a4fae179004f63088e22d4dd654abd2b320c7329e0ae9329d773a801a8590295N

Sharing

Copy URL Twitter E-mail

General

Target

a4fae179004f63088e22d4dd654abd2b320c7329e0ae9329d773a801a8590295N
Size

94KB
MD5

f0c61d4401485b570e4c94012877d770
SHA1

a0361cdfa39df40972bacc6943a5b28045f98838
SHA256

a4fae179004f63088e22d4dd654abd2b320c7329e0ae9329d773a801a8590295
SHA512

23a50acfc03ebc5aee5b8690861ab384c43b496a896266861cf20f4295f6d8873c672f8d55008f02e3127f569026d996705e32ac304ba16d8b6a6d9f118dafe7
SSDEEP

1536:8DwgHOt0oaD0WL3aEfWzpdcnsB06XEGGdFnqvWyCWDsC63sW3b/cd3j6LafXIDUe:8DwzaD0tEfqdcnsB0GGd1ACWD+dbu3eb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4fae179004f63088e22d4dd654abd2b320c7329e0ae9329d773a801a8590295N

Files

a4fae179004f63088e22d4dd654abd2b320c7329e0ae9329d773a801a8590295N
.dll windows:6 windows x86 arch:x86

d0b64ddbe6dcf10da1bf138d69ad064c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\projects\processhacker\bin\Release32\plugins\UserNotes.pdb

Imports

uxtheme

EnableThemeDialogTexture

processhacker.exe

PhOpenProcess
_PhPluginAddMenuHook@12
PhInitializeLayoutManager
PhInsertEMenuItem
PhMainWndHandle
PhDeleteLayoutManager
PhFreeFileDialog
_PhPluginCreateEMenuItem@20
PhShowFileDialog
PhCreateEMenuItem
PhFindEntryHashtable
PhDereferenceObject
mxmlDelete
PhEnumHashtable
mxmlNewOpaque
PhfAcquireQueuedLockExclusive
PhConvertUtf8ToUtf16
mxmlElementSetAttr
PhReferenceObject
PhFree
PhInitializeAutoPool
PhAutoDereferenceObject
PhDrainAutoPool
PhCreateStringEx
PhInitializeStringBuilder
PhGetWindowText
PhCreateFileWin32
PhCreateHashtable
_PhPropPageDlgProcHeader@24
PhCompareStringRef
PhSetFileDialogFilter
PhFindEMenuItem
PhAppendFormatStringBuilder
_PhGetPluginInformation@4
PhCreateOpenFileDialog
PhAddSettings
PhGetStringSetting
PhGetFileDialogFileName
PhSetFileDialogFileName
_PhGetGeneralCallback@4
_PhFindPlugin@4
PhSetStringSetting2
_PhPluginSetObjectExtension@20
PhSplitStringRefAtChar
_PhAddProcessPropPage@8
_PhGetSelectedProcessItems@8
PhRemoveStringBuilder
_PhPropPageDlgProcDestroy@4
_PhShowProcessAffinityDialog2@12
_PhDoPropPageLayout@4
PhFinalStringBuilderString
PhAddLayoutItem
PhFormatString_V
PhProcessModifiedEvent
PhRegisterCallback
ProcessQueryAccess
PhCenterWindow
_PhGetSelectedProcessItem@0
PhConcatStringRef2
_PhPluginAddTreeNewColumn@24
_PhRegisterPlugin@12
_PhGetPluginCallback@8
PhGetFileName
_PhCreateProcessPropPageContextEx@16
PhExpandEnvironmentStrings
_PhPluginGetObjectExtension@12
PhProcessesUpdatedEvent
PhLayoutManagerLayout
_PhDuplicateProcessNodeList@0
_PhAddPropPageLayoutItem@16
PhGetApplicationDirectory
PhIntegerToString64
mxmlSaveFd
PhHashStringRef
PhGetFileSize
mxmlNewElement
PhAllocate
PhGetFullPath
mxmlLoadFd
PhEqualStringRef
PhConvertUtf16ToUtf8Ex
PhRemoveEntryHashtable
PhAddEntryHashtableEx
PhStringToInteger64
PhfWakeForReleaseQueuedLock
PhDeleteAutoPool
mxml_opaque_cb
PhReferenceEmptyString
_PhInvalidateAllProcessNodes@0

ntdll

RtlDetermineDosPathNameType_U
NtQueryInformationProcess
NtClose
NtSetInformationProcess
RtlUnwind

user32

MessageBoxW
GetPropW
SendMessageW
EndDialog
RemovePropW
SetDlgItemTextW
SetPropW
SetWindowLongW
GetDlgItem
GetParent
DialogBoxParamW
EnableWindow
SetWindowTextW

comdlg32

ChooseColorW

shell32

SHCreateDirectoryExW

comctl32

CreatePropertySheetPageW

kernel32

GetConsoleCP
FlushFileBuffers
WriteFile
SetStdHandle
HeapReAlloc
HeapSize
GetStringTypeW
GetFileType
GetStdHandle
GetProcessHeap
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetACP
GetConsoleMode
HeapFree
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
InterlockedFlushSList
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetFilePointerEx
RaiseException
HeapAlloc
DecodePointer
CloseHandle
CreateFileW
WriteConsoleW

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d0b64ddbe6dcf10da1bf138d69ad064c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

uxtheme

processhacker.exe

ntdll

user32

comdlg32

shell32

comctl32

kernel32

Sections

.text Size: 55KB - Virtual size: 55KB

.rdata Size: 27KB - Virtual size: 27KB

.data Size: 2KB - Virtual size: 4KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 55KB - Virtual size: 55KB

.rdata
Size: 27KB - Virtual size: 27KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 5KB - Virtual size: 4KB