6129793656612b015f020b0b76b5ea729de1d150bdb651ed841f309fd7bc735a

Sharing

Copy URL Twitter E-mail

General

Target

6129793656612b015f020b0b76b5ea729de1d150bdb651ed841f309fd7bc735a
Size

26KB
MD5

640eda427ab0c2b1d46474c17d551e64
SHA1

02ea7c2641d0b35d663d78312e066b6aaae2e5d5
SHA256

6129793656612b015f020b0b76b5ea729de1d150bdb651ed841f309fd7bc735a
SHA512

70baf70c95be314d9767c86c0c489c6def3f2f8af4568df7937fccdf0fab95c615f5b928ca10b4b8efc31d4a5c4091c689bea2240b1234b4b8a23d2fa9fe5cab
SSDEEP

384:bo5JH2neK5SxKzNrM8Ji87TH0AJNYmtjMVITo8TZsHLUJdz28JN77hhnq:bAlf8A87h/YM3Mg3hBq

Score

1^/10

Malware Config

Signatures

Files

6129793656612b015f020b0b76b5ea729de1d150bdb651ed841f309fd7bc735a
.dll windows:6 windows x64 arch:x64

49af573c756f784ebe19a1d86a0e4539

Code Sign

03:c6:ab:dd:e7:aa:44:0b:c1:99:0a:06:d5:34:89:db
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

15/03/2017, 00:00

Not After

20/03/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Photoshop\, Bridge,O=Adobe Systems Incorporated,POSTALCODE=95110,STREET=345 Park Avenue,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1f:3a:7e:3e:ed:73:19:a9:82:2a:b2:e4:e6:43:0a:91:20:6d:69:a7:56:e4:21:94:35:1c:20:9d:9f:9f:f4:52
Signer

Actual PE Digest

1f:3a:7e:3e:ed:73:19:a9:82:2a:b2:e4:e6:43:0a:91:20:6d:69:a7:56:e4:21:94:35:1c:20:9d:9f:9f:f4:52

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\PS\PS20\Win64_Release\20180920.r.24\photoshop\main\plugins\Targets\x64\Objs\Release\Filters\NTSC Colors\NTSC Colors.pdb

Imports

plugin

NewHandle

vcruntime140

memset
__std_type_info_destroy_list
memcpy
__C_specific_handler

api-ms-win-crt-math-l1-1-0

pow
_hypot

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_initterm_e
_initterm
_initialize_onexit_table
_register_onexit_function
_seh_filter_dll
_crt_atexit
_execute_onexit_table
_crt_at_quick_exit
_configure_narrow_argv
_cexit
terminate

kernel32

QueryPerformanceCounter
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
RtlCaptureContext
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry

Exports

Exports

PluginMain

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

49af573c756f784ebe19a1d86a0e4539

Code Sign

03:c6:ab:dd:e7:aa:44:0b:c1:99:0a:06:d5:34:89:dbCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

1f:3a:7e:3e:ed:73:19:a9:82:2a:b2:e4:e6:43:0a:91:20:6d:69:a7:56:e4:21:94:35:1c:20:9d:9f:9f:f4:52Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

plugin

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 9KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 732B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 28B

03:c6:ab:dd:e7:aa:44:0b:c1:99:0a:06:d5:34:89:db
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

1f:3a:7e:3e:ed:73:19:a9:82:2a:b2:e4:e6:43:0a:91:20:6d:69:a7:56:e4:21:94:35:1c:20:9d:9f:9f:f4:52
Signer

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 732B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 28B