e834d567ddd4e7f325461fe81522cb44768bb1dec62073fa78e4c240c37dc60e

Sharing

Copy URL Twitter E-mail

General

Target

e834d567ddd4e7f325461fe81522cb44768bb1dec62073fa78e4c240c37dc60e
Size

278KB
MD5

c006e5e9bcb22657b01d26a3533ff087
SHA1

e6f33e3b7564e72d6bbd73067f5dc6a231a7c546
SHA256

e834d567ddd4e7f325461fe81522cb44768bb1dec62073fa78e4c240c37dc60e
SHA512

6a195037ecccfb202706bc4c2f7776f2025f26b15278c70aa22a45185ee794d0beea7538ce7f29019539f8f4ef8a24dc2f9752ebbc1b0784e6ed2d27dc54d85d
SSDEEP

3072:4GHUU5iL8OJkOiDgCtjDCh8SQPQ8j8oHvo8P+2oWNfLYQnMcW+xVgQT4W9iBx8Dc:jUU8Jp8jnJcQ36cu6xAIMD1

Score

1^/10

Malware Config

Signatures

Files

e834d567ddd4e7f325461fe81522cb44768bb1dec62073fa78e4c240c37dc60e
.dll windows:6 windows x64 arch:x64

0398c649a2f069a5b7c9f9d6157f5dee

Code Sign

03:c6:ab:dd:e7:aa:44:0b:c1:99:0a:06:d5:34:89:db
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

15/03/2017, 00:00

Not After

20/03/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Photoshop\, Bridge,O=Adobe Systems Incorporated,POSTALCODE=95110,STREET=345 Park Avenue,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

f4:14:32:00:94:c3:90:ed:bf:4d:06:db:42:25:8d:a2:76:be:12:4a:39:f8:e8:cb:d5:51:7b:a2:41:04:89:54
Signer

Actual PE Digest

f4:14:32:00:94:c3:90:ed:bf:4d:06:db:42:25:8d:a2:76:be:12:4a:39:f8:e8:cb:d5:51:7b:a2:41:04:89:54

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\PS\PS20\Win64_Release\20180920.r.24\photoshop\main\shared\uxtech\uxtech\make\winapi\winrt\binaries\x64\Release\WinRTSupport.pdb

Imports

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetProcAddress

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
WakeConditionVariable
Sleep

api-ms-win-core-winrt-string-l1-1-0

WindowsPromoteStringBuffer
WindowsDeleteStringBuffer
WindowsCreateString
WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsPreallocateStringBuffer

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
DeleteCriticalSection
ResetEvent
CreateEventW
LeaveCriticalSection
SetEvent
EnterCriticalSection
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
WaitForSingleObjectEx

oleaut32

SysAllocString
SysFreeString

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoGetObjectContext
CoTaskMemAlloc

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoInitialize

api-ms-win-core-threadpool-l1-2-0

TrySubmitThreadpoolCallback

kernel32

GetCurrentPackageFamilyName
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
GetModuleHandleW
QueryFullProcessImageNameW

user32

CreateWindowExW
DefWindowProcW
SetWindowLongPtrW
SendNotifyMessageW
RemovePropA
RegisterWindowMessageA
GetPropA
DestroyWindow
PostMessageW
CallWindowProcW
SetPropA

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
_Mtx_unlock
_Mtx_init_in_situ
_Mtx_lock
_Mtx_destroy_in_situ
?_Throw_C_error@std@@YAXH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z

vcruntime140

__std_exception_destroy
memcpy
memmove
__std_exception_copy
__std_terminate
__C_specific_handler
_purecall
__vcrt_InitializeCriticalSectionEx
_CxxThrowException
memset
__std_type_info_destroy_list
__RTDynamicCast
__CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
terminate
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_seh_filter_dll
_initterm_e

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
GetRestrictedErrorInfo

Exports

Exports

WinRTDialAppendIconMenuItem
WinRTDialAppendKnownMenuItem
WinRTDialClearMenu
WinRTDialCommitPendingMenuAdditions
WinRTDialCreate
WinRTDialGetNumberOfMenuItems
WinRTDialIntialize
WinRTDialIsAvailable
WinRTDialSetButtonPressedHandler
WinRTDialSetControlAcquiredHandler
WinRTDialSetControlLostHandler
WinRTDialSetRotationChangedHandler
WinRTDialSetRotationResolution
WinRTDialSetScreenContactContinuedHandler
WinRTDialSetScreenContactEndedHandler
WinRTDialSetScreenContactStartedHandler
WinRTDialTerminate
WinRTShareDataForWindow
WinRTShareFileForWindow
WinRTSharingIsAvailable
WinRTSharingTerminate
_WinRTApiInformation_IsEnabledEvent
_WinRTApiInformation_IsEnabledMethod
_WinRTApiInformation_IsEnabledType
_WinRTAsyncOperationBOOL_Cancel
_WinRTAsyncOperationBOOL_Close
_WinRTAsyncOperationBOOL_Completed
_WinRTAsyncOperationBOOL_Dealloc
_WinRTAsyncOperationBOOL_GetResults
_WinRTAsyncOperationBOOL_GetStatus
_WinRTSecondaryTileVisualElements_Dealloc
_WinRTSecondaryTileVisualElements_GetBackgroundColor
_WinRTSecondaryTileVisualElements_GetForegroundText
_WinRTSecondaryTileVisualElements_GetLogoUriLarge
_WinRTSecondaryTileVisualElements_GetLogoUriMedium
_WinRTSecondaryTileVisualElements_GetLogoUriSmall
_WinRTSecondaryTileVisualElements_GetLogoUriTiny
_WinRTSecondaryTileVisualElements_GetLogoUriWide
_WinRTSecondaryTileVisualElements_GetShowDisplayNameOnLarge
_WinRTSecondaryTileVisualElements_GetShowDisplayNameOnMedium
_WinRTSecondaryTileVisualElements_GetShowDisplayNameOnWide
_WinRTSecondaryTile_Alloc
_WinRTSecondaryTile_Dealloc
_WinRTSecondaryTile_Exists
_WinRTSecondaryTile_GetTileID
_WinRTSecondaryTile_GetVisualElements
_WinRTSecondaryTile_InitWithCreateArgs
_WinRTSecondaryTile_InitWithTileID
_WinRTSecondaryTile_RequestCreateAsync
_WinRTSecondaryTile_RequestDeleteAsync
_WinRTShareProviderOperation_ReportCompleted
_WinRTShareProvider_Alloc
_WinRTShareProvider_Dealloc
_WinRTShareProvider_GetBackgroundColor
_WinRTShareProvider_GetIconUri
_WinRTShareProvider_GetTitle
_WinRTShareProvider_InitWithArgs
_WinRTTileUpdater_Alloc
_WinRTTileUpdater_Clear
_WinRTTileUpdater_Dealloc
_WinRTTileUpdater_EnableNotificationQueuing
_WinRTTileUpdater_EnableNotificationQueuingForTileSize
_WinRTTileUpdater_InitWithPrimaryTile
_WinRTTileUpdater_InitWithSecondaryTile
_WinRTTileUpdater_Update

Sections

.text
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0398c649a2f069a5b7c9f9d6157f5dee

Code Sign

03:c6:ab:dd:e7:aa:44:0b:c1:99:0a:06:d5:34:89:dbCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

f4:14:32:00:94:c3:90:ed:bf:4d:06:db:42:25:8d:a2:76:be:12:4a:39:f8:e8:cb:d5:51:7b:a2:41:04:89:54Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-string-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-synch-l1-1-0

oleaut32

api-ms-win-core-com-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-threadpool-l1-2-0

kernel32

user32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-error-l1-1-0

Exports

Exports

Sections

.text Size: 134KB - Virtual size: 133KB

.rdata Size: 93KB - Virtual size: 92KB

.data Size: 28KB - Virtual size: 40KB

.pdata Size: 11KB - Virtual size: 11KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

03:c6:ab:dd:e7:aa:44:0b:c1:99:0a:06:d5:34:89:db
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

f4:14:32:00:94:c3:90:ed:bf:4d:06:db:42:25:8d:a2:76:be:12:4a:39:f8:e8:cb:d5:51:7b:a2:41:04:89:54
Signer

.text
Size: 134KB - Virtual size: 133KB

.rdata
Size: 93KB - Virtual size: 92KB

.data
Size: 28KB - Virtual size: 40KB

.pdata
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB