1cfb9922ca6e2cbe18792c6ad4835df61accc07159221bbc3e519ce0923db43d

Sharing

Copy URL Twitter E-mail

General

Target

1cfb9922ca6e2cbe18792c6ad4835df61accc07159221bbc3e519ce0923db43d
Size

11.3MB
MD5

2a9f19cb4ad5add4cb75768154029f86
SHA1

0126d19839a690446cc2e5c652937aa5b16e1813
SHA256

1cfb9922ca6e2cbe18792c6ad4835df61accc07159221bbc3e519ce0923db43d
SHA512

669f38a1b5e96a5f9884be970d656a9a6ef726dc9a9ac63c3da2b869d3f9f259eb56ebda761c6ed77949cc6e30522bc865790c11c37b430120adeac95326db1a
SSDEEP

196608:3XEHTrZGzUgBKl779S83fBKl7TqoJF/d1SHBKl7ipf3NXVDH10zL0ZW85BKl7y:nEH/MzUg4B7954BTNzO4Bip/Hr10fc4I

Score

1^/10

Malware Config

Signatures

Files

1cfb9922ca6e2cbe18792c6ad4835df61accc07159221bbc3e519ce0923db43d
.zip
flashcenter_ax_install_cn.exe
.exe windows:5 windows x86 arch:x86

2d17d82ea08a4f178a6a3360e43ce5fd

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:88:61:06:2e:3b:97:5a:b7:6d:a2:89:80:c5:b9:5e
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

17/03/2023, 00:00

Not After

20/03/2025, 23:59

Subject

CN=Chongqing Zhongcheng Network Technology Co. Ltd.,O=Chongqing Zhongcheng Network Technology Co. Ltd.,ST=重庆市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

de:c6:78:31:2f:6e:e4:2f:a5:46:47:f2:0e:88:71:87:54:c6:53:62:cb:da:dc:51:af:01:23:af:d6:84:90:61
Signer

Actual PE Digest

de:c6:78:31:2f:6e:e4:2f:a5:46:47:f2:0e:88:71:87:54:c6:53:62:cb:da:dc:51:af:01:23:af:d6:84:90:61

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\vkansal\Documents\GitHub\Dev\target\win\Release\Adobe Download Manager.pdb

Imports

shell32

SHCreateDirectoryExW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetMalloc
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHGetFileInfoW
DragQueryFileW
DragFinish
SHAppBarMessage
SHGetFolderPathW
SHGetFolderLocation
CommandLineToArgvW

shlwapi

UrlIsW
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
PathIsDirectoryW
PathFindExtensionW
PathFindFileNameW
PathRemoveExtensionW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW
PathIsFileSpecW
PathAddExtensionW
PathRenameExtensionW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

kernel32

HeapSize
HeapQueryInformation
SetStdHandle
GetStartupInfoW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
CreateSemaphoreW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetConsoleCP
GetConsoleMode
ReadConsoleW
GetStringTypeW
GetTimeZoneInformation
OutputDebugStringW
GetDateFormatW
GetTimeFormatW
LCMapStringW
VirtualQuery
EnumSystemLocalesW
WriteConsoleW
SetEnvironmentVariableA
lstrlenA
CreateMutexW
ReleaseSemaphore
OpenSemaphoreW
ReleaseMutex
GetUserDefaultLangID
GetLocalTime
OpenMutexW
LoadLibraryExA
VirtualAlloc
GetSystemInfo
GetModuleHandleExW
MoveFileExW
RtlUnwind
ExitThread
GetSystemTimeAsFileTime
HeapReAlloc
IsProcessorFeaturePresent
IsDebuggerPresent
GetCommandLineW
FindResourceExW
GetUserDefaultLCID
VirtualProtect
GetProfileIntW
SearchPathW
GetTempFileNameW
VerifyVersionInfoW
VerSetConditionMask
SetErrorMode
SetFileAttributesW
GetFileTime
GetFileAttributesExW
FileTimeToLocalFileTime
GlobalGetAtomNameW
FileTimeToSystemTime
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
GetCurrentDirectoryW
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GlobalFlags
GetThreadLocale
lstrcmpiW
UnlockFile
SetFilePointer
LockFile
GetVolumeInformationW
GetFileSize
FlushFileBuffers
CopyFileW
FormatMessageW
GlobalSize
GlobalFindAtomW
LoadLibraryA
DecodePointer
EncodePointer
RaiseException
GetModuleHandleA
OutputDebugStringA
lstrcpyW
SetDllDirectoryW
SetThreadPriority
FreeResource
GlobalAddAtomW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpW
lstrcmpA
GlobalDeleteAtom
LoadLibraryExW
GetCurrentThread
InterlockedExchange
GetVersion
GetFileType
GetEnvironmentVariableW
GetStdHandle
GetExitCodeThread
GetFileSizeEx
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindNextFileW
FindFirstFileW
GetFileAttributesW
RemoveDirectoryW
GetTempPathW
FindClose
SetFilePointerEx
SetEndOfFile
lstrlenW
DisconnectNamedPipe
GetOverlappedResult
ReadFile
CreateNamedPipeW
ConnectNamedPipe
TerminateThread
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetExitCodeProcess
WideCharToMultiByte
GetProcessHeap
HeapFree
HeapAlloc
ResumeThread
WriteProcessMemory
DeleteFileW
GetWindowsDirectoryW
DuplicateHandle
VirtualProtectEx
FlushInstructionCache
GetModuleFileNameW
GetSystemDirectoryW
CreateProcessW
SetThreadContext
GetThreadContext
ExitProcess
Sleep
GetTickCount
GetDiskFreeSpaceExW
SetLastError
GlobalUnlock
MulDiv
GlobalAlloc
GlobalLock
LocalFree
GetCurrentProcessId
LocalAlloc
GetVersionExW
OpenProcess
GetCurrentProcess
FreeLibrary
GetFullPathNameW
CreateThread
CloseHandle
WaitForMultipleObjects
CreateEventW
GlobalFree
MultiByteToWideChar
CreateFileW
WriteFile
SetEvent
WaitForSingleObject
GetCurrentThreadId
LockResource
SizeofResource
InterlockedDecrement
InterlockedIncrement
LoadResource
FindResourceW
GetProcAddress
GetLastError
InitializeCriticalSectionAndSpinCount
LoadLibraryW
GetModuleHandleW
GetSystemWindowsDirectoryW
IsValidLocale

gdi32

GetTextFaceW
SetPixelV
GetViewportOrgEx
LPtoDP
GetWindowOrgEx
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
SetPaletteEntries
ExtFloodFill
EnumFontFamiliesExW
RoundRect
OffsetRgn
SetDIBColorTable
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
Polyline
Polygon
CreatePolygonRgn
Ellipse
CreateEllipticRgn
CreateDIBSection
CreateRoundRectRgn
GetTextCharsetInfo
EnumFontFamiliesW
CreateDIBitmap
DPtoLP
SetRectRgn
GetMapMode
GetTextMetricsW
GetRgnBox
GetTextColor
GetBkColor
PatBlt
CreateRectRgnIndirect
GetTextExtentPoint32W
CreateDCW
CopyMetaFileW
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
ExtTextOutW
TextOutW
MoveToEx
GetObjectW
SetTextAlign
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetBkColor
SelectPalette
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
CreateSolidBrush
CreatePatternBrush
CreateHatchBrush
CreateBitmap
GetStockObject
SetPixel
CreateCompatibleBitmap
BitBlt
SetTextColor
DeleteDC
CreateFontIndirectW
GetDeviceCaps
StretchBlt
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
CombineRgn
SetMapMode
Rectangle
CreateRectRgn
CreatePen
SetViewportExtEx

advapi32

OpenServiceW
OpenProcessToken
CreateWellKnownSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
SetEntriesInAclW
QueryServiceStatusEx
GetNamedSecurityInfoW
SetNamedSecurityInfoW
OpenSCManagerW
CloseServiceHandle
ConvertSidToStringSidW
LookupAccountSidW
CreateProcessAsUserW
GetTokenInformation
RegSetValueExW
RegCreateKeyExW
RegCloseKey
AdjustTokenPrivileges
CheckTokenMembership
RegOpenKeyExW
FreeSid
AllocateAndInitializeSid
LookupPrivilegeValueW
RegQueryValueExW

comctl32

_TrackMouseEvent
InitCommonControlsEx

ole32

CoCreateInstance
CoCreateGuid
StgCreateDocfileOnILockBytes
CoUninitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
OleCreateMenuDescriptor
OleLockRunning
StgOpenStorageOnILockBytes
DoDragDrop
OleRun
CoInitializeEx
StringFromGUID2
CoRegisterMessageFilter
CoGetClassObject
ReleaseStgMedium
OleDuplicateData
OleIsCurrentClipboard
OleFlushClipboard
CoTaskMemFree
CoRevokeClassObject
OleUninitialize
CreateILockBytesOnHGlobal
OleInitialize
CoFreeUnusedLibraries
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
IsAccelerator
OleTranslateAccelerator
CoDisconnectObject
OleDestroyMenuDescriptor
CLSIDFromProgID
CoInitialize
CLSIDFromString

oleaut32

SafeArrayUnaccessData
VarBstrFromDate
LoadTypeLi
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayCreate
GetErrorInfo
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
DispCallFunc
LoadRegTypeLi
VariantChangeType
VariantCopy
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
SysStringLen
VariantInit
VariantClear
SysAllocString
SysFreeString

gdiplus

GdipCreateBitmapFromScan0
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipSetInterpolationMode
GdipCreateBitmapFromHBITMAP
GdipBitmapLockBits
GdipLoadImageFromStream
GdiplusStartup
GdipReleaseDC
GdipCloneImage
GdipCreateFromHDC
GdipDisposeImage
GdipAlloc
GdipDeleteGraphics
GdipCreateBitmapFromStream
GdipFree
GdipDrawImageRectRect
GdiplusShutdown
GdipBitmapUnlockBits
GdipDrawImageRectI
GdipDrawImageI

Exports

Exports

_CreateProcessWithTokenW@36

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 562KB - Virtual size: 561KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 491KB - Virtual size: 491KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
flashcenter_install_cn.exe
.exe windows:5 windows x86 arch:x86

2d17d82ea08a4f178a6a3360e43ce5fd

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:88:61:06:2e:3b:97:5a:b7:6d:a2:89:80:c5:b9:5e
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

17/03/2023, 00:00

Not After

20/03/2025, 23:59

Subject

CN=Chongqing Zhongcheng Network Technology Co. Ltd.,O=Chongqing Zhongcheng Network Technology Co. Ltd.,ST=重庆市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3e:e3:f1:51:1b:64:5f:b3:80:c4:c9:bd:b6:2b:7f:95:e8:a4:1b:3b:f1:62:a4:47:51:3a:19:f5:de:25:05:8e
Signer

Actual PE Digest

3e:e3:f1:51:1b:64:5f:b3:80:c4:c9:bd:b6:2b:7f:95:e8:a4:1b:3b:f1:62:a4:47:51:3a:19:f5:de:25:05:8e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\vkansal\Documents\GitHub\Dev\target\win\Release\Adobe Download Manager.pdb

Imports

shell32

SHCreateDirectoryExW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetMalloc
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHGetFileInfoW
DragQueryFileW
DragFinish
SHAppBarMessage
SHGetFolderPathW
SHGetFolderLocation
CommandLineToArgvW

shlwapi

UrlIsW
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
PathIsDirectoryW
PathFindExtensionW
PathFindFileNameW
PathRemoveExtensionW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW
PathIsFileSpecW
PathAddExtensionW
PathRenameExtensionW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

kernel32

HeapSize
HeapQueryInformation
SetStdHandle
GetStartupInfoW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
CreateSemaphoreW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetConsoleCP
GetConsoleMode
ReadConsoleW
GetStringTypeW
GetTimeZoneInformation
OutputDebugStringW
GetDateFormatW
GetTimeFormatW
LCMapStringW
VirtualQuery
EnumSystemLocalesW
WriteConsoleW
SetEnvironmentVariableA
lstrlenA
CreateMutexW
ReleaseSemaphore
OpenSemaphoreW
ReleaseMutex
GetUserDefaultLangID
GetLocalTime
OpenMutexW
LoadLibraryExA
VirtualAlloc
GetSystemInfo
GetModuleHandleExW
MoveFileExW
RtlUnwind
ExitThread
GetSystemTimeAsFileTime
HeapReAlloc
IsProcessorFeaturePresent
IsDebuggerPresent
GetCommandLineW
FindResourceExW
GetUserDefaultLCID
VirtualProtect
GetProfileIntW
SearchPathW
GetTempFileNameW
VerifyVersionInfoW
VerSetConditionMask
SetErrorMode
SetFileAttributesW
GetFileTime
GetFileAttributesExW
FileTimeToLocalFileTime
GlobalGetAtomNameW
FileTimeToSystemTime
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
GetCurrentDirectoryW
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GlobalFlags
GetThreadLocale
lstrcmpiW
UnlockFile
SetFilePointer
LockFile
GetVolumeInformationW
GetFileSize
FlushFileBuffers
CopyFileW
FormatMessageW
GlobalSize
GlobalFindAtomW
LoadLibraryA
DecodePointer
EncodePointer
RaiseException
GetModuleHandleA
OutputDebugStringA
lstrcpyW
SetDllDirectoryW
SetThreadPriority
FreeResource
GlobalAddAtomW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpW
lstrcmpA
GlobalDeleteAtom
LoadLibraryExW
GetCurrentThread
InterlockedExchange
GetVersion
GetFileType
GetEnvironmentVariableW
GetStdHandle
GetExitCodeThread
GetFileSizeEx
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindNextFileW
FindFirstFileW
GetFileAttributesW
RemoveDirectoryW
GetTempPathW
FindClose
SetFilePointerEx
SetEndOfFile
lstrlenW
DisconnectNamedPipe
GetOverlappedResult
ReadFile
CreateNamedPipeW
ConnectNamedPipe
TerminateThread
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetExitCodeProcess
WideCharToMultiByte
GetProcessHeap
HeapFree
HeapAlloc
ResumeThread
WriteProcessMemory
DeleteFileW
GetWindowsDirectoryW
DuplicateHandle
VirtualProtectEx
FlushInstructionCache
GetModuleFileNameW
GetSystemDirectoryW
CreateProcessW
SetThreadContext
GetThreadContext
ExitProcess
Sleep
GetTickCount
GetDiskFreeSpaceExW
SetLastError
GlobalUnlock
MulDiv
GlobalAlloc
GlobalLock
LocalFree
GetCurrentProcessId
LocalAlloc
GetVersionExW
OpenProcess
GetCurrentProcess
FreeLibrary
GetFullPathNameW
CreateThread
CloseHandle
WaitForMultipleObjects
CreateEventW
GlobalFree
MultiByteToWideChar
CreateFileW
WriteFile
SetEvent
WaitForSingleObject
GetCurrentThreadId
LockResource
SizeofResource
InterlockedDecrement
InterlockedIncrement
LoadResource
FindResourceW
GetProcAddress
GetLastError
InitializeCriticalSectionAndSpinCount
LoadLibraryW
GetModuleHandleW
GetSystemWindowsDirectoryW
IsValidLocale

gdi32

GetTextFaceW
SetPixelV
GetViewportOrgEx
LPtoDP
GetWindowOrgEx
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
SetPaletteEntries
ExtFloodFill
EnumFontFamiliesExW
RoundRect
OffsetRgn
SetDIBColorTable
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
Polyline
Polygon
CreatePolygonRgn
Ellipse
CreateEllipticRgn
CreateDIBSection
CreateRoundRectRgn
GetTextCharsetInfo
EnumFontFamiliesW
CreateDIBitmap
DPtoLP
SetRectRgn
GetMapMode
GetTextMetricsW
GetRgnBox
GetTextColor
GetBkColor
PatBlt
CreateRectRgnIndirect
GetTextExtentPoint32W
CreateDCW
CopyMetaFileW
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
ExtTextOutW
TextOutW
MoveToEx
GetObjectW
SetTextAlign
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetBkColor
SelectPalette
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
CreateSolidBrush
CreatePatternBrush
CreateHatchBrush
CreateBitmap
GetStockObject
SetPixel
CreateCompatibleBitmap
BitBlt
SetTextColor
DeleteDC
CreateFontIndirectW
GetDeviceCaps
StretchBlt
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
CombineRgn
SetMapMode
Rectangle
CreateRectRgn
CreatePen
SetViewportExtEx

advapi32

OpenServiceW
OpenProcessToken
CreateWellKnownSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
SetEntriesInAclW
QueryServiceStatusEx
GetNamedSecurityInfoW
SetNamedSecurityInfoW
OpenSCManagerW
CloseServiceHandle
ConvertSidToStringSidW
LookupAccountSidW
CreateProcessAsUserW
GetTokenInformation
RegSetValueExW
RegCreateKeyExW
RegCloseKey
AdjustTokenPrivileges
CheckTokenMembership
RegOpenKeyExW
FreeSid
AllocateAndInitializeSid
LookupPrivilegeValueW
RegQueryValueExW

comctl32

_TrackMouseEvent
InitCommonControlsEx

ole32

CoCreateInstance
CoCreateGuid
StgCreateDocfileOnILockBytes
CoUninitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
OleCreateMenuDescriptor
OleLockRunning
StgOpenStorageOnILockBytes
DoDragDrop
OleRun
CoInitializeEx
StringFromGUID2
CoRegisterMessageFilter
CoGetClassObject
ReleaseStgMedium
OleDuplicateData
OleIsCurrentClipboard
OleFlushClipboard
CoTaskMemFree
CoRevokeClassObject
OleUninitialize
CreateILockBytesOnHGlobal
OleInitialize
CoFreeUnusedLibraries
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
IsAccelerator
OleTranslateAccelerator
CoDisconnectObject
OleDestroyMenuDescriptor
CLSIDFromProgID
CoInitialize
CLSIDFromString

oleaut32

SafeArrayUnaccessData
VarBstrFromDate
LoadTypeLi
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayCreate
GetErrorInfo
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
DispCallFunc
LoadRegTypeLi
VariantChangeType
VariantCopy
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
SysStringLen
VariantInit
VariantClear
SysAllocString
SysFreeString

gdiplus

GdipCreateBitmapFromScan0
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipSetInterpolationMode
GdipCreateBitmapFromHBITMAP
GdipBitmapLockBits
GdipLoadImageFromStream
GdiplusStartup
GdipReleaseDC
GdipCloneImage
GdipCreateFromHDC
GdipDisposeImage
GdipAlloc
GdipDeleteGraphics
GdipCreateBitmapFromStream
GdipFree
GdipDrawImageRectRect
GdiplusShutdown
GdipBitmapUnlockBits
GdipDrawImageRectI
GdipDrawImageI

Exports

Exports

_CreateProcessWithTokenW@36

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 562KB - Virtual size: 561KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 491KB - Virtual size: 491KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
flashcenter_pp_ax_install_cn.exe
.exe windows:5 windows x86 arch:x86

2d17d82ea08a4f178a6a3360e43ce5fd

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:88:61:06:2e:3b:97:5a:b7:6d:a2:89:80:c5:b9:5e
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

17/03/2023, 00:00

Not After

20/03/2025, 23:59

Subject

CN=Chongqing Zhongcheng Network Technology Co. Ltd.,O=Chongqing Zhongcheng Network Technology Co. Ltd.,ST=重庆市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:56:c5:6e:a7:2d:3a:ff:bb:57:80:00:cf:04:74:fc:10:48:e8:9b:e7:d7:1b:52:e8:d9:13:1c:2a:13:93:3e
Signer

Actual PE Digest

71:56:c5:6e:a7:2d:3a:ff:bb:57:80:00:cf:04:74:fc:10:48:e8:9b:e7:d7:1b:52:e8:d9:13:1c:2a:13:93:3e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\vkansal\Documents\GitHub\Dev\target\win\Release\Adobe Download Manager.pdb

Imports

shell32

SHCreateDirectoryExW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetMalloc
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHGetFileInfoW
DragQueryFileW
DragFinish
SHAppBarMessage
SHGetFolderPathW
SHGetFolderLocation
CommandLineToArgvW

shlwapi

UrlIsW
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
PathIsDirectoryW
PathFindExtensionW
PathFindFileNameW
PathRemoveExtensionW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW
PathIsFileSpecW
PathAddExtensionW
PathRenameExtensionW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

kernel32

HeapSize
HeapQueryInformation
SetStdHandle
GetStartupInfoW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
CreateSemaphoreW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetConsoleCP
GetConsoleMode
ReadConsoleW
GetStringTypeW
GetTimeZoneInformation
OutputDebugStringW
GetDateFormatW
GetTimeFormatW
LCMapStringW
VirtualQuery
EnumSystemLocalesW
WriteConsoleW
SetEnvironmentVariableA
lstrlenA
CreateMutexW
ReleaseSemaphore
OpenSemaphoreW
ReleaseMutex
GetUserDefaultLangID
GetLocalTime
OpenMutexW
LoadLibraryExA
VirtualAlloc
GetSystemInfo
GetModuleHandleExW
MoveFileExW
RtlUnwind
ExitThread
GetSystemTimeAsFileTime
HeapReAlloc
IsProcessorFeaturePresent
IsDebuggerPresent
GetCommandLineW
FindResourceExW
GetUserDefaultLCID
VirtualProtect
GetProfileIntW
SearchPathW
GetTempFileNameW
VerifyVersionInfoW
VerSetConditionMask
SetErrorMode
SetFileAttributesW
GetFileTime
GetFileAttributesExW
FileTimeToLocalFileTime
GlobalGetAtomNameW
FileTimeToSystemTime
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
GetCurrentDirectoryW
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GlobalFlags
GetThreadLocale
lstrcmpiW
UnlockFile
SetFilePointer
LockFile
GetVolumeInformationW
GetFileSize
FlushFileBuffers
CopyFileW
FormatMessageW
GlobalSize
GlobalFindAtomW
LoadLibraryA
DecodePointer
EncodePointer
RaiseException
GetModuleHandleA
OutputDebugStringA
lstrcpyW
SetDllDirectoryW
SetThreadPriority
FreeResource
GlobalAddAtomW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpW
lstrcmpA
GlobalDeleteAtom
LoadLibraryExW
GetCurrentThread
InterlockedExchange
GetVersion
GetFileType
GetEnvironmentVariableW
GetStdHandle
GetExitCodeThread
GetFileSizeEx
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindNextFileW
FindFirstFileW
GetFileAttributesW
RemoveDirectoryW
GetTempPathW
FindClose
SetFilePointerEx
SetEndOfFile
lstrlenW
DisconnectNamedPipe
GetOverlappedResult
ReadFile
CreateNamedPipeW
ConnectNamedPipe
TerminateThread
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetExitCodeProcess
WideCharToMultiByte
GetProcessHeap
HeapFree
HeapAlloc
ResumeThread
WriteProcessMemory
DeleteFileW
GetWindowsDirectoryW
DuplicateHandle
VirtualProtectEx
FlushInstructionCache
GetModuleFileNameW
GetSystemDirectoryW
CreateProcessW
SetThreadContext
GetThreadContext
ExitProcess
Sleep
GetTickCount
GetDiskFreeSpaceExW
SetLastError
GlobalUnlock
MulDiv
GlobalAlloc
GlobalLock
LocalFree
GetCurrentProcessId
LocalAlloc
GetVersionExW
OpenProcess
GetCurrentProcess
FreeLibrary
GetFullPathNameW
CreateThread
CloseHandle
WaitForMultipleObjects
CreateEventW
GlobalFree
MultiByteToWideChar
CreateFileW
WriteFile
SetEvent
WaitForSingleObject
GetCurrentThreadId
LockResource
SizeofResource
InterlockedDecrement
InterlockedIncrement
LoadResource
FindResourceW
GetProcAddress
GetLastError
InitializeCriticalSectionAndSpinCount
LoadLibraryW
GetModuleHandleW
GetSystemWindowsDirectoryW
IsValidLocale

gdi32

GetTextFaceW
SetPixelV
GetViewportOrgEx
LPtoDP
GetWindowOrgEx
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
SetPaletteEntries
ExtFloodFill
EnumFontFamiliesExW
RoundRect
OffsetRgn
SetDIBColorTable
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
Polyline
Polygon
CreatePolygonRgn
Ellipse
CreateEllipticRgn
CreateDIBSection
CreateRoundRectRgn
GetTextCharsetInfo
EnumFontFamiliesW
CreateDIBitmap
DPtoLP
SetRectRgn
GetMapMode
GetTextMetricsW
GetRgnBox
GetTextColor
GetBkColor
PatBlt
CreateRectRgnIndirect
GetTextExtentPoint32W
CreateDCW
CopyMetaFileW
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
ExtTextOutW
TextOutW
MoveToEx
GetObjectW
SetTextAlign
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetBkColor
SelectPalette
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
CreateSolidBrush
CreatePatternBrush
CreateHatchBrush
CreateBitmap
GetStockObject
SetPixel
CreateCompatibleBitmap
BitBlt
SetTextColor
DeleteDC
CreateFontIndirectW
GetDeviceCaps
StretchBlt
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
CombineRgn
SetMapMode
Rectangle
CreateRectRgn
CreatePen
SetViewportExtEx

advapi32

OpenServiceW
OpenProcessToken
CreateWellKnownSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
SetEntriesInAclW
QueryServiceStatusEx
GetNamedSecurityInfoW
SetNamedSecurityInfoW
OpenSCManagerW
CloseServiceHandle
ConvertSidToStringSidW
LookupAccountSidW
CreateProcessAsUserW
GetTokenInformation
RegSetValueExW
RegCreateKeyExW
RegCloseKey
AdjustTokenPrivileges
CheckTokenMembership
RegOpenKeyExW
FreeSid
AllocateAndInitializeSid
LookupPrivilegeValueW
RegQueryValueExW

comctl32

_TrackMouseEvent
InitCommonControlsEx

ole32

CoCreateInstance
CoCreateGuid
StgCreateDocfileOnILockBytes
CoUninitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
OleCreateMenuDescriptor
OleLockRunning
StgOpenStorageOnILockBytes
DoDragDrop
OleRun
CoInitializeEx
StringFromGUID2
CoRegisterMessageFilter
CoGetClassObject
ReleaseStgMedium
OleDuplicateData
OleIsCurrentClipboard
OleFlushClipboard
CoTaskMemFree
CoRevokeClassObject
OleUninitialize
CreateILockBytesOnHGlobal
OleInitialize
CoFreeUnusedLibraries
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
IsAccelerator
OleTranslateAccelerator
CoDisconnectObject
OleDestroyMenuDescriptor
CLSIDFromProgID
CoInitialize
CLSIDFromString

oleaut32

SafeArrayUnaccessData
VarBstrFromDate
LoadTypeLi
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayCreate
GetErrorInfo
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
DispCallFunc
LoadRegTypeLi
VariantChangeType
VariantCopy
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
SysStringLen
VariantInit
VariantClear
SysAllocString
SysFreeString

gdiplus

GdipCreateBitmapFromScan0
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipSetInterpolationMode
GdipCreateBitmapFromHBITMAP
GdipBitmapLockBits
GdipLoadImageFromStream
GdiplusStartup
GdipReleaseDC
GdipCloneImage
GdipCreateFromHDC
GdipDisposeImage
GdipAlloc
GdipDeleteGraphics
GdipCreateBitmapFromStream
GdipFree
GdipDrawImageRectRect
GdiplusShutdown
GdipBitmapUnlockBits
GdipDrawImageRectI
GdipDrawImageI

Exports

Exports

_CreateProcessWithTokenW@36

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 562KB - Virtual size: 561KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 491KB - Virtual size: 491KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
flashcenter_pp_install_cn.exe
.exe windows:5 windows x86 arch:x86

2d17d82ea08a4f178a6a3360e43ce5fd

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:88:61:06:2e:3b:97:5a:b7:6d:a2:89:80:c5:b9:5e
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

17/03/2023, 00:00

Not After

20/03/2025, 23:59

Subject

CN=Chongqing Zhongcheng Network Technology Co. Ltd.,O=Chongqing Zhongcheng Network Technology Co. Ltd.,ST=重庆市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a1:3e:58:c1:1e:eb:20:6c:66:d4:1c:11:e1:6c:1e:9a:e6:14:90:2b:bf:be:0e:16:fb:7a:f4:91:41:23:9c:53
Signer

Actual PE Digest

a1:3e:58:c1:1e:eb:20:6c:66:d4:1c:11:e1:6c:1e:9a:e6:14:90:2b:bf:be:0e:16:fb:7a:f4:91:41:23:9c:53

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\vkansal\Documents\GitHub\Dev\target\win\Release\Adobe Download Manager.pdb

Imports

shell32

SHCreateDirectoryExW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetMalloc
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHGetFileInfoW
DragQueryFileW
DragFinish
SHAppBarMessage
SHGetFolderPathW
SHGetFolderLocation
CommandLineToArgvW

shlwapi

UrlIsW
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
PathIsDirectoryW
PathFindExtensionW
PathFindFileNameW
PathRemoveExtensionW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW
PathIsFileSpecW
PathAddExtensionW
PathRenameExtensionW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

kernel32

HeapSize
HeapQueryInformation
SetStdHandle
GetStartupInfoW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
CreateSemaphoreW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetConsoleCP
GetConsoleMode
ReadConsoleW
GetStringTypeW
GetTimeZoneInformation
OutputDebugStringW
GetDateFormatW
GetTimeFormatW
LCMapStringW
VirtualQuery
EnumSystemLocalesW
WriteConsoleW
SetEnvironmentVariableA
lstrlenA
CreateMutexW
ReleaseSemaphore
OpenSemaphoreW
ReleaseMutex
GetUserDefaultLangID
GetLocalTime
OpenMutexW
LoadLibraryExA
VirtualAlloc
GetSystemInfo
GetModuleHandleExW
MoveFileExW
RtlUnwind
ExitThread
GetSystemTimeAsFileTime
HeapReAlloc
IsProcessorFeaturePresent
IsDebuggerPresent
GetCommandLineW
FindResourceExW
GetUserDefaultLCID
VirtualProtect
GetProfileIntW
SearchPathW
GetTempFileNameW
VerifyVersionInfoW
VerSetConditionMask
SetErrorMode
SetFileAttributesW
GetFileTime
GetFileAttributesExW
FileTimeToLocalFileTime
GlobalGetAtomNameW
FileTimeToSystemTime
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
GetCurrentDirectoryW
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GlobalFlags
GetThreadLocale
lstrcmpiW
UnlockFile
SetFilePointer
LockFile
GetVolumeInformationW
GetFileSize
FlushFileBuffers
CopyFileW
FormatMessageW
GlobalSize
GlobalFindAtomW
LoadLibraryA
DecodePointer
EncodePointer
RaiseException
GetModuleHandleA
OutputDebugStringA
lstrcpyW
SetDllDirectoryW
SetThreadPriority
FreeResource
GlobalAddAtomW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpW
lstrcmpA
GlobalDeleteAtom
LoadLibraryExW
GetCurrentThread
InterlockedExchange
GetVersion
GetFileType
GetEnvironmentVariableW
GetStdHandle
GetExitCodeThread
GetFileSizeEx
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindNextFileW
FindFirstFileW
GetFileAttributesW
RemoveDirectoryW
GetTempPathW
FindClose
SetFilePointerEx
SetEndOfFile
lstrlenW
DisconnectNamedPipe
GetOverlappedResult
ReadFile
CreateNamedPipeW
ConnectNamedPipe
TerminateThread
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetExitCodeProcess
WideCharToMultiByte
GetProcessHeap
HeapFree
HeapAlloc
ResumeThread
WriteProcessMemory
DeleteFileW
GetWindowsDirectoryW
DuplicateHandle
VirtualProtectEx
FlushInstructionCache
GetModuleFileNameW
GetSystemDirectoryW
CreateProcessW
SetThreadContext
GetThreadContext
ExitProcess
Sleep
GetTickCount
GetDiskFreeSpaceExW
SetLastError
GlobalUnlock
MulDiv
GlobalAlloc
GlobalLock
LocalFree
GetCurrentProcessId
LocalAlloc
GetVersionExW
OpenProcess
GetCurrentProcess
FreeLibrary
GetFullPathNameW
CreateThread
CloseHandle
WaitForMultipleObjects
CreateEventW
GlobalFree
MultiByteToWideChar
CreateFileW
WriteFile
SetEvent
WaitForSingleObject
GetCurrentThreadId
LockResource
SizeofResource
InterlockedDecrement
InterlockedIncrement
LoadResource
FindResourceW
GetProcAddress
GetLastError
InitializeCriticalSectionAndSpinCount
LoadLibraryW
GetModuleHandleW
GetSystemWindowsDirectoryW
IsValidLocale

gdi32

GetTextFaceW
SetPixelV
GetViewportOrgEx
LPtoDP
GetWindowOrgEx
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
SetPaletteEntries
ExtFloodFill
EnumFontFamiliesExW
RoundRect
OffsetRgn
SetDIBColorTable
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
Polyline
Polygon
CreatePolygonRgn
Ellipse
CreateEllipticRgn
CreateDIBSection
CreateRoundRectRgn
GetTextCharsetInfo
EnumFontFamiliesW
CreateDIBitmap
DPtoLP
SetRectRgn
GetMapMode
GetTextMetricsW
GetRgnBox
GetTextColor
GetBkColor
PatBlt
CreateRectRgnIndirect
GetTextExtentPoint32W
CreateDCW
CopyMetaFileW
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
ExtTextOutW
TextOutW
MoveToEx
GetObjectW
SetTextAlign
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetBkColor
SelectPalette
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
CreateSolidBrush
CreatePatternBrush
CreateHatchBrush
CreateBitmap
GetStockObject
SetPixel
CreateCompatibleBitmap
BitBlt
SetTextColor
DeleteDC
CreateFontIndirectW
GetDeviceCaps
StretchBlt
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
CombineRgn
SetMapMode
Rectangle
CreateRectRgn
CreatePen
SetViewportExtEx

advapi32

OpenServiceW
OpenProcessToken
CreateWellKnownSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
SetEntriesInAclW
QueryServiceStatusEx
GetNamedSecurityInfoW
SetNamedSecurityInfoW
OpenSCManagerW
CloseServiceHandle
ConvertSidToStringSidW
LookupAccountSidW
CreateProcessAsUserW
GetTokenInformation
RegSetValueExW
RegCreateKeyExW
RegCloseKey
AdjustTokenPrivileges
CheckTokenMembership
RegOpenKeyExW
FreeSid
AllocateAndInitializeSid
LookupPrivilegeValueW
RegQueryValueExW

comctl32

_TrackMouseEvent
InitCommonControlsEx

ole32

CoCreateInstance
CoCreateGuid
StgCreateDocfileOnILockBytes
CoUninitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
OleCreateMenuDescriptor
OleLockRunning
StgOpenStorageOnILockBytes
DoDragDrop
OleRun
CoInitializeEx
StringFromGUID2
CoRegisterMessageFilter
CoGetClassObject
ReleaseStgMedium
OleDuplicateData
OleIsCurrentClipboard
OleFlushClipboard
CoTaskMemFree
CoRevokeClassObject
OleUninitialize
CreateILockBytesOnHGlobal
OleInitialize
CoFreeUnusedLibraries
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
IsAccelerator
OleTranslateAccelerator
CoDisconnectObject
OleDestroyMenuDescriptor
CLSIDFromProgID
CoInitialize
CLSIDFromString

oleaut32

SafeArrayUnaccessData
VarBstrFromDate
LoadTypeLi
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayCreate
GetErrorInfo
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
DispCallFunc
LoadRegTypeLi
VariantChangeType
VariantCopy
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
SysStringLen
VariantInit
VariantClear
SysAllocString
SysFreeString

gdiplus

GdipCreateBitmapFromScan0
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipSetInterpolationMode
GdipCreateBitmapFromHBITMAP
GdipBitmapLockBits
GdipLoadImageFromStream
GdiplusStartup
GdipReleaseDC
GdipCloneImage
GdipCreateFromHDC
GdipDisposeImage
GdipAlloc
GdipDeleteGraphics
GdipCreateBitmapFromStream
GdipFree
GdipDrawImageRectRect
GdiplusShutdown
GdipBitmapUnlockBits
GdipDrawImageRectI
GdipDrawImageI

Exports

Exports

_CreateProcessWithTokenW@36

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 562KB - Virtual size: 561KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 491KB - Virtual size: 491KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2d17d82ea08a4f178a6a3360e43ce5fd

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0f:88:61:06:2e:3b:97:5a:b7:6d:a2:89:80:c5:b9:5eCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

de:c6:78:31:2f:6e:e4:2f:a5:46:47:f2:0e:88:71:87:54:c6:53:62:cb:da:dc:51:af:01:23:af:d6:84:90:61Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

shlwapi

userenv

kernel32

gdi32

advapi32

comctl32

ole32

oleaut32

gdiplus

Exports

Exports

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 562KB - Virtual size: 561KB

.data Size: 31KB - Virtual size: 65KB

.rsrc Size: 3.1MB - Virtual size: 3.1MB

.reloc Size: 491KB - Virtual size: 491KB

2d17d82ea08a4f178a6a3360e43ce5fd

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0f:88:61:06:2e:3b:97:5a:b7:6d:a2:89:80:c5:b9:5eCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

3e:e3:f1:51:1b:64:5f:b3:80:c4:c9:bd:b6:2b:7f:95:e8:a4:1b:3b:f1:62:a4:47:51:3a:19:f5:de:25:05:8eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

shlwapi

userenv

kernel32

gdi32

advapi32

comctl32

ole32

oleaut32

gdiplus

Exports

Exports

Sections

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0f:88:61:06:2e:3b:97:5a:b7:6d:a2:89:80:c5:b9:5e
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

de:c6:78:31:2f:6e:e4:2f:a5:46:47:f2:0e:88:71:87:54:c6:53:62:cb:da:dc:51:af:01:23:af:d6:84:90:61
Signer

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 562KB - Virtual size: 561KB

.data
Size: 31KB - Virtual size: 65KB

.rsrc
Size: 3.1MB - Virtual size: 3.1MB

.reloc
Size: 491KB - Virtual size: 491KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0f:88:61:06:2e:3b:97:5a:b7:6d:a2:89:80:c5:b9:5e
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

3e:e3:f1:51:1b:64:5f:b3:80:c4:c9:bd:b6:2b:7f:95:e8:a4:1b:3b:f1:62:a4:47:51:3a:19:f5:de:25:05:8e
Signer

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 562KB - Virtual size: 561KB

.data
Size: 31KB - Virtual size: 65KB

.rsrc
Size: 3.1MB - Virtual size: 3.1MB

.reloc
Size: 491KB - Virtual size: 491KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0f:88:61:06:2e:3b:97:5a:b7:6d:a2:89:80:c5:b9:5e
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

71:56:c5:6e:a7:2d:3a:ff:bb:57:80:00:cf:04:74:fc:10:48:e8:9b:e7:d7:1b:52:e8:d9:13:1c:2a:13:93:3e
Signer

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 562KB - Virtual size: 561KB

.data
Size: 31KB - Virtual size: 65KB

.rsrc
Size: 3.1MB - Virtual size: 3.1MB

.reloc
Size: 491KB - Virtual size: 491KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0f:88:61:06:2e:3b:97:5a:b7:6d:a2:89:80:c5:b9:5e
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

a1:3e:58:c1:1e:eb:20:6c:66:d4:1c:11:e1:6c:1e:9a:e6:14:90:2b:bf:be:0e:16:fb:7a:f4:91:41:23:9c:53
Signer