PresentationHostProxy[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

PresentationHostProxy.dll
Size

97KB
MD5

7d70a2ed58c7ecdb2f99114011738e4d
SHA1

6eb6b164095a25b328b7f33fe2cd50d2bd8ae7f5
SHA256

6604f00f04a2074ef5f516d9d16f055b338ff4c1e4653fae3f77a1ee2f87a4bb
SHA512

31ae683d30f9b0f0fdfc977329861db38049df27e8472bbfcf170bb0a24f1269fcc0747eb34f199f230c3c2602afbe68bf867586a639cd53b25dbcff26e4a45c
SSDEEP

3072:dsxiqBRneUEN7g0YYhNVi95Bw4fNI3dfJI:ki4ReUEJg8zVi

Score

1^/10

Malware Config

Signatures

Files

PresentationHostProxy.dll
.dll regsvr32 windows:5 windows x86 arch:x86

48a06811b7b3201f5b2ce8175c910fe1

Code Sign

61:1a:f5:ea:00:00:00:00:00:6a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/11/2011, 22:39

Not After

01/02/2013, 22:49

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:05:19:96:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2011, 20:42

Not After

25/10/2012, 20:42

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

15:81:a4:10:4b:08:2e:7a:b3:61:0e:aa:31:a0:29:ee:af:9e:ee:c5
Signer

Actual PE Digest

15:81:a4:10:4b:08:2e:7a:b3:61:0e:aa:31:a0:29:ee:af:9e:ee:c5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

PresentationHostProxy.pdb

Imports

advapi32

RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW
RegEnumKeyW

kernel32

FreeLibrary
lstrlenW
GetProcAddress
GetModuleHandleW
lstrcmpiW
RaiseException
GetLastError
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
LeaveCriticalSection
CreateEventW
CloseHandle
GetCurrentThreadId
OutputDebugStringW
SetEvent
WaitForMultipleObjects
GetExitCodeThread
LoadLibraryW
ExitProcess
InterlockedCompareExchange
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
LocalAlloc
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
SetFilePointer
LoadLibraryA
InterlockedExchange
RtlUnwind
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
GetProcessHeap
WideCharToMultiByte
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetStdHandle
WriteFile
Sleep
HeapDestroy
HeapCreate
HeapReAlloc
VirtualAlloc
VirtualFree
GetCommandLineA
CreateThread
ExitThread
HeapFree
HeapAlloc

user32

PostQuitMessage
CharNextW
TranslateMessage
DispatchMessageW
GetMessageW

ole32

CoRegisterPSClsid
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
HWND_UserSize
HWND_UserFree
HWND_UserMarshal
HWND_UserUnmarshal
CoGetStdMarshalEx
OleInitialize
CoMarshalInterThreadInterfaceInStream
OleUninitialize
CoUnmarshalInterface
CoCreateInstance

rpcrt4

NdrOleAllocate
NdrStubForwardingFunction
NdrOleFree
IUnknown_QueryInterface_Proxy
CStdStubBuffer_AddRef
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
NdrDllUnregisterProxy
NdrDllGetClassObject
NdrCStdStubBuffer2_Release
NdrDllCanUnloadNow
NdrDllRegisterProxy
NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
IUnknown_AddRef_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_Invoke
IUnknown_Release_Proxy
NdrStubCall2

oleaut32

BSTR_UserMarshal
BSTR_UserUnmarshal
BSTR_UserFree
VarUI4FromStr
VariantInit
SysAllocStringLen
VariantClear
BSTR_UserSize
SysAllocString
SysFreeString

urlmon

ObtainUserAgentString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 329B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

48a06811b7b3201f5b2ce8175c910fe1

Code Sign

61:1a:f5:ea:00:00:00:00:00:6aCertificate

Extended Key Usages

Key Usages

61:05:19:96:00:00:00:00:00:1bCertificate

Extended Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:15:08:27:00:00:00:00:00:0cCertificate

Extended Key Usages

Key Usages

15:81:a4:10:4b:08:2e:7a:b3:61:0e:aa:31:a0:29:ee:af:9e:ee:c5Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

ole32

rpcrt4

oleaut32

urlmon

Exports

Exports

Sections

.text Size: 77KB - Virtual size: 76KB

.orpc Size: 512B - Virtual size: 329B

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 6KB

61:1a:f5:ea:00:00:00:00:00:6a
Certificate

61:05:19:96:00:00:00:00:00:1b
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:15:08:27:00:00:00:00:00:0c
Certificate

15:81:a4:10:4b:08:2e:7a:b3:61:0e:aa:31:a0:29:ee:af:9e:ee:c5
Signer

.text
Size: 77KB - Virtual size: 76KB

.orpc
Size: 512B - Virtual size: 329B

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 6KB