notepad++[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

notepad++.exe
Size

5.9MB
MD5

b4a060de93be7ebf6290554a863f1577
SHA1

4b405f3296e5d503c9243bf6cd9d62302adf430c
SHA256

bc1256e8d35c24431c53011153d7bfcb3453aee2bc00efafe29e97ed4f39ba5b
SHA512

26e482efbe486500483e0739ccb1086fd67e79ca8205cfc956800d426e2c8abc8c7d410dda0ebc77b118833428c107cf369dc22b0e4d7386f926f4c0a7011277
SSDEEP

98304:RO7vBSru/C9/RZlPtEfJdJNrL3r6GDbd5/moe:oplC9/RlmJdJB7rnl5e

Score

1^/10

Malware Config

Signatures

Files

notepad++.exe
.exe windows:5 windows x64 arch:x64

4481eeeb8d1e4d61d2ba670ce2825b57

Code Sign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

03:aa:64:92:de:9d:96:a9:0a:4b:ca:97:be:ad:b4:4a
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

13/05/2022, 00:00

Not After

14/05/2025, 23:59

Subject

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0b:eb:fd:18:ef:68:68:d3:ba:ea:ad:90:e3:69:10:01:61:a2:d2:27
Signer

Actual PE Digest

0b:eb:fd:18:ef:68:68:d3:ba:ea:ad:90:e3:69:10:01:61:a2:d2:27

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\sources\notepad-plus-plus\PowerEditor\bin64\npp.pdb

Imports

comctl32

ImageList_BeginDrag
ImageList_EndDrag
ImageList_SetIconSize
ImageList_DragMove
ImageList_DragShowNolock
ImageList_Remove
ImageList_AddMasked
ord17
InitCommonControlsEx
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Create
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_Draw
ord413
ord412
ImageList_DragEnter
ord410

shlwapi

PathMatchSpecW
ColorRGBToHLS
PathStripPathW
PathAppendW
PathAddExtensionW
PathRemoveExtensionW
PathIsDirectoryW
PathCombineW
AssocQueryStringW
PathFindFileNameW
PathIsRelativeW
PathGetDriveNumberW
PathCompactPathExW
PathFindExtensionW
PathFileExistsW
PathRemoveFileSpecW
ColorHLSToRGB

shell32

SHFileOperationW
SHCreateItemFromParsingName
DragQueryPoint
DragFinish
ShellExecuteW
ord165
SHGetFolderPathW
DragQueryFileW
Shell_NotifyIconW

dbghelp

ImageNtHeader

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

crypt32

CryptQueryObject
CertGetNameStringW
CertNameToStrW
CertGetCertificateContextProperty
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CryptMsgClose

wintrust

WinVerifyTrust

sensapi

IsDestinationReachableW
IsNetworkAlive

wininet

InternetCrackUrlW

imm32

ImmSetCompositionStringW
ImmEscapeW
ImmGetCompositionStringW
ImmSetCompositionWindow
ImmSetCompositionFontW
ImmReleaseContext
ImmGetContext
ImmNotifyIME
ImmSetCandidateWindow

msimg32

AlphaBlend

kernel32

GlobalLock
GetCurrentDirectoryW
CreateFileW
FlushFileBuffers
SetFilePointerEx
WriteFile
CloseHandle
GetLocalTime
GlobalAlloc
FormatMessageW
GetTimeFormatEx
GetDateFormatEx
LCMapStringW
FormatMessageA
ExpandEnvironmentStringsW
SetCurrentDirectoryW
FreeLibrary
LoadResource
LockResource
SizeofResource
FindResourceW
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
CreateThread
CopyFileW
GetCurrentProcess
GetCurrentProcessId
LoadLibraryW
ReleaseMutex
CreateMutexW
Sleep
GlobalSize
lstrcpynW
WaitForMultipleObjects
CopyFileExW
GetSystemInfo
GetVersionExW
CreateFileMappingW
MapViewOfFile
DeleteFileW
GetTempPathW
SetLastError
CancelIo
SleepEx
WaitForSingleObjectEx
QueueUserAPC
ReadDirectoryChangesW
GetLocaleInfoA
GetTickCount
GetStringTypeExW
LCMapStringA
GetStringTypeExA
GetUserDefaultLCID
LoadLibraryA
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeCriticalSectionAndSpinCount
GetLocaleInfoEx
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
GetTimeFormatW
GetSystemTimeAsFileTime
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
GetModuleHandleExW
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
IsProcessorFeaturePresent
GetNativeSystemInfo
RaiseException
RtlPcToFileHeader
QueryPerformanceFrequency
QueryPerformanceCounter
InitOnceBeginInitialize
InitOnceComplete
GetStringTypeW
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
CreateDirectoryW
CompareFileTime
lstrlenW
lstrcmpW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
WideCharToMultiByte
MultiByteToWideChar
GetACP
GlobalFree
GetModuleFileNameW
GetVersion
GetCurrentThreadId
MulDiv
LocalFree
GetDateFormatW
LocalAlloc
GetLastError
OutputDebugStringW
lstrcmpiW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
VirtualProtect
IsDebuggerPresent
GetStartupInfoW
GlobalUnlock
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
MoveFileExW
lstrcpyW
SetFileAttributesW
GetLongPathNameW
GetFullPathNameW
GetFileAttributesExW
InitializeSListHead
RtlUnwindEx
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ReadFile
ExitProcess
ExitThread
FreeLibraryAndExitThread
GetStdHandle
HeapAlloc
HeapFree
GetFileType
GetConsoleMode
ReadConsoleW
CompareStringW
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
GetConsoleOutputCP
GetFileSizeEx
RtlUnwind
IsValidCodePage
GetOEMCP
HeapReAlloc
FindFirstFileExW
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
HeapSize
SetEndOfFile
WriteConsoleW
UnmapViewOfFile

user32

BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
KillTimer
GetCaretBlinkTime
AppendMenuA
GetMessageTime
GetKeyboardLayout
ValidateRect
SetTimer
MsgWaitForMultipleObjects
NotifyWinEvent
GetUpdateRgn
SystemParametersInfoA
GetDoubleClickTime
DrawTextA
CopyImage
MonitorFromPoint
AdjustWindowRectEx
LoadStringW
LoadStringA
CharLowerW
RemoveMenu
GetIconInfo
CreateIconIndirect
LoadIconW
GetDesktopWindow
WindowFromPoint
LockWindowUpdate
GetDCEx
mouse_event
GetDlgItemTextA
GetScrollInfo
SetScrollInfo
DestroyIcon
GetSysColorBrush
MessageBoxA
GetWindowTextLengthW
FlashWindowEx
RegisterClassExW
UnregisterClassW
PostQuitMessage
DispatchMessageW
TranslateMessage
GetMessageW
BringWindowToTop
ReleaseCapture
SetCapture
GetActiveWindow
SetParent
RedrawWindow
IsChild
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
FindWindowExW
IsWindowEnabled
SetMenuItemInfoW
InsertMenuW
GetMenuItemCount
EnableMenuItem
CheckMenuItem
DestroyMenu
CreatePopupMenu
CreateMenu
GetMenuState
EmptyClipboard
SetClipboardData
IsWindow
GetDlgCtrlID
GetDlgItemInt
CreateDialogParamW
ClientToScreen
IsWindowVisible
ShowWindow
IsClipboardFormatAvailable
RegisterClipboardFormatW
GetClipboardData
ChangeClipboardChain
SetClipboardViewer
CloseClipboard
OpenClipboard
CharUpperW
GetParent
SetCaretPos
ShowCaret
HideCaret
DestroyCaret
CreateCaret
SetCursor
MessageBeep
RemovePropW
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
GetDC
UpdateWindow
DrawTextExW
GetMenu
GetSystemMetrics
ToAscii
GetKeyboardState
DrawIcon
LoadMenuW
IsDialogMessageW
SetMenu
GetMonitorInfoW
GetPropW
ScrollWindow
DestroyCursor
CreateCursor
RegisterWindowMessageW
AppendMenuW
LoadBitmapW
MonitorFromWindow
CheckMenuRadioItem
ChildWindowFromPointEx
SetRectEmpty
GetCapture
TrackMouseEvent
MonitorFromRect
CreateDialogIndirectParamW
ShowCursor
FindWindowW
CreateAcceleratorTableW
GetClassNameA
IsCharLowerW
IsCharAlphaNumericW
SetForegroundWindow
SetMenuItemBitmaps
DeleteMenu
DrawMenuBar
GetMenuStringW
SetWindowPlacement
GetWindowPlacement
DestroyWindow
CreateWindowExW
RegisterClassW
PostMessageW
DrawFrameControl
DrawEdge
MoveWindow
DrawIconEx
LoadImageW
EnableWindow
GetKeyState
SetFocus
SendDlgItemMessageW
EndDialog
DialogBoxIndirectParamW
DialogBoxParamW
GetComboBoxInfo
GetMenuBarInfo
GetClassNameW
EnumThreadWindows
EnumChildWindows
GetWindowLongW
PtInRect
OffsetRect
IntersectRect
InflateRect
FrameRect
FillRect
DrawFocusRect
GetSysColor
ChildWindowFromPoint
MapWindowPoints
ScreenToClient
GetCursorPos
GetWindowRect
GetClientRect
GetWindowTextW
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetWindowDC
DrawTextW
GetMenuItemInfoW
GetFocus
SetWindowPos
DefWindowProcW
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowTextW
GetDlgItemTextW
SetDlgItemTextW
SetDlgItemTextA
GetDlgItem
CallWindowProcW
SendMessageW
MessageBoxW
wsprintfW
GetAncestor
SystemParametersInfoW
SetPropW
TranslateAcceleratorW
DestroyAcceleratorTable
IsZoomed
IsIconic
ModifyMenuW
InsertMenuItemW
ShowScrollBar
IsCharAlphaW
GetMenuItemID
GetSubMenu
LoadCursorW
SetDlgItemInt
TrackPopupMenu

gdi32

CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
MoveToEx
GetPixel
BitBlt
RestoreDC
SelectClipRgn
LineTo
CreateHatchBrush
GetTextMetricsW
SetROP2
GetROP2
CreateFontW
Polyline
ExtTextOutW
GetDeviceCaps
SetTextColor
SetWindowOrgEx
OffsetWindowOrgEx
CreateBitmap
CreatePatternBrush
PatBlt
SetBrushOrgEx
GetDIBits
SetDIBits
EnumFontFamiliesExW
SetTextAlign
StartDocW
EndDoc
StartPage
EndPage
DPtoLP
GetTextExtentPointW
StretchBlt
CombineRgn
IntersectClipRect
Ellipse
Polygon
ExtCreatePen
GetTextExtentExPointA
GetTextExtentExPointW
GetTextExtentPoint32A
CreateDIBSection
ExtTextOutA
SetBkMode
SetBkColor
GetObjectW
RoundRect
Rectangle
GetTextExtentPoint32W
GetStockObject
GetClipRgn
ExcludeClipRect
DeleteObject
CreateSolidBrush
CreateRectRgnIndirect
CreateRectRgn
CreatePen
CreateFontIndirectW
SelectObject
SaveDC
CreateFontA

comdlg32

ChooseColorW
PrintDlgW

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
IsTextUnicode

ole32

CLSIDFromProgID
RegisterDragDrop
OleInitialize
DoDragDrop
OleUninitialize
ReleaseStgMedium
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
RevokeDragDrop

oleaut32

SysAllocStringLen
SysFreeString

uxtheme

OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeBackgroundContentRect
GetThemePartSize
GetThemeFont
SetWindowTheme
EnableThemeDialogTexture
DrawThemeParentBackground
GetThemeTransitionDuration
BufferedPaintRenderAnimation
EndBufferedAnimation
BeginBufferedAnimation
BufferedPaintStopAllAnimations
DrawThemeTextEx

Exports

Exports

CreateLexer
GetLexerCount
GetLexerFactory
GetLexerName
GetLibraryPropertyNames
GetNameSpace
LexerNameFromID
SetLibraryProperty

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 790KB - Virtual size: 790KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 74KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4481eeeb8d1e4d61d2ba670ce2825b57

Code Sign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

03:aa:64:92:de:9d:96:a9:0a:4b:ca:97:be:ad:b4:4aCertificate

Extended Key Usages

Key Usages

0b:eb:fd:18:ef:68:68:d3:ba:ea:ad:90:e3:69:10:01:61:a2:d2:27Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

shlwapi

shell32

dbghelp

version

crypt32

wintrust

sensapi

wininet

imm32

msimg32

kernel32

user32

gdi32

comdlg32

advapi32

ole32

oleaut32

uxtheme

Exports

Exports

Sections

.text Size: 3.6MB - Virtual size: 3.6MB

.rdata Size: 790KB - Virtual size: 790KB

.data Size: 74KB - Virtual size: 153KB

.pdata Size: 103KB - Virtual size: 102KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.reloc Size: 20KB - Virtual size: 19KB

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

03:aa:64:92:de:9d:96:a9:0a:4b:ca:97:be:ad:b4:4a
Certificate

0b:eb:fd:18:ef:68:68:d3:ba:ea:ad:90:e3:69:10:01:61:a2:d2:27
Signer

.text
Size: 3.6MB - Virtual size: 3.6MB

.rdata
Size: 790KB - Virtual size: 790KB

.data
Size: 74KB - Virtual size: 153KB

.pdata
Size: 103KB - Virtual size: 102KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

.reloc
Size: 20KB - Virtual size: 19KB