taskmanager[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

taskmanager.dll
Size

3.7MB
MD5

eaac3deec2c925a90c9312ea84b7dc78
SHA1

9628d460c4a73c4168e044a09d1e104622f53c41
SHA256

0d65ddeabe482ca2566d6b4387212a14780f600762f4fe94847551e20cac49c9
SHA512

74e1cdfb562b70efcc918bd605456b547013c52b9b9b703e0eb176c340df668e752df2842b6834164dd707fb7325a4c4e0a61115e3b25b97205897e4078dc077
SSDEEP

49152:hAFDDwj4WU7x3oYM5KBfvwL0dmZqaCp2cr19xS7ssEw2x:CD+wRM5q+/q9gWf

Score

1^/10

Malware Config

Signatures

Files

taskmanager.dll
.dll windows:6 windows x64 arch:x64

9a044126d6a6564e400305171a454c2b

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:9e:98:88:d0:f9:7a:54:32:82:7a:5e
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

04/10/2021, 17:33

Not After

04/10/2024, 17:33

Subject

SERIALNUMBER=2306741,CN=McAfee\, LLC,O=McAfee\, LLC,STREET=6220 America Ctr Dr,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

47:e0:d8:57:8a:b2:00:08:39:19:fa:11
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

13/10/2023, 14:08

Not After

13/10/2026, 14:08

Subject

SERIALNUMBER=2306741,CN=McAfee\, LLC,O=McAfee\, LLC,STREET=6220 America Ctr Dr,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

56:6e:8b:95:eb:cd:95:9b:1a:7f:a5:06:42:de:6d:c5:50:76:20:6d:b2:12:29:8d:f1:21:6d:b6:02:d7:02:0b
Signer

Actual PE Digest

56:6e:8b:95:eb:cd:95:9b:1a:7f:a5:06:42:de:6d:c5:50:76:20:6d:b2:12:29:8d:f1:21:6d:b6:02:d7:02:0b

Digest Algorithm

sha256

PE Digest Matches

true

56:6e:8b:95:eb:cd:95:9b:1a:7f:a5:06:42:de:6d:c5:50:76:20:6d:b2:12:29:8d:f1:21:6d:b6:02:d7:02:0b
Signer

Actual PE Digest

56:6e:8b:95:eb:cd:95:9b:1a:7f:a5:06:42:de:6d:c5:50:76:20:6d:b2:12:29:8d:f1:21:6d:b6:02:d7:02:0b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\TaskManager.pdb

Imports

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

kernel32

GetModuleFileNameW
Sleep
GetFileAttributesW
FindFirstFileW
FindNextFileW
CreateDirectoryW
OutputDebugStringW
WTSGetActiveConsoleSessionId
LoadLibraryExW
GetSystemInfo
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateMutexA
ReleaseMutex
WaitNamedPipeW
CreateFileW
GetNamedPipeServerProcessId
GetNamedPipeClientProcessId
GetCurrentThreadId
CancelIoEx
WriteFile
GetOverlappedResult
ReadFile
CreateNamedPipeW
ConnectNamedPipe
GetCurrentProcessId
GetCurrentProcess
lstrcmpiW
K32EnumProcesses
QueryFullProcessImageNameW
TerminateProcess
ProcessIdToSessionId
GetTickCount64
FormatMessageW
LocalAlloc
LoadLibraryExA
lstrcmpiA
DuplicateHandle
CreateThread
WaitForMultipleObjectsEx
WaitForSingleObjectEx
CancelIo
ReadDirectoryChangesW
GetUserDefaultLangID
GetUserDefaultUILanguage
GetSystemPowerStatus
GetFileSizeEx
SetLastError
UnmapViewOfFile
VirtualQuery
MapViewOfFile
IsDebuggerPresent
RtlCaptureContext
RaiseFailFastException
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentThread
GetSystemDirectoryW
GetModuleHandleExW
LoadLibraryW
GetNativeSystemInfo
VerifyVersionInfoW
GetCommandLineW
GetComputerNameW
GetFinalPathNameByHandleW
LCMapStringEx
GetFileInformationByHandleEx
SetFileInformationByHandle
GetDateFormatEx
SystemTimeToFileTime
GlobalAlloc
SetFilePointer
GetTempFileNameW
ReplaceFileW
GetSystemTimeAsFileTime
GetVolumeInformationW
CreateMutexW
GetPrivateProfileStringW
GetFileSize
CopyFileW
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
CreateFileMappingW
FormatMessageA
LockFileEx
UnlockFile
HeapCompact
DeleteFileA
LoadLibraryA
CreateFileA
FlushViewOfFile
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetFullPathNameW
HeapCreate
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
CreateSemaphoreW
ReleaseSemaphore
CreateDirectoryA
FindFirstFileA
FindNextFileA
GetFileAttributesExA
RemoveDirectoryA
SetFilePointerEx
GetLocalTime
CreateFileMappingA
MoveFileA
ReplaceFileA
MapViewOfFileEx
GetModuleHandleW
MoveFileExW
DeleteFileW
GetProcAddress
FreeLibrary
LocalFree
DeleteCriticalSection
DecodePointer
InitializeCriticalSectionEx
GlobalFree
CreateProcessW
FindResourceW
FindResourceExW
LoadResource
LockResource
SizeofResource
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
MultiByteToWideChar
WideCharToMultiByte
TerminateThread
WaitForSingleObject
WaitForMultipleObjects
ResetEvent
CreateEventW
GetExitCodeProcess
SetEvent
GetLastError
OpenProcess
CloseHandle
FindClose
GetSystemTime
VerSetConditionMask
GetLargePageMinimum
QueryUnbiasedInterruptTime
WriteConsoleW
ReadConsoleW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetConsoleMode
GetConsoleOutputCP
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileType
GetStdHandle
ExitProcess
FreeLibraryAndExitThread
ExitThread
RtlUnwind
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
RtlUnwindEx
InitializeSListHead
GetStartupInfoW
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
InitializeCriticalSectionAndSpinCount
GetCPInfo
CompareStringEx
RaiseException
VirtualProtect
GetStringTypeW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
SwitchToThread
GetExitCodeThread
QueryPerformanceFrequency
InitOnceBeginInitialize
InitOnceComplete
GetLocaleInfoEx
FindFirstFileExW
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
RtlPcToFileHeader
ReleaseSRWLockShared
AcquireSRWLockShared
EncodePointer
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree

user32

CharUpperBuffW
CharLowerBuffA
CharLowerBuffW

advapi32

RegCloseKey
RegEnumKeyExW
ConvertSidToStringSidA
GetTraceEnableFlags
LookupAccountNameW
RegCreateKeyExA
RegOpenKeyExA
ConvertSidToStringSidW
GetTokenInformation
GetLengthSid
SetTokenInformation
ConvertStringSidToSidW
OpenProcessToken
CreateProcessAsUserW
RegEnumValueW
RegQueryInfoKeyW
SetNamedSecurityInfoW
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
DuplicateTokenEx
ImpersonateLoggedOnUser
RevertToSelf
RegSetValueExA
RegSetValueExW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegDeleteTreeW
RegNotifyChangeKeyValue
RegCreateKeyExW
StartTraceW
EnableTraceEx2
RegisterTraceGuidsW
UnregisterTraceGuids
TraceEvent
GetTraceLoggerHandle
GetTraceEnableLevel
ControlTraceW

shell32

SHGetKnownFolderPath
SHGetFolderPathW
SHGetSpecialFolderPathW

ole32

CoTaskMemFree
CoSetProxyBlanket
CoCreateGuid
StringFromGUID2
CoInitializeSecurity
OleRun
CoCreateInstance
StringFromCLSID
CoUninitialize
CoInitializeEx

oleaut32

SysAllocString
SysFreeString
SysAllocStringLen
VariantClear
SysStringLen

bcrypt

BCryptDestroyKey
BCryptImportKeyPair
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptGenRandom
BCryptVerifySignature
BCryptOpenAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptGetProperty
BCryptFinishHash

shlwapi

PathCombineW
PathFindExtensionW
PathIsRelativeW
PathFileExistsW
StrRChrW
StrCmpNIW
PathFindFileNameW

Exports

Exports

CreateModule

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 711KB - Virtual size: 710KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 89KB - Virtual size: 235KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9a044126d6a6564e400305171a454c2b

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

7d:9e:98:88:d0:f9:7a:54:32:82:7a:5eCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

47:e0:d8:57:8a:b2:00:08:39:19:fa:11Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

56:6e:8b:95:eb:cd:95:9b:1a:7f:a5:06:42:de:6d:c5:50:76:20:6d:b2:12:29:8d:f1:21:6d:b6:02:d7:02:0bSigner

56:6e:8b:95:eb:cd:95:9b:1a:7f:a5:06:42:de:6d:c5:50:76:20:6d:b2:12:29:8d:f1:21:6d:b6:02:d7:02:0bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

userenv

kernel32

user32

advapi32

shell32

ole32

oleaut32

bcrypt

shlwapi

Exports

Exports

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.rdata Size: 711KB - Virtual size: 710KB

.data Size: 89KB - Virtual size: 235KB

.pdata Size: 131KB - Virtual size: 130KB

.didat Size: 512B - Virtual size: 384B

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 1024B - Virtual size: 856B

.reloc Size: 26KB - Virtual size: 26KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

7d:9e:98:88:d0:f9:7a:54:32:82:7a:5e
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

47:e0:d8:57:8a:b2:00:08:39:19:fa:11
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

56:6e:8b:95:eb:cd:95:9b:1a:7f:a5:06:42:de:6d:c5:50:76:20:6d:b2:12:29:8d:f1:21:6d:b6:02:d7:02:0b
Signer

56:6e:8b:95:eb:cd:95:9b:1a:7f:a5:06:42:de:6d:c5:50:76:20:6d:b2:12:29:8d:f1:21:6d:b6:02:d7:02:0b
Signer

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 711KB - Virtual size: 710KB

.data
Size: 89KB - Virtual size: 235KB

.pdata
Size: 131KB - Virtual size: 130KB

.didat
Size: 512B - Virtual size: 384B

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 1024B - Virtual size: 856B

.reloc
Size: 26KB - Virtual size: 26KB