PresentationHostDLL[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

PresentationHostDLL.dll
Size

168KB
MD5

8054f43af43399c1df2f431190ac9588
SHA1

f7cfd277166dd3677c0a9ff671a41afcdb7ca3c2
SHA256

e7c9a59e36a706afe60ef6f98ad471af03abf83ea0838d27d8889354a8969927
SHA512

9b0c17465893e8f45dbd65748ccf76654b7c3163132e8f3b1eb31b6ffb13e022af41c3555d538e73582313ac9d37c87cc923f9d26ee7bb43d74a73de8d2c2e77
SSDEEP

3072:6BWyhgeeX73Vr4KzHZVr+cJG2uEBY5FUGRGvaKOLbjKQ+6iuQhh:S5s733TPVJG22tR6OLHV8h

Score

1^/10

Malware Config

Signatures

Files

PresentationHostDLL.dll
.dll windows:5 windows x64 arch:x64

d1d418a2988538eeaf489bb07da5a277

Code Sign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:32

Not After

10/01/2013, 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e4:78:f7:8e:ce:85:f9:83:a9:b1:51:1e:b9:66:54:b0:ee:ec:ca:ae
Signer

Actual PE Digest

e4:78:f7:8e:ce:85:f9:83:a9:b1:51:1e:b9:66:54:b0:ee:ec:ca:ae

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
OpenProcessToken
GetTokenInformation
GetSidSubAuthority
GetSidSubAuthorityCount
RegisterTraceGuidsW
GetTraceEnableLevel
TraceEvent
GetTraceLoggerHandle

kernel32

DisableThreadLibraryCalls
SetEvent
CreateEventW
GetLastError
QueueUserWorkItem
RaiseException
WaitForSingleObject
GlobalAlloc
ExitProcess
GetSystemDirectoryW
LockResource
CreateToolhelp32Snapshot
GetCurrentProcessId
Module32FirstW
Module32NextW
CloseHandle
lstrcmpW
MulDiv
GlobalUnlock
GlobalLock
GetCurrentProcess
FlushInstructionCache
EnterCriticalSection
LeaveCriticalSection
CreateMutexW
ReleaseMutex
WaitForMultipleObjects
GetProcAddress
GetProcessTimes
GetSystemTimeAsFileTime
LoadLibraryW
FindFirstFileW
FindClose
GetUserDefaultLangID
OpenProcess
LocalAlloc
LocalFree
TerminateProcess
RegisterWaitForSingleObject
SetLastError
GetCurrentThread
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
lstrcmpiW
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
lstrlenW
GetModuleHandleW
GetModuleFileNameW
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
QueryPerformanceCounter
GetTickCount
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
InterlockedPushEntrySList
SetEnvironmentVariableW
HeapFree
HeapAlloc
GetProcessHeap
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
GetVersionExW
FindResourceExW
MapViewOfFile
CreateFileMappingW
CreateFileW
UnmapViewOfFile
GetLocaleInfoW
ResumeThread
SuspendThread
VirtualProtect
VirtualQuery
SetThreadContext
GetThreadContext
DeleteTimerQueueTimer
OutputDebugStringW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
SearchPathW

msvcr80

memset
memcpy
bsearch
_CxxThrowException
wcscpy_s
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__clean_type_info_names_internal
__crt_debugger_hook
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
__C_specific_handler
_wcslwr_s
_ultow_s
swprintf_s
wcschr
wcsstr
wcsncmp
_beginthreadex
_purecall
_recalloc
memcmp
free
_wcsnicmp
memcpy_s
wcsncpy_s
_wcsicmp
??_V@YAXPEAX@Z
??3@YAXPEAX@Z
malloc
_callnewh
_encoded_null
_vsnwprintf

user32

LoadCursorW
GetMenuItemCount
GetSubMenu
GetMenuItemID
CharNextW
GetMessageExtraInfo
MsgWaitForMultipleObjects
PeekMessageW
DispatchMessageW
SetMessageExtraInfo
GetKeyState
DefWindowProcW
PostMessageW
CheckMenuItem
GetClassNameW
TranslateMessage
DestroyWindow
GetWindow
GetWindowThreadProcessId
GetClassInfoW
RegisterClassExW
UnregisterClassA
EnableMenuItem
GetMenuItemInfoW
LoadStringW
DestroyMenu
RemoveMenu
LoadMenuW
InsertMenuW
GetMenuStringW
CreateMenu
KillTimer
RegisterRawInputDevices
SetWindowLongPtrW
SetParent
MessageBoxW
CallWindowProcW
RegisterClassW
GetClientRect
CreateWindowExW
SetFocus
ShowWindow
PostThreadMessageW
MoveWindow
GetWindowLongPtrW
GetDesktopWindow
InvalidateRgn
GetClassInfoExW
InvalidateRect
ReleaseCapture
SetCapture
ScreenToClient
GetMessageW
SetTimer
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetWindowLongW
SetWindowLongW
DestroyAcceleratorTable
GetSysColor
BeginPaint
FillRect
EndPaint
GetDC
ReleaseDC
IsChild
GetFocus
IsWindow
GetDlgItem
SendMessageW
RedrawWindow
GetParent
SetWindowPos
CreateAcceleratorTableW
ClientToScreen

gdi32

BitBlt
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteDC
DeleteObject
GetDeviceCaps
GetStockObject
GetObjectW

ole32

CoGetClassObject
CoTaskMemRealloc
CoTaskMemAlloc
CreateBindCtx
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoAllowSetForegroundWindow
CoReleaseMarshalData
OleUninitialize
CLSIDFromString
CLSIDFromProgID
OleLockRunning
StringFromGUID2
CreateStreamOnHGlobal
OleInitialize
CoMarshalInterThreadInterfaceInStream
CoTaskMemFree
OleTranslateAccelerator
CoUnmarshalInterface
CoCreateInstance

oleaut32

VariantInit
VariantCopy
SysAllocStringLen
SysStringByteLen
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
DispCallFunc
VariantClear
SysAllocStringByteLen
VarUI4FromStr
SysStringLen
SysFreeString
SysAllocString

mscoree

CorBindToRuntimeEx

shlwapi

PathCombineW

wininet

InternetErrorDlg
InternetSetCookieExW
InternetGetCookieExW

urlmon

UrlMkGetSessionOption
URLOpenBlockingStreamW
CoInternetParseUrl
CreateURLMoniker
CompareSecurityIds

shell32

SHGetFolderPathW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

psapi

GetMappedFileNameW

Exports

Exports

Activate
CreateIDispatchSTAForwarder
DRMCloseEnvironmentHandle
DRMCloseHandle
DRMCreateBoundLicense
DRMCreateEnablingBitsDecryptor
DRMCreateEnablingBitsEncryptor
DRMCreateLicenseStorageSession
DRMDecrypt
DRMEncrypt
DRMGetBoundLicenseAttribute
DRMGetBoundLicenseObject
DRMGetBoundLicenseObjectCount
DRMGetInfo
DRMGetServiceLocation
DRMGetSignedIssuanceLicense
DRMInitEnvironment
Deactivate
DllMain
ForwardTranslateAccelerator
LoadFromHistory
ProcessUnhandledException
SaveToHistory

Sections

.text
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d1d418a2988538eeaf489bb07da5a277

Code Sign

61:19:cc:93:00:01:00:00:00:66Certificate

Extended Key Usages

Key Usages

61:02:92:4a:00:00:00:00:00:20Certificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

e4:78:f7:8e:ce:85:f9:83:a9:b1:51:1e:b9:66:54:b0:ee:ec:ca:aeSigner

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcr80

user32

gdi32

ole32

oleaut32

mscoree

shlwapi

wininet

urlmon

shell32

version

psapi

Exports

Exports

Sections

.text Size: 94KB - Virtual size: 94KB

.rdata Size: 54KB - Virtual size: 53KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 5KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

61:19:cc:93:00:01:00:00:00:66
Certificate

61:02:92:4a:00:00:00:00:00:20
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

e4:78:f7:8e:ce:85:f9:83:a9:b1:51:1e:b9:66:54:b0:ee:ec:ca:ae
Signer

.text
Size: 94KB - Virtual size: 94KB

.rdata
Size: 54KB - Virtual size: 53KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB