FreePDFCreator[.]7z

Sharing

Copy URL Twitter E-mail

General

Target

FreePDFCreator.7z
Size

1.5MB
MD5

e2a7076ef9a8d0cd2ed52258a1c1b3f9
SHA1

b237bed79afb3feb506f1038c115e4d1efb46cbe
SHA256

4214a3cc39081253660b4ca1823efb0f5439eff776f532cdf6a55a15777cc9e1
SHA512

24c0fa0ca2c120577528ad9b621a1abc8ee0d988e7a55a22a384181f2cc602f13122c65dc405a95ebb0aa5564429332786b0e0a3c4218e101e59a959ce2ff3a5
SSDEEP

24576:KEzY+nYlKjXFAHF8evFJZjTNslv4MsVTt4/YlGKleJMAieoc53G0:KEXnjaWevN3KlQ3TtdlReRac5f

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/FreePDFCreator/FreePDFCreator.exe
unpack001/FreePDFCreator/JetBrains.Annotations.dll
unpack001/FreePDFCreator/Uninstall.exe

Files

FreePDFCreator.7z
.7z

Password: Infected2024
FreePDFCreator/FreePDFCreator.exe
.exe windows:4 windows x86 arch:x86

Password: Infected2024

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\BridgeDev\freepdfcreator\FreePDFCreator\FreePDFCreator\obj\Release\FreePDFCreator.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/BrowserMetrics/BrowserMetrics-659ED449-2674.pma
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Crashpad/settings.dat
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Crashpad/throttle_store.dat
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/AssistanceHome/AssistanceHomeSQLite
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_0
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_1
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_2
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_3
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Cache/Cache_Data/f_000001
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Cache/Cache_Data/f_000002
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Cache/Cache_Data/f_000003
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Cache/Cache_Data/index
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Code Cache/js/afa1a02b2695cf13_0
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Code Cache/js/fb8750a782aa8525_0
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Code Cache/js/index
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Code Cache/js/index-dir/the-real-index
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Code Cache/wasm/index
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Code Cache/wasm/index-dir/the-real-index
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/DIPS
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/DawnCache/data_0
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/DawnCache/data_1
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/DawnCache/data_2
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/DawnCache/data_3
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/DawnCache/index
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/EdgeEDrop/EdgeEDropSQLite.db
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/EdgeHubAppUsage/EdgeHubAppUsageSQLite.db
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Extension Rules/000003.log
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Extension Rules/CURRENT
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Extension Rules/LOG
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Extension Rules/MANIFEST-000001
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Extension Scripts/000003.log
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Extension Scripts/CURRENT
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Extension Scripts/LOG
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Extension Scripts/MANIFEST-000001
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Extension State/000003.log
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Extension State/CURRENT
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Extension State/LOG
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Extension State/LOG.old
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Extension State/MANIFEST-000001
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/ExtensionActivityComp
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/ExtensionActivityEdge
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Favicons
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/GPUCache/data_0
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/GPUCache/data_1
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/GPUCache/data_2
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/GPUCache/data_3
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/GPUCache/index
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/History
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/HubApps Icons
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Local Storage/leveldb/CURRENT
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Local Storage/leveldb/LOG
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Local Storage/leveldb/LOG.old
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Local Storage/leveldb/MANIFEST-000001
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Login Data
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Network Action Predictor
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Network/Cookies
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Network/Network Persistent State
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Network/Reporting and NEL
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Network/SCT Auditing Pending Reports
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Network/Sdch Dictionaries
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Network/TransportSecurity
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Network/Trust Tokens
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Preferences
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/PreferredApps
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/README
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/SCT Auditing Pending Reports
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Sdch Dictionaries
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Secure Preferences
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Session Storage/000003.log
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Session Storage/CURRENT
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Session Storage/LOG
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Session Storage/LOG.old
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Session Storage/MANIFEST-000001
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Shared Dictionary/cache/index
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Shared Dictionary/cache/index-dir/the-real-index
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Shared Dictionary/db
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Site Characteristics Database/000003.log
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Site Characteristics Database/CURRENT
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Site Characteristics Database/LOG
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Site Characteristics Database/LOG.old
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Site Characteristics Database/MANIFEST-000001
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/000003.log
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/CURRENT
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/LOG
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/LOG.old
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/MANIFEST-000001
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Top Sites
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Visited Links
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/Web Data
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/heavy_ad_intervention_opt_out.db
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/shared_proto_db/000003.log
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/shared_proto_db/CURRENT
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/shared_proto_db/LOG
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/shared_proto_db/LOG.old
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/shared_proto_db/MANIFEST-000001
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/000003.log
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/CURRENT
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/LOG
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/LOG.old
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/MANIFEST-000001
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/GrShaderCache/data_0
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/GrShaderCache/data_1
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/GrShaderCache/data_2
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/GrShaderCache/data_3
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/GrShaderCache/index
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/GraphiteDawnCache/data_0
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/GraphiteDawnCache/data_1
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/GraphiteDawnCache/data_2
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/GraphiteDawnCache/data_3
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/GraphiteDawnCache/index
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Last Version
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Local State
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/ShaderCache/data_0
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/ShaderCache/data_1
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/ShaderCache/data_2
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/ShaderCache/data_3
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/ShaderCache/index
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/SmartScreen/RemoteData/customSettings
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/SmartScreen/RemoteData/customSettings_F95BA787499AB4FA9EFFF472CE383A14
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/SmartScreen/RemoteData/customSynchronousLookupUris
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/SmartScreen/RemoteData/customSynchronousLookupUris_0
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/SmartScreen/RemoteData/edgeSettings
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/SmartScreen/RemoteData/edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/SmartScreen/RemoteData/synchronousLookupUris
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/SmartScreen/RemoteData/synchronousLookupUris_638343870221005468
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/SmartScreen/RemoteData/topTraffic
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/SmartScreen/RemoteData/topTraffic_638004170464094982
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/SmartScreen/local/downloadCache
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/SmartScreen/local/downloadCache_
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/SmartScreen/local/uriCache
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/SmartScreen/local/uriCache_
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Snapshots/119.0.2151.72/Default/Cookies
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Snapshots/119.0.2151.72/Default/Favicons
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Snapshots/119.0.2151.72/Default/History
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Snapshots/119.0.2151.72/Default/Login Data
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Snapshots/119.0.2151.72/Default/Preferences
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Snapshots/119.0.2151.72/Default/Secure Preferences
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Snapshots/119.0.2151.72/Default/Sync Data/LevelDB/000003.log
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Snapshots/119.0.2151.72/Default/Sync Data/LevelDB/CURRENT
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Snapshots/119.0.2151.72/Default/Sync Data/LevelDB/LOG
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Snapshots/119.0.2151.72/Default/Sync Data/LevelDB/MANIFEST-000001
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Snapshots/119.0.2151.72/Default/Web Data
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Snapshots/119.0.2151.72/Last Version
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Snapshots/119.0.2151.72/Local State
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/Variations
FreePDFCreator/FreePDFCreator.exe.WebView2/EBWebView/segmentation_platform/ukm_db
FreePDFCreator/FreePDFCreator.exe.config
FreePDFCreator/FreePDFCreator.pdb
FreePDFCreator/JetBrains.Annotations.dll
.dll .js windows:4 windows x86 arch:x86 polyglot

Password: Infected2024

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/src/obj/Release/net20/JetBrains.Annotations.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FreePDFCreator/Microsoft.Web.WebView2.Core.dll
.dll windows:4 windows x86 arch:x86

Password: Infected2024

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/02/2023, 20:10

Not After

31/01/2024, 20:10

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ee:d9:4b:08:e4:4a:80:98:9c:e4:7d:e7:6c:7d:cf:84:a3:c8:80:ef:c9:4e:fe:d9:b2:91:74:88:d3:b0:8a:e3
Signer

Actual PE Digest

ee:d9:4b:08:e4:4a:80:98:9c:e4:7d:e7:6c:7d:cf:84:a3:c8:80:ef:c9:4e:fe:d9:b2:91:74:88:d3:b0:8a:e3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\PrereleasePackage\Microsoft.Web.WebView2.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 675KB - Virtual size: 675KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FreePDFCreator/Microsoft.Web.WebView2.WinForms.dll
.dll windows:4 windows x86 arch:x86

Password: Infected2024

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:3c:2b:0a:49:d9:d2:91:7e:ac:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/02/2023, 20:10

Not After

31/01/2024, 20:10

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a6:5f:a5:19:0d:39:03:20:ba:a0:72:0a:e6:7b:42:a0:be:65:33:84:a5:59:bf:26:b4:b7:b0:4f:1c:1e:9e:17
Signer

Actual PE Digest

a6:5f:a5:19:0d:39:03:20:ba:a0:72:0a:e6:7b:42:a0:be:65:33:84:a5:59:bf:26:b4:b7:b0:4f:1c:1e:9e:17

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\third_party\edge_webview2\win\winforms_control\Microsoft.Web.WebView2.WinForms\obj\Release Experimental APIs\net45\Microsoft.Web.WebView2.WinForms.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FreePDFCreator/Microsoft.Web.WebView2.Wpf.dll
.dll windows:4 windows x86 arch:x86

Password: Infected2024

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:3c:2b:0a:49:d9:d2:91:7e:ac:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/02/2023, 20:10

Not After

31/01/2024, 20:10

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

31:bb:a5:cf:b2:9d:61:21:e0:aa:ef:e3:ed:d9:f5:07:fa:db:d3:02:bc:14:9d:f8:2e:ad:3a:1b:0b:63:dc:a5
Signer

Actual PE Digest

31:bb:a5:cf:b2:9d:61:21:e0:aa:ef:e3:ed:d9:f5:07:fa:db:d3:02:bc:14:9d:f8:2e:ad:3a:1b:0b:63:dc:a5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\Release Experimental APIs\net45\Microsoft.Web.WebView2.Wpf.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FreePDFCreator/Microsoft.Xaml.Behaviors.dll
.dll windows:4 windows x86 arch:x86

Password: Infected2024

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b2:63:8a:cb:ae:08:38:57:4d:ee:95:eb:a6:58:3b:10:80:3d:86:3e:1c:8f:0d:12:62:f5:87:f8:01:ae:17:30
Signer

Actual PE Digest

b2:63:8a:cb:ae:08:38:57:4d:ee:95:eb:a6:58:3b:10:80:3d:86:3e:1c:8f:0d:12:62:f5:87:f8:01:ae:17:30

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\src\Microsoft.Xaml.Behaviors\obj\Release\net462\Microsoft.Xaml.Behaviors.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FreePDFCreator/Microsoft.Xaml.Behaviors.pdb
FreePDFCreator/Newtonsoft.Json.dll
.dll windows:4 windows x86 arch:x86

Password: Infected2024

dae02f32a21e03ce65412f6e56942daa

Code Sign

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Certificate

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Not Before

15/01/2021, 00:00

Not After

14/01/2046, 23:59

Subject

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Certificate

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Not Before

15/07/2021, 00:00

Not After

14/07/2031, 23:59

Subject

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Certificate

Issuer

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Not Before

13/08/2021, 00:00

Not After

29/10/2024, 23:59

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Signer

Actual PE Digest

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 681KB - Virtual size: 680KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FreePDFCreator/System.ComponentModel.Annotations.dll
.dll windows:4 windows x86 arch:x86

Password: Infected2024

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:bf:91:6c:fb:7c:1a:24:e0:22:00:00:00:00:00:bf
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:57C8-2D15-1C8B,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:20

Not After

11/08/2018, 20:20

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:90:d3:b6:dd:87:df:4e:84:6f:b5:22:f4:f6:9c:c6:e6:fd:34:f3:6b:0a:66:83:1d:4b:6c:06:60:25:a2:05
Signer

Actual PE Digest

5f:90:d3:b6:dd:87:df:4e:84:6f:b5:22:f4:f6:9c:c6:e6:fd:34:f3:6b:0a:66:83:1d:4b:6c:06:60:25:a2:05

Digest Algorithm

sha256

PE Digest Matches

true

c3:31:16:77:dd:f7:23:e7:e9:f0:6b:b3:3c:f4:65:e7:13:97:71:ed
Signer

Actual PE Digest

c3:31:16:77:dd:f7:23:e7:e9:f0:6b:b3:3c:f4:65:e7:13:97:71:ed

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.ComponentModel.Annotations/netfx\System.ComponentModel.Annotations.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FreePDFCreator/Uninstall.exe
.exe windows:4 windows x86 arch:x86

56a78d55f3f7af51443e58e0ce2fb5f6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
CreateFileW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 156KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
FreePDFCreator/runtimes/win-x64/native/WebView2Loader.dll
.dll windows:5 windows x64 arch:x64

aaa8a1994a594e4746a652eda600aebf

Code Sign

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/02/2023, 20:10

Not After

31/01/2024, 20:10

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

56:ed:1c:16:a8:82:ef:b1:61:db:86:93:51:06:84:48:09:f2:5a:ae:b0:60:03:a9:52:67:a8:25:0a:28:f6:48
Signer

Actual PE Digest

56:ed:1c:16:a8:82:ef:b1:61:db:86:93:51:06:84:48:09:f2:5a:ae:b0:60:03:a9:52:67:a8:25:0a:28:f6:48

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\e\src\out\Release_x64\WebView2Loader.dll.pdb

Imports

kernel32

CloseHandle
CreateEventW
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile

Exports

Exports

CompareBrowserVersions
CreateCoreWebView2Environment
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString

Sections

.text
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gxfg
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.retplne
Size: 512B - Virtual size: 140B

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FreePDFCreator/runtimes/win-x86/native/WebView2Loader.dll
.dll windows:5 windows x86 arch:x86

608537c42a46a95b31cc1ef01ab6eeb0

Code Sign

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/02/2023, 20:10

Not After

31/01/2024, 20:10

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:d0:d1:29:ee:da:2d:ab:68:48:69:cc:20:be:3e:c3:4b:b3:eb:67:83:cc:b0:5e:bf:8b:ba:ca:be:41:b7:5d
Signer

Actual PE Digest

1d:d0:d1:29:ee:da:2d:ab:68:48:69:cc:20:be:3e:c3:4b:b3:eb:67:83:cc:b0:5e:bf:8b:ba:ca:be:41:b7:5d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\e\src\out\Release\WebView2Loader.dll.pdb

Imports

kernel32

CloseHandle
CreateEventW
CreateFileW
DecodePointer
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ResetEvent
RtlUnwind
SetEvent
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile

Exports

Exports

CompareBrowserVersions
CreateCoreWebView2Environment
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: Infected2024

Password: Infected2024

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 167KB - Virtual size: 166KB

.rsrc Size: 114KB - Virtual size: 114KB

.reloc Size: 512B - Virtual size: 12B

Password: Infected2024

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 104KB - Virtual size: 103KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

Password: Infected2024

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3eCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

ee:d9:4b:08:e4:4a:80:98:9c:e4:7d:e7:6c:7d:cf:84:a3:c8:80:ef:c9:4e:fe:d9:b2:91:74:88:d3:b0:8a:e3Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 675KB - Virtual size: 675KB

.rsrc Size: 1024B - Virtual size: 1000B

.reloc Size: 512B - Virtual size: 12B

Password: Infected2024

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:3c:2b:0a:49:d9:d2:91:7e:ac:00:00:00:00:03:3cCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

a6:5f:a5:19:0d:39:03:20:ba:a0:72:0a:e6:7b:42:a0:be:65:33:84:a5:59:bf:26:b4:b7:b0:4f:1c:1e:9e:17Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 27KB - Virtual size: 26KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

Password: Infected2024

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:3c:2b:0a:49:d9:d2:91:7e:ac:00:00:00:00:03:3cCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

31:bb:a5:cf:b2:9d:61:21:e0:aa:ef:e3:ed:d9:f5:07:fa:db:d3:02:bc:14:9d:f8:2e:ad:3a:1b:0b:63:dc:a5Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

.text
Size: 167KB - Virtual size: 166KB

.rsrc
Size: 114KB - Virtual size: 114KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 104KB - Virtual size: 103KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3e
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

ee:d9:4b:08:e4:4a:80:98:9c:e4:7d:e7:6c:7d:cf:84:a3:c8:80:ef:c9:4e:fe:d9:b2:91:74:88:d3:b0:8a:e3
Signer

.text
Size: 675KB - Virtual size: 675KB

.rsrc
Size: 1024B - Virtual size: 1000B

.reloc
Size: 512B - Virtual size: 12B

33:00:00:03:3c:2b:0a:49:d9:d2:91:7e:ac:00:00:00:00:03:3c
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

a6:5f:a5:19:0d:39:03:20:ba:a0:72:0a:e6:7b:42:a0:be:65:33:84:a5:59:bf:26:b4:b7:b0:4f:1c:1e:9e:17
Signer

.text
Size: 27KB - Virtual size: 26KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

33:00:00:03:3c:2b:0a:49:d9:d2:91:7e:ac:00:00:00:00:03:3c
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

31:bb:a5:cf:b2:9d:61:21:e0:aa:ef:e3:ed:d9:f5:07:fa:db:d3:02:bc:14:9d:f8:2e:ad:3a:1b:0b:63:dc:a5
Signer

.text
Size: 34KB - Virtual size: 34KB

.rsrc
Size: 1024B - Virtual size: 984B

.reloc
Size: 512B - Virtual size: 12B

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

b2:63:8a:cb:ae:08:38:57:4d:ee:95:eb:a6:58:3b:10:80:3d:86:3e:1c:8f:0d:12:62:f5:87:f8:01:ae:17:30
Signer

.text
Size: 130KB - Virtual size: 130KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Certificate

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Certificate

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Signer

.text
Size: 681KB - Virtual size: 680KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

33:00:00:00:bf:91:6c:fb:7c:1a:24:e0:22:00:00:00:00:00:bf
Certificate

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

5f:90:d3:b6:dd:87:df:4e:84:6f:b5:22:f4:f6:9c:c6:e6:fd:34:f3:6b:0a:66:83:1d:4b:6c:06:60:25:a2:05
Signer

c3:31:16:77:dd:f7:23:e7:e9:f0:6b:b3:3c:f4:65:e7:13:97:71:ed
Signer