71a0508bf75b1b3f84606026ca9dd764

Sharing

Copy URL

Twitter E-mail

General

Target

71a0508bf75b1b3f84606026ca9dd764
Size

5.9MB
MD5

71a0508bf75b1b3f84606026ca9dd764
SHA1

dbb4dd16882685410e70b1babfaf6b832be4183a
SHA256

1df95ebb57c93ce4374ff3ba6fcdad3662af67015abade8925c242a04e1b6b6c
SHA512

c44509540183529e3fefbc50d92a93356fb891483712c8500eac818e7c7ec2cb85eea51aebdcc3043e6067a2abd3cdc1d90148047808f26f9883beccf751b60d
SSDEEP

98304:h1Nwt0IdVFLa+CWaPknoMiIgSLr/e9Yo0Pa7Re+P9sZ5QH/i0tu1S9Qnlr8ik1Xz:G9fVDaPknBiBSLy91t7RpgRns9Qlwx1D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack002/DATA PROTECTION/freebl3.dll

Files

71a0508bf75b1b3f84606026ca9dd764
.zip

Password: infected
npp.8.4.1.Installer.x64.zip
.zip
DATA PROTECTION/Privacy Policy.txt
DATA PROTECTION/combase.dll
.dll windows:6 windows x64 arch:x64

ba8646d28f2e7b54e7bcd331d13af3a6

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-12-2020 21:29

Not After

02-12-2021 21:29

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cd:be:61:d4:d7:63:11:87:41:1e:bf:d0:47:06:95:70:ef:6d:eb:bc:4b:2d:a2:15:07:f3:9b:84:ab:5c:67:3c
Signer

Actual PE Digest

cd:be:61:d4:d7:63:11:87:41:1e:bf:d0:47:06:95:70:ef:6d:eb:bc:4b:2d:a2:15:07:f3:9b:84:ab:5c:67:3c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

combase.pdb

Imports

msvcrt

__dllonexit
_unlock
_lock
__C_specific_handler
_onexit
_initterm
_amsg_exit
_XcptFilter
_itoa_s
memcpy_s
??_V@YAXPEAX@Z
memset
memcpy
memcmp
_local_unwind
wcsnlen
wcsncpy_s
??_U@YAPEAX_K@Z
_wcsnicmp
wcsrchr
_vsnprintf
wcsstr
_wcslwr
_wtol
wcstok
wcschr
qsort
realloc
memmove_s
free
malloc
rand_s
wcsncmp
memmove
_wtoi
_resetstkoflw
_purecall
_wcsicmp
_vsnwprintf
__CxxFrameHandler3
swprintf_s
wcscmp

api-ms-win-core-heap-l1-2-0

HeapSize
HeapValidate
HeapAlloc
HeapFree
GetProcessHeap
HeapCreate
HeapDestroy
HeapReAlloc
HeapCompact

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-2

GetProcessMitigationPolicy
GetCurrentThreadId
TerminateProcess
GetCurrentThread
SetThreadStackGuarantee
SwitchToThread
OpenProcess
ProcessIdToSessionId
GetCurrentProcess
SetThreadToken
OpenThreadToken
OpenProcessToken
CreateThread
GetProcessId
GetCurrentProcessId

api-ms-win-core-registry-l1-1-0

RegGetValueA
RegDeleteKeyExA
RegCloseKey
RegOpenCurrentUser
RegOpenKeyExW
RegOpenUserClassesRoot
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegDeleteKeyExW
RegEnumKeyExW
RegCreateKeyExA
RegSetValueExW
RegGetValueW
RegEnumValueW
RegCreateKeyExW

api-ms-win-core-synch-l1-2-0

SleepEx
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
SetWaitableTimerEx
LeaveCriticalSection
Sleep
WaitForSingleObject
ReleaseSRWLockExclusive
InitializeSRWLock
CreateWaitableTimerExW
ResetEvent
CreateEventW
DeleteCriticalSection
OpenEventW
SetEvent
WaitForMultipleObjectsEx
CreateEventA
InitOnceExecuteOnce
ReleaseSRWLockShared
AcquireSRWLockShared
WaitForSingleObjectEx
AcquireSRWLockExclusive
OpenEventA

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

rpcrt4

RpcServerUseProtseqEpW
RpcBindingVectorFree
NdrConvert2
RpcServerUseProtseqExW
RpcServerUseProtseqEpExW
RpcBindingFromStringBindingW
RpcServerUseProtseqW
RpcBindingCreateW
RpcBindingBind
SimpleTypeBufferSize
NdrMesTypeDecode2
NdrMesTypeAlignSize2
NdrMesTypeEncode2
RpcAsyncCompleteCall
NdrClientCall2
RpcErrorAddRecord
RpcMgmtSetComTimeout
RpcMgmtInqComTimeout
I_RpcServerSubscribeForDisconnectNotification
I_RpcServerGetAssociationID
I_RpcMgmtEnableDedicatedThreadPool
NdrCorrelationInitialize
NdrFullPointerXlatInit
SimpleTypeMemorySize
NdrFullPointerXlatFree
NdrClearOutParameters
I_RpcBCacheFree
NdrCorrelationFree
I_RpcExceptionFilter
NdrGetTypeFlags
MesEncodeFixedBufferHandleCreate
MesHandleFree
SimpleTypeAlignment
I_RpcBCacheAllocate
MesBufferHandleReset
MesDecodeBufferHandleCreate
I_RpcFixTransferSyntax
I_RpcSendReceive
RpcRaiseException
RpcErrorEndEnumeration
RpcErrorGetNextRecord
RpcErrorStartEnumeration
NdrClientInitializeNew
I_RpcReceive
I_RpcAsyncSetHandle
NdrServerInitialize
I_RpcGetBuffer
I_RpcAllocate
I_RpcFree
I_RpcGetBufferWithObject
UuidCreate
I_RpcRequestMutex
NdrStubCall2
I_RpcNegotiateTransferSyntax
I_RpcClearMutex
I_RpcMgmtQueryDedicatedThreadPool
RpcBindingFree
RpcBindingSetOption
NdrAsyncServerCall
NdrServerCall2
RpcBindingUnbind
RpcBindingCopy
NdrMesTypeDecode3
I_RpcSend
I_RpcAsyncAbortCall
RpcServerUnregisterIf
RpcServerRegisterIf3
RpcImpersonateClient2
RpcServerRegisterAuthInfoW
RpcCertGeneratePrincipalNameW
I_RpcOpenClientProcess
RpcBindingInqAuthClientW
NdrMesTypeEncode3
I_RpcSetDCOMAppId
I_RpcBindingInqCurrentModifiedId
RpcBindingInqObject
I_RpcBindingInqLocalClientPID
RpcBindingServerFromClient
RpcRevertToSelfEx
RpcImpersonateClient
RpcStringBindingParseW
RpcBindingToStringBindingW
I_RpcBindingInqTransportType
RpcServerInqCallAttributesW
I_RpcBindingSetPrivateOption
RpcBindingSetAuthInfoExW
RpcSmDestroyClientContext
NdrClientCall3
NdrStubCall3
RpcStringFreeW
RpcBindingInqAuthInfoExW
RpcCancelThreadEx
RpcMgmtSetCancelTimeout
NdrOleAllocate
NdrOleFree
NdrDllGetClassObject
RpcAsyncCancelCall
RpcServerInqBindings
RpcServerTestCancel
NdrGetUserMarshalInfo
I_RpcFreeBuffer
RpcAsyncInitializeHandle
RpcAsyncGetCallStatus

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime
GetTickCount64
GetComputerNameExW
GetSystemInfo
GetSystemWindowsDirectoryW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
OutputDebugStringA
DebugBreak
IsDebuggerPresent

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWork
CloseThreadpoolWait
CreateThreadpoolWait
SetThreadpoolWait
SetEventWhenCallbackReturns
WaitForThreadpoolWaitCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-fibers-l1-1-1

FlsAlloc
FlsSetValue
FlsFree
IsThreadAFiber

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
GetModuleHandleW
LoadLibraryExA
GetProcAddress
LoadStringW
FreeLibrary
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleExW

api-ms-win-core-string-l1-1-0

GetStringTypeW
WideCharToMultiByte
CompareStringOrdinal
CompareStringW
MultiByteToWideChar

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW
SearchPathW
FreeEnvironmentStringsW
GetEnvironmentStringsW

api-ms-win-security-base-l1-2-0

CreateWellKnownSid
AccessCheck
CheckTokenMembership
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeSid
GetSidLengthRequired
GetAppContainerAce
InitializeAcl
InitializeSecurityDescriptor
ImpersonateLoggedOnUser
GetAce
MapGenericMask
GetSidSubAuthorityCount
GetKernelObjectSecurity
GetSidSubAuthority
DuplicateToken
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
MakeSelfRelativeSD
IsValidSecurityDescriptor
GetTokenInformation
RevertToSelf
ImpersonateAnonymousToken
AccessCheckByType
GetSecurityDescriptorDacl
GetLengthSid
IsValidSid
GetSecurityDescriptorLength
PrivilegeCheck
CopySid
EqualSid

api-ms-win-core-rtlsupport-l1-2-0

RtlCompareMemory
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-memory-l1-1-2

UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
VirtualProtect
VirtualAlloc
VirtualQuery
MapViewOfFile

api-ms-win-core-localization-l1-2-1

FormatMessageW
LCMapStringW

api-ms-win-core-file-l1-2-1

CreateFileW

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventRegister
EventWriteEx
EventUnregister

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled
QuirkIsEnabledForProcess

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-kernel32-legacy-l1-1-1

RaiseFailFastException

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrcmpiA
lstrcmpiW
lstrlenA

api-ms-win-core-heap-obsolete-l1-1-0

GlobalSize
LocalAlloc
GlobalFree
LocalFree
GlobalUnlock
GlobalReAlloc
GlobalAlloc
GlobalLock

api-ms-win-core-privateprofile-l1-1-1

GetProfileStringW

api-ms-win-core-sidebyside-l1-1-0

ReleaseActCtx
FindActCtxSectionGuid
FindActCtxSectionStringW
ActivateActCtx
AddRefActCtx
DeactivateActCtx
GetCurrentActCtx
CreateActCtxW

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock

ntdll

RtlCopySid
NtQueryInformationToken
RtlLengthSid
NtQueryObject
LdrStandardizeSystemPath
RtlFreeSid
RtlDelete
RtlApplicationVerifierStop
RtlCheckForOrphanedCriticalSections
NtQueryInformationThread
RtlFreeHeap
RtlGetAppContainerNamedObjectPath
NtTerminateProcess
RtlReportException
RtlInitializeCriticalSectionAndSpinCount
NtQueryTimerResolution
RtlLoadString
RtlInitializeConditionVariable
ord1
EvtIntReportEventAndSourceAsync
RtlSplay
RtlDeleteNoSplay
RtlInitUnicodeString
NtOpenKey
RtlEqualUnicodeString
WinSqmSetDWORD
RtlInitializeCriticalSection
RtlImageNtHeader
RtlIsCriticalSectionLockedByThread
RtlDllShutdownInProgress
DbgPrint
EtwEventUnregister
RtlAllocateHeap
NtQueryValueKey
RtlQueryPackageIdentity
ZwQuerySecurityAttributesToken
RtlSidDominates
RtlGetAppContainerSidType
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwGetTraceLoggerHandle
NtQuerySystemInformation
RtlSleepConditionVariableCS
RtlDeleteCriticalSection
RtlWakeAllConditionVariable
NtQueryInformationProcess
NtApphelpCacheControl
RtlInitUnicodeStringEx
RtlValidRelativeSecurityDescriptor
NtClose
NtDuplicateObject
NtCreateKey
RtlRealPredecessor
EtwEventRegister
EtwTraceMessage
EtwEventWrite
RtlNtStatusToDosError
NtQueryKey

api-ms-win-core-interlocked-l1-2-0

InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

CLSIDFromOle1Class
CLSIDFromProgID
CLSIDFromString
CleanupOleStateInAllTls
CleanupTlsOleState
ClearCleanupFlag
CoAddRefServerProcess
CoAllowUnmarshalerCLSID
CoCancelCall
CoCopyProxy
CoCreateErrorInfo
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoCreateInstance
CoCreateInstanceEx
CoCreateInstanceFromApp
CoCreateObjectInContext
CoDeactivateObject
CoDecodeProxy
CoDecrementMTAUsage
CoDisableCallCancellation
CoDisconnectContext
CoDisconnectObject
CoEnableCallCancellation
CoFreeUnusedLibraries
CoFreeUnusedLibrariesEx
CoGetActivationState
CoGetApartmentID
CoGetApartmentType
CoGetCallContext
CoGetCallState
CoGetCallerTID
CoGetCancelObject
CoGetClassObject
CoGetClassVersion
CoGetContextToken
CoGetCurrentLogicalThreadId
CoGetCurrentProcess
CoGetDefaultContext
CoGetErrorInfo
CoGetInstanceFromFile
CoGetInstanceFromIStorage
CoGetInterfaceAndReleaseStream
CoGetMalloc
CoGetMarshalSizeMax
CoGetModuleType
CoGetObjectContext
CoGetPSClsid
CoGetProcessIdentifier
CoGetStandardMarshal
CoGetStdMarshalEx
CoGetSystemSecurityPermissions
CoGetTreatAsClass
CoImpersonateClient
CoIncrementMTAUsage
CoInitializeEx
CoInitializeSecurity
CoInitializeWOW
CoInvalidateRemoteMachineBindings
CoIsHandlerConnected
CoLockObjectExternal
CoMarshalHresult
CoMarshalInterThreadInterfaceInStream
CoMarshalInterface
CoPopServiceDomain
CoPushServiceDomain
CoQueryAuthenticationServices
CoQueryClientBlanket
CoQueryProxyBlanket
CoReactivateObject
CoRegisterActivationFilter
CoRegisterClassObject
CoRegisterInitializeSpy
CoRegisterMallocSpy
CoRegisterMessageFilter
CoRegisterPSClsid
CoRegisterSurrogate
CoRegisterSurrogateEx
CoReleaseMarshalData
CoReleaseServerProcess
CoResumeClassObjects
CoRetireServer
CoRevertToSelf
CoRevokeClassObject
CoRevokeInitializeSpy
CoRevokeMallocSpy
CoSetCancelObject
CoSetErrorInfo
CoSetProxyBlanket
CoSuspendClassObjects
CoSwitchCallContext
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoTestCancel
CoUninitialize
CoUnloadingWOW
CoUnmarshalHresult
CoUnmarshalInterface
CoVrfCheckThreadState
CoVrfGetThreadState
CoVrfReleaseThreadState
CoWaitForMultipleHandles
CoWaitForMultipleObjects
CreateErrorInfo
CreateStreamOnHGlobal
DcomChannelSetHResult
DllDebugObjectRPCHook
DllGetActivationFactory
DllGetClassObject
EnableHookObject
FreePropVariantArray
FreePropVariantArrayWorker
GetCatalogHelper
GetErrorInfo
GetFuncDescs
GetHGlobalFromStream
GetHookInterface
GetRestrictedErrorInfo
HSTRING_UserFree
HSTRING_UserFree64
HSTRING_UserMarshal
HSTRING_UserMarshal64
HSTRING_UserSize
HSTRING_UserSize64
HSTRING_UserUnmarshal
HSTRING_UserUnmarshal64
HkOleRegisterObject
IIDFromString
InternalAppInvokeExceptionFilter
InternalCCFreeUnused
InternalCCGetClassInformationForDde
InternalCCGetClassInformationFromKey
InternalCCSetDdeServerWindow
InternalCMLSendReceive
InternalCallAsProxyExceptionFilter
InternalCallFrameExceptionFilter
InternalCallerIsAppContainer
InternalCanMakeOutCall
InternalCoIsSurrogateProcess
InternalCoRegisterDisconnectCallback
InternalCoRegisterSurrogatedObject
InternalCoStdMarshalObject
InternalCoUnregisterDisconnectCallback
InternalCompleteObjRef
InternalCreateCAggId
InternalCreateIdentityHandler
InternalDoATClassCreate
InternalFillLocalOXIDInfo
InternalFreeObjRef
InternalGetWindowPropInterface
InternalIrotEnumRunning
InternalIrotEnumRunning2
InternalIrotGetObject
InternalIrotGetObject2
InternalIrotGetObject3
InternalIrotGetTimeOfLastChange
InternalIrotGetTimeOfLastChange2
InternalIrotIsRunning
InternalIrotIsRunning2
InternalIrotNoteChangeTime
InternalIrotRegister
InternalIrotRevoke
InternalIsApartmentInitialized
InternalIsProcessInitialized
InternalMarshalObjRef
InternalNotifyDDStartOrStop
InternalOleModalLoopBlockFn
InternalRegisterWindowPropInterface
InternalReleaseMarshalObjRef
InternalSTAInvoke
InternalServerExceptionFilter
InternalSetAptCallCtrlOnTlsIfRequired
InternalSetOleThunkWowPtr
InternalStubInvoke
InternalTlsAllocData
InternalUnmarshalObjRef
IsErrorPropagationEnabled
NdrExtStubInitialize
NdrOleDllGetClassObject
NdrOleInitializeExtension
NdrProxyForwardingFunction10
NdrProxyForwardingFunction11
NdrProxyForwardingFunction12
NdrProxyForwardingFunction13
NdrProxyForwardingFunction14
NdrProxyForwardingFunction15
NdrProxyForwardingFunction16
NdrProxyForwardingFunction17
NdrProxyForwardingFunction18
NdrProxyForwardingFunction19
NdrProxyForwardingFunction20
NdrProxyForwardingFunction21
NdrProxyForwardingFunction22
NdrProxyForwardingFunction23
NdrProxyForwardingFunction24
NdrProxyForwardingFunction25
NdrProxyForwardingFunction26
NdrProxyForwardingFunction27
NdrProxyForwardingFunction28
NdrProxyForwardingFunction29
NdrProxyForwardingFunction3
NdrProxyForwardingFunction30
NdrProxyForwardingFunction31
NdrProxyForwardingFunction32
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
NdrProxyForwardingFunction6
NdrProxyForwardingFunction7
NdrProxyForwardingFunction8
NdrProxyForwardingFunction9
NdrpFindInterface
ObjectStublessClient10
ObjectStublessClient11
ObjectStublessClient12
ObjectStublessClient13
ObjectStublessClient14
ObjectStublessClient15
ObjectStublessClient16
ObjectStublessClient17
ObjectStublessClient18
ObjectStublessClient19
ObjectStublessClient20
ObjectStublessClient21
ObjectStublessClient22
ObjectStublessClient23
ObjectStublessClient24
ObjectStublessClient25
ObjectStublessClient26
ObjectStublessClient27
ObjectStublessClient28
ObjectStublessClient29
ObjectStublessClient3
ObjectStublessClient30
ObjectStublessClient31
ObjectStublessClient32
ObjectStublessClient4
ObjectStublessClient5
ObjectStublessClient6
ObjectStublessClient7
ObjectStublessClient8
ObjectStublessClient9
ProgIDFromCLSID
PropVariantClear
PropVariantCopy
ReleaseFuncDescs
RoActivateInstance
RoCaptureErrorContext
RoClearError
RoFailFastWithErrorContext
RoFailFastWithErrorContextInternal
RoFailFastWithErrorContextInternal2
RoFreeParameterizedTypeExtra
RoGetActivatableClassRegistration
RoGetActivationFactory
RoGetAgileReference
RoGetApartmentIdentifier
RoGetErrorReportingFlags
RoGetMatchingRestrictedErrorInfo
RoGetParameterizedTypeInstanceIID
RoGetServerActivatableClasses
RoInitialize
RoInspectCapturedStackBackTrace
RoInspectThreadErrorInfo
RoOriginateError
RoOriginateErrorW
RoOriginateLanguageException
RoParameterizedTypeExtraGetTypeSignature
RoRegisterActivationFactories
RoRegisterForApartmentShutdown
RoReportCapabilityCheckFailure
RoReportFailedDelegate
RoReportUnhandledError
RoResolveRestrictedErrorInfoReference
RoRevokeActivationFactories
RoSetErrorReportingFlags
RoTransformError
RoTransformErrorW
RoUninitialize
RoUnregisterForApartmentShutdown
SetCleanupFlag
SetErrorInfo
SetRestrictedErrorInfo
StringFromCLSID
StringFromGUID2
StringFromIID
UpdateDCOMSettings
UpdateProcessTracing
WdtpInterfacePointer_UserMarshal
WdtpInterfacePointer_UserMarshal64
WdtpInterfacePointer_UserSize
WdtpInterfacePointer_UserSize64
WdtpInterfacePointer_UserUnmarshal
WdtpInterfacePointer_UserUnmarshal64
WindowsCompareStringOrdinal
WindowsConcatString
WindowsCreateString
WindowsCreateStringReference
WindowsDeleteString
WindowsDeleteStringBuffer
WindowsDuplicateString
WindowsGetStringLen
WindowsGetStringRawBuffer
WindowsInspectString
WindowsIsStringEmpty
WindowsPreallocateStringBuffer
WindowsPromoteStringBuffer
WindowsReplaceString
WindowsStringHasEmbeddedNull
WindowsSubstring
WindowsSubstringWithSpecifiedLength
WindowsTrimStringEnd
WindowsTrimStringStart

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ndr64
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DATA PROTECTION/freebl3.dll
.dll windows:6 windows x64 arch:x64

8a564fee0e9aa5547525f921a1b23c12

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/var/tmp/build/firefox-71aaf16cd119/obj-mingw/security/nss/lib/freebl/freebl_freebl3/freebl3.pdb

Imports

nss3

NSS_SecureMemcmp
NSS_SecureMemcmpZero
PORT_Alloc_Util
PORT_ArenaAlloc_Util
PORT_ArenaZAlloc_Util
PORT_FreeArena_Util
PORT_Free_Util
PORT_GetError_Util
PORT_NewArena_Util
PORT_SetError_Util
PORT_ZAllocAlignedOffset_Util
PORT_ZAlloc_Util
PORT_ZFree_Util
PR_CallOnce
PR_DestroyCondVar
PR_DestroyLock
PR_GetEnvSecure
PR_Lock
PR_NewCondVar
PR_NewLock
PR_NotifyAllCondVar
PR_NotifyCondVar
PR_Unlock
PR_WaitCondVar
SECITEM_AllocItem_Util
SECITEM_CompareItem_Util
SECITEM_CopyItem_Util
SECITEM_FreeItem_Util
SECITEM_ZfreeItem_Util
SECOID_FindOIDTag_Util

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
SystemFunction036

api-ms-win-crt-heap-l1-1-0

_set_new_mode
calloc
free
malloc

api-ms-win-crt-private-l1-1-0

memcmp
memcpy

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
__p___wargv
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_exit
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_register_onexit_function
abort

api-ms-win-crt-string-l1-1-0

_strdup
islower
isupper
memset
strlen
strncmp
tolower
toupper

api-ms-win-crt-time-l1-1-0

__daylight
__timezone
__tzname
_time64
_tzset

api-ms-win-crt-utility-l1-1-0

rand

kernel32

DeleteCriticalSection
EnterCriticalSection
GetComputerNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceA
GetLastError
GetLogicalDrives
GetTickCount
GetVolumeInformationA
GlobalMemoryStatus
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfwprintf
_close
_open
_write
fwrite

api-ms-win-crt-environment-l1-1-0

__p__environ
__p__wenviron

Exports

Exports

FREEBL_GetVector

Sections

.text
Size: 559KB - Virtual size: 558KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 170KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.buildid
Size: 512B - Virtual size: 149B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npp.8.4.1.Installer.x64.exe
.exe windows:6 windows x64 arch:x64

013c74198fc6e42dcf33737d6c40c012

Code Sign

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

18-03-2020 00:00

Not After

18-03-2045 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:b3:cc:d3:37:f4:7e:99:60:e6:1d:7c
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

03-06-2021 09:58

Not After

04-06-2022 09:58

Subject

SERIALNUMBER=529 991 119,CN=LEDGER SAS,O=LEDGER SAS,STREET=1 rue du Mail,L=Paris,ST=Île-de-France,C=FR,1.3.6.1.4.1.311.60.2.1.3=#13024652,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d7:33:4f:94:69:b8:9c:0e:37:6e:22:35:a8:31:16:72:09:cc:02:45:92:7d:42:eb:c5:e2:9c:34:33:78:1d:ec
Signer

Actual PE Digest

d7:33:4f:94:69:b8:9c:0e:37:6e:22:35:a8:31:16:72:09:cc:02:45:92:7d:42:eb:c5:e2:9c:34:33:78:1d:ec

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

wextract.pdb

Imports

advapi32

OpenProcessToken
GetTokenInformation
RegSetValueExA
EqualSid
RegQueryValueExA
LookupPrivilegeValueA
RegCreateKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegDeleteValueA
AllocateAndInitializeSid
FreeSid
AdjustTokenPrivileges
RegCloseKey

kernel32

GetPrivateProfileIntA
GetFileAttributesA
IsDBCSLeadByte
GetSystemDirectoryA
GlobalUnlock
GetShortPathNameA
CreateDirectoryA
FindFirstFileA
GetLastError
GetProcAddress
RemoveDirectoryA
SetFileAttributesA
GlobalFree
FindClose
GetPrivateProfileStringA
LoadLibraryA
LocalAlloc
WritePrivateProfileStringA
GetModuleFileNameA
FindNextFileA
CompareStringA
_lopen
CloseHandle
LocalFree
DeleteFileA
ExitProcess
DosDateTimeToFileTime
CreateFileA
FindResourceA
SetFilePointer
GlobalAlloc
ExpandEnvironmentStringsA
WaitForSingleObject
SetEvent
GetModuleHandleW
FormatMessageA
SetFileTime
WriteFile
GetDriveTypeA
GetVolumeInformationA
TerminateThread
SizeofResource
CreateEventA
GetExitCodeProcess
CreateProcessA
ReadFile
SetCurrentDirectoryA
_llseek
ResetEvent
LockResource
GetSystemInfo
LoadLibraryExA
CreateMutexA
GetCurrentDirectoryA
GetVersionExA
GetVersion
GetTempPathA
CreateThread
LocalFileTimeToFileTime
Sleep
FreeResource
GetWindowsDirectoryA
lstrcmpA
_lclose
GlobalLock
GetCurrentProcess
LoadResource
FreeLibrary
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
OutputDebugStringA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
EnumResourceLanguagesA
MulDiv
GetDiskFreeSpaceA
GetTempFileNameA

gdi32

GetDeviceCaps

user32

SetForegroundWindow
MsgWaitForMultipleObjects
SendDlgItemMessageA
GetWindowLongPtrA
GetWindowRect
GetDC
MessageBoxA
PeekMessageA
ReleaseDC
GetDlgItem
SetWindowPos
ShowWindow
SetWindowLongPtrA
DispatchMessageA
SetWindowTextA
EnableWindow
CallWindowProcA
DialogBoxIndirectParamA
GetDlgItemTextA
LoadStringA
MessageBeep
CharUpperA
CharNextA
ExitWindowsEx
CharPrevA
EndDialog
GetDesktopWindow
SetDlgItemTextA
SendMessageA
GetSystemMetrics

msvcrt

?terminate@@YAXXZ
_fmode
_acmdln
__C_specific_handler
_initterm
__setusermatherr
_ismbblead
_cexit
memset
memcpy
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
_errno
_vsnprintf
_commode

comctl32

ord17

cabinet

ord22
ord23
ord21
ord20

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Sections

.text
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

ba8646d28f2e7b54e7bcd331d13af3a6

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:edCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

cd:be:61:d4:d7:63:11:87:41:1e:bf:d0:47:06:95:70:ef:6d:eb:bc:4b:2d:a2:15:07:f3:9b:84:ab:5c:67:3cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-handle-l1-1-0

rpcrt4

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-fibers-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-file-l1-2-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-quirks-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-privateprofile-l1-1-1

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-0

ntdll

api-ms-win-core-interlocked-l1-2-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.orpc Size: 88KB - Virtual size: 87KB

.ndr64 Size: 9KB - Virtual size: 9KB

.data Size: 26KB - Virtual size: 27KB

.pdata Size: 158KB - Virtual size: 158KB

.idata Size: 17KB - Virtual size: 17KB

.didat Size: 1KB - Virtual size: 1KB

.rsrc Size: 64KB - Virtual size: 64KB

.reloc Size: 35KB - Virtual size: 34KB

8a564fee0e9aa5547525f921a1b23c12

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

nss3

advapi32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

kernel32

api-ms-win-crt-stdio-l1-1-0

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

cd:be:61:d4:d7:63:11:87:41:1e:bf:d0:47:06:95:70:ef:6d:eb:bc:4b:2d:a2:15:07:f3:9b:84:ab:5c:67:3c
Signer

.text
Size: 1.7MB - Virtual size: 1.7MB

.orpc
Size: 88KB - Virtual size: 87KB

.ndr64
Size: 9KB - Virtual size: 9KB

.data
Size: 26KB - Virtual size: 27KB

.pdata
Size: 158KB - Virtual size: 158KB

.idata
Size: 17KB - Virtual size: 17KB

.didat
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 64KB - Virtual size: 64KB

.reloc
Size: 35KB - Virtual size: 34KB

.text
Size: 559KB - Virtual size: 558KB

.rdata
Size: 170KB - Virtual size: 169KB

.buildid
Size: 512B - Virtual size: 149B

.data
Size: 512B - Virtual size: 16KB

.pdata
Size: 7KB - Virtual size: 7KB

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 1024B - Virtual size: 896B

.reloc
Size: 1024B - Virtual size: 964B

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

04:b3:cc:d3:37:f4:7e:99:60:e6:1d:7c
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

d7:33:4f:94:69:b8:9c:0e:37:6e:22:35:a8:31:16:72:09:cc:02:45:92:7d:42:eb:c5:e2:9c:34:33:78:1d:ec
Signer

.text
Size: 32KB - Virtual size: 32KB

.data
Size: 512B - Virtual size: 7KB

.pdata
Size: 1KB - Virtual size: 1KB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 5.2MB - Virtual size: 5.2MB

.reloc
Size: 512B - Virtual size: 36B