253bd44b0a7d5ac19aae4d6ba789e816c2eb962fb06cea78c
SHA512

cb3bd13bfc2fc68452515127d7e759c52df5a66e1515d896fc5ed1292724e07ddff73b4e90427b8957f0505107741f6bb8e03ea8816fbc03e8ed0d8a7250ad24
SSDEEP

49152:LfdlrEB1ntModO7v1nt/D/DxdPWYuB4TJqjStH3oc3qdLrTaraLNCs6nAnXczbHc:vLBlbFZuJPT7Lwv/1kB

Score

1^/10

Malware Config

Signatures

Files

notepad++.exe
.exe windows x86

b1bfba3268f10da53fd89fd5f92236fe

Code Sign

01:34:25:92:a0:01:0c:b1:10:9c:11:c0:51:9c:fd:24
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

03/05/2019, 00:00

Not After

11/05/2022, 12:00

Subject

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e1:b1:e9:68:26:65:f9:80:ec:8d:28:47:82:e7:18:a1:c4:ff:d0:b9
Signer

Actual PE Digest

e1:b1:e9:68:26:65:f9:80:ec:8d:28:47:82:e7:18:a1:c4:ff:d0:b9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_DragMove
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_SetIconSize
ord17
ImageList_AddMasked
ImageList_GetImageCount
InitCommonControlsEx
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Create
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_DragShowNolock
ImageList_Draw

shlwapi

PathStripPathW
PathAddExtensionW
PathIsDirectoryW
PathRemoveExtensionW
AssocQueryStringW
PathMatchSpecW
PathIsRelativeW
PathGetDriveNumberW
PathCompactPathExW
PathFindExtensionW
PathFileExistsW
PathRemoveFileSpecW
PathFindFileNameW
PathAppendW

shell32

DragQueryPoint
CommandLineToArgvW
Shell_NotifyIconW
SHFileOperationW
SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW
DragQueryFileW
DragFinish
ShellExecuteW
ord165
SHGetFolderPathW

dbghelp

ImageNtHeader

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

crypt32

CryptQueryObject
CertGetNameStringW
CertNameToStrW
CertGetCertificateContextProperty
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CryptMsgClose

wintrust

WinVerifyTrust

sensapi

IsDestinationReachableW
IsNetworkAlive

kernel32

GetFullPathNameW
SetFileAttributesW
GetFileAttributesExW
DeleteFileW
MoveFileExW
GetTimeFormatW
GetDateFormatW
GlobalLock
GlobalUnlock
GlobalAlloc
FormatMessageW
GetCurrentDirectoryW
LCMapStringW
LockResource
FreeLibrary
LoadResource
SizeofResource
lstrcmpiW
LoadLibraryExW
FindResourceW
GetCurrentThreadId
SetCurrentDirectoryW
InterlockedIncrement
InterlockedDecrement
CreateThread
SetEvent
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventW
CopyFileW
GetCurrentProcess
GetCurrentProcessId
LoadLibraryW
CreateFileW
GlobalSize
ReleaseMutex
Sleep
CreateMutexW
lstrcpynW
WaitForMultipleObjects
ExpandEnvironmentStringsW
GetSystemInfo
GetVersionExW
CreateDirectoryW
UnmapViewOfFile
CreateFileMappingW
GetLocalTime
GetACP
SetLastError
GetTempPathW
QueueUserAPC
SleepEx
WaitForSingleObjectEx
CancelIo
ReadDirectoryChangesW
RaiseException
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
DuplicateHandle
VirtualProtect
VirtualFree
VirtualAlloc
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
GetCurrentThread
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
CompareStringW
GetTickCount
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
DecodePointer
EncodePointer
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetStringTypeW
lstrcpyW
CompareFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetLongPathNameW
FindNextFileW
FindFirstFileW
GetFileAttributesW
lstrlenW
lstrcmpW
FindClose
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameW
GlobalFree
GetVersion
GetProcAddress
GetModuleHandleW
MulDiv
OutputDebugStringW
GetLastError
LocalFree
LocalAlloc
RtlUnwind
ReadFile
ExitProcess
GetModuleHandleExW
ExitThread
HeapAlloc
HeapFree
HeapReAlloc
GetStdHandle
WriteFile
GetFileType
GetConsoleMode
ReadConsoleW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
SetFilePointerEx
FlushFileBuffers
GetConsoleCP
IsValidCodePage
GetOEMCP
GetProcessHeap
FindFirstFileExW
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
HeapSize
SetEndOfFile
MapViewOfFile

user32

CreateAcceleratorTableW
FindWindowW
CreateDialogIndirectParamW
SystemParametersInfoW
TrackMouseEvent
GetCapture
SetRectEmpty
AppendMenuW
RegisterWindowMessageW
ShowCursor
CreateCursor
DestroyCursor
ScrollWindow
SetPropW
GetPropW
RemovePropW
SetScrollInfo
InsertMenuItemW
LoadStringW
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
LoadIconW
GetDesktopWindow
PtInRect
WindowFromPoint
LockWindowUpdate
GetDCEx
mouse_event
SetDlgItemInt
LoadBitmapW
GetSysColorBrush
MapWindowPoints
MessageBoxA
AdjustWindowRectEx
GetWindowTextLengthW
TrackPopupMenu
FlashWindowEx
RegisterClassExW
UnregisterClassW
PostQuitMessage
DispatchMessageW
TranslateMessage
GetMessageW
GetWindowTextW
ReleaseCapture
SetCapture
GetDlgCtrlID
IsChild
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
SetParent
GetCursorPos
RedrawWindow
InsertMenuW
EnableMenuItem
CheckMenuItem
DestroyMenu
CreatePopupMenu
CreateMenu
GetMenuState
ScreenToClient
EmptyClipboard
SetClipboardData
IsWindow
GetDlgItemInt
FrameRect
FillRect
DrawFocusRect
IsCharAlphaW
InflateRect
GetClassNameA
ClientToScreen
GetWindowRect
IsWindowVisible
ShowWindow
IsClipboardFormatAvailable
RegisterClipboardFormatW
GetClipboardData
ChangeClipboardChain
SetClipboardViewer
CloseClipboard
OpenClipboard
LoadCursorW
GetParent
CharLowerW
CharUpperW
DrawIcon
SetCaretPos
ShowCaret
HideCaret
DestroyCaret
CreateCaret
SetCursor
MessageBeep
GetClientRect
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
UpdateWindow
DrawTextExW
DrawTextW
GetMenu
GetSystemMetrics
ToAscii
GetKeyboardState
GetFocus
SetWindowPlacement
GetWindowPlacement
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PostMessageW
DrawFrameControl
DrawEdge
SetWindowPos
SetFocus
MoveWindow
DrawIconEx
LoadImageW
EnableWindow
GetKeyState
SendDlgItemMessageW
EndDialog
DialogBoxIndirectParamW
DialogBoxParamW
SetWindowLongW
GetWindowLongW
SetWindowTextW
GetDlgItemTextW
SetDlgItemTextW
SetDlgItemTextA
GetDlgItem
CallWindowProcW
SendMessageW
MessageBoxW
wsprintfW
IsCharLowerW
GetSysColor
IsCharAlphaNumericW
GetDlgItemTextA
GetClassNameW
LoadMenuW
IsDialogMessageW
SetMenu
RealChildWindowFromPoint
GetMonitorInfoW
MonitorFromWindow
CheckMenuRadioItem
SetForegroundWindow
SetMenuItemInfoW
GetMenuItemInfoW
DeleteMenu
GetMenuItemCount
DrawMenuBar
GetMenuStringW
TranslateAcceleratorW
DestroyAcceleratorTable
IsZoomed
IsIconic
ModifyMenuW
GetMenuItemID
GetSubMenu
RemoveMenu
CreateDialogParamW
DestroyIcon
GetActiveWindow

gdi32

CreateBitmap
CreatePatternBrush
PatBlt
SetBrushOrgEx
EnumFontFamiliesExW
SetTextAlign
SetWindowOrgEx
GetDeviceCaps
CreateFontIndirectW
GetObjectW
SaveDC
RestoreDC
BitBlt
GetPixel
CreateHatchBrush
DeleteDC
StartDocW
EndDoc
StartPage
EndPage
ExtTextOutW
DPtoLP
GetTextExtentPointW
StretchBlt
CreateCompatibleDC
CreateCompatibleBitmap
MoveToEx
LineTo
SetBkColor
GetTextMetricsW
SetTextColor
SetROP2
SetBkMode
SelectObject
Rectangle
GetTextExtentPoint32W
GetStockObject
GetROP2
DeleteObject
CreateSolidBrush
CreatePen
CreateFontW
OffsetWindowOrgEx
CreateFontA

comdlg32

PrintDlgW
GetSaveFileNameW
GetOpenFileNameW
ChooseColorW

advapi32

RegOpenKeyExW
RegQueryValueExW
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
IsTextUnicode
RegCloseKey

ole32

CoInitialize
CoUninitialize

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 451KB - Virtual size: 450KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 681KB - Virtual size: 681KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b1bfba3268f10da53fd89fd5f92236fe

Code Sign

01:34:25:92:a0:01:0c:b1:10:9c:11:c0:51:9c:fd:24Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

e1:b1:e9:68:26:65:f9:80:ec:8d:28:47:82:e7:18:a1:c4:ff:d0:b9Signer

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

shlwapi

shell32

dbghelp

version

crypt32

wintrust

sensapi

kernel32

user32

gdi32

comdlg32

advapi32

ole32

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 451KB - Virtual size: 450KB

.data Size: 32KB - Virtual size: 106KB

.gfids Size: 4KB - Virtual size: 3KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 681KB - Virtual size: 681KB

.reloc Size: 80KB - Virtual size: 80KB

01:34:25:92:a0:01:0c:b1:10:9c:11:c0:51:9c:fd:24
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

e1:b1:e9:68:26:65:f9:80:ec:8d:28:47:82:e7:18:a1:c4:ff:d0:b9
Signer

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 451KB - Virtual size: 450KB

.data
Size: 32KB - Virtual size: 106KB

.gfids
Size: 4KB - Virtual size: 3KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 681KB - Virtual size: 681KB

.reloc
Size: 80KB - Virtual size: 80KB