28acce8d59122146f9d16e595209a72c0d33be93b1a8688a5b0d37e9cf5a9793

Sharing

Copy URL Twitter E-mail

General

Target

28acce8d59122146f9d16e595209a72c0d33be93b1a8688a5b0d37e9cf5a9793
Size

94KB
MD5

6b8bd94c00c24a3d75a90c4f783a3ac2
SHA1

f6c5cf646d96123b67b48509e9c9495c3626df91
SHA256

28acce8d59122146f9d16e595209a72c0d33be93b1a8688a5b0d37e9cf5a9793
SHA512

031365b42513e1176183bf03b04f5aaead4a98bad39aada47cf2d2dd4763b90c6f720b22ce37e33c0c9472e1a59f0f7358b2578be409cb01b8c30c10930eac6f
SSDEEP

1536:xDwgHOt0oaD0WL3aEfWzpdcnsB06XEGGdFnqvWyCWDsC63sW3b/cd3oShaTXIDUe:xDwzaD0tEfqdcnsB0GGd1ACWD+dbu31h

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28acce8d59122146f9d16e595209a72c0d33be93b1a8688a5b0d37e9cf5a9793

Files

28acce8d59122146f9d16e595209a72c0d33be93b1a8688a5b0d37e9cf5a9793
.dll windows:6 windows x86 arch:x86

d0b64ddbe6dcf10da1bf138d69ad064c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\projects\processhacker\bin\Release32\plugins\UserNotes.pdb

Imports

uxtheme

EnableThemeDialogTexture

processhacker.exe

PhOpenProcess
_PhPluginAddMenuHook@12
PhInitializeLayoutManager
PhInsertEMenuItem
PhMainWndHandle
PhDeleteLayoutManager
PhFreeFileDialog
_PhPluginCreateEMenuItem@20
PhShowFileDialog
PhCreateEMenuItem
PhFindEntryHashtable
PhDereferenceObject
mxmlDelete
PhEnumHashtable
mxmlNewOpaque
PhfAcquireQueuedLockExclusive
PhConvertUtf8ToUtf16
mxmlElementSetAttr
PhReferenceObject
PhFree
PhInitializeAutoPool
PhAutoDereferenceObject
PhDrainAutoPool
PhCreateStringEx
PhInitializeStringBuilder
PhGetWindowText
PhCreateFileWin32
PhCreateHashtable
_PhPropPageDlgProcHeader@24
PhCompareStringRef
PhSetFileDialogFilter
PhFindEMenuItem
PhAppendFormatStringBuilder
_PhGetPluginInformation@4
PhCreateOpenFileDialog
PhAddSettings
PhGetStringSetting
PhGetFileDialogFileName
PhSetFileDialogFileName
_PhGetGeneralCallback@4
_PhFindPlugin@4
PhSetStringSetting2
_PhPluginSetObjectExtension@20
PhSplitStringRefAtChar
_PhAddProcessPropPage@8
_PhGetSelectedProcessItems@8
PhRemoveStringBuilder
_PhPropPageDlgProcDestroy@4
_PhShowProcessAffinityDialog2@12
_PhDoPropPageLayout@4
PhFinalStringBuilderString
PhAddLayoutItem
PhFormatString_V
PhProcessModifiedEvent
PhRegisterCallback
ProcessQueryAccess
PhCenterWindow
_PhGetSelectedProcessItem@0
PhConcatStringRef2
_PhPluginAddTreeNewColumn@24
_PhRegisterPlugin@12
_PhGetPluginCallback@8
PhGetFileName
_PhCreateProcessPropPageContextEx@16
PhExpandEnvironmentStrings
_PhPluginGetObjectExtension@12
PhProcessesUpdatedEvent
PhLayoutManagerLayout
_PhDuplicateProcessNodeList@0
_PhAddPropPageLayoutItem@16
PhGetApplicationDirectory
PhIntegerToString64
mxmlSaveFd
PhHashStringRef
PhGetFileSize
mxmlNewElement
PhAllocate
PhGetFullPath
mxmlLoadFd
PhEqualStringRef
PhConvertUtf16ToUtf8Ex
PhRemoveEntryHashtable
PhAddEntryHashtableEx
PhStringToInteger64
PhfWakeForReleaseQueuedLock
PhDeleteAutoPool
mxml_opaque_cb
PhReferenceEmptyString
_PhInvalidateAllProcessNodes@0

ntdll

RtlDetermineDosPathNameType_U
NtQueryInformationProcess
NtClose
NtSetInformationProcess
RtlUnwind

user32

MessageBoxW
GetPropW
SendMessageW
EndDialog
RemovePropW
SetDlgItemTextW
SetPropW
SetWindowLongW
GetDlgItem
GetParent
DialogBoxParamW
EnableWindow
SetWindowTextW

comdlg32

ChooseColorW

shell32

SHCreateDirectoryExW

comctl32

CreatePropertySheetPageW

kernel32

GetConsoleCP
FlushFileBuffers
WriteFile
SetStdHandle
HeapReAlloc
HeapSize
GetStringTypeW
GetFileType
GetStdHandle
GetProcessHeap
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetACP
GetConsoleMode
HeapFree
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
InterlockedFlushSList
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetFilePointerEx
RaiseException
HeapAlloc
DecodePointer
CloseHandle
CreateFileW
WriteConsoleW

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d0b64ddbe6dcf10da1bf138d69ad064c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

uxtheme

processhacker.exe

ntdll

user32

comdlg32

shell32

comctl32

kernel32

Sections

.text Size: 55KB - Virtual size: 55KB

.rdata Size: 27KB - Virtual size: 27KB

.data Size: 2KB - Virtual size: 4KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 55KB - Virtual size: 55KB

.rdata
Size: 27KB - Virtual size: 27KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 5KB - Virtual size: 4KB