1df95ebb57c93ce4374ff3ba6fcdad3662af67015abade8925c242a04e1b6b6c

Sharing

Copy URL Twitter E-mail

General

Target
1df95ebb57c93ce4374ff3ba6fcdad3662af67015abade8925c242a04e1b6b6c
Size 5.9MB
Sample241110-ay91taylck
SHA256 1df95ebb57c93ce4374ff3ba6fcdad3662af67015abade8925c242a04e1b6b6c
MD5 71a0508bf75b1b3f84606026ca9dd764
SHA1 dbb4dd16882685410e70b1babfaf6b832be4183a
SHA512 c44509540183529e3fefbc50d92a93356fb891483712c8500eac818e7c7ec2cb85eea51aebdcc3043e6067a2abd3cdc1d90148047808f26f9883beccf751b60d
SSDEEP 98304:h1Nwt0IdVFLa+CWaPknoMiIgSLr/e9Yo0Pa7Re+P9sZ5QH/i0tu1S9Qnlr8ik1Xz:G9fVDaPknBiBSLy91t7RpgRns9Qlwx1D
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/DATA PROTECTION/freebl3.dll

File Explorer

1df95ebb57c93ce4374ff3ba6fcdad3662af67015abade8925c242a04e1b6b6c

.zip 5.9MB
npp.8.4.1.Installer.x64.zip

.zip 6.6MB
DATA PROTECTION/Privacy Policy.txt

3KB
DATA PROTECTION/combase.dll

.dll 2.1MB
DATA PROTECTION/freebl3.dll

.dll 741KB
npp.8.4.1.Installer.x64.exe

.exe 700.0MB

1df95ebb57c93ce4374ff3ba6fcdad3662af67015abade8925c242a04e1b6b6c

SHA256 1df95ebb57c93ce4374ff3ba6fcdad3662af67015abade8925c242a04e1b6b6c
MD5 71a0508bf75b1b3f84606026ca9dd764
SHA1 dbb4dd16882685410e70b1babfaf6b832be4183a
SHA512 c44509540183529e3fefbc50d92a93356fb891483712c8500eac818e7c7ec2cb85eea51aebdcc3043e6067a2abd3cdc1d90148047808f26f9883beccf751b60d
SSDEEP 98304:h1Nwt0IdVFLa+CWaPknoMiIgSLr/e9Yo0Pa7Re+P9sZ5QH/i0tu1S9Qnlr8ik1Xz:G9fVDaPknBiBSLy91t7RpgRns9Qlwx1D
MD5 SHA1 SHA512 SSDEEP

Password

infected

DATA PROTECTION/combase.dll

IMPHASH ba8646d28f2e7b54e7bcd331d13af3a6
SHA256 c5a6f11a839ad1e46983ddbef1f697e17e1f64ba80d388f6d7392461ddd90a9e
MD5 65441ddd17d8f99b37b9716412415940
SHA1 23aaaec781f3f81bbb65470944c060e973b6e995
SHA512 e04496ce8373021a586f31abffcbad46d159a3e70ac06c57416be7c413a7d7a93d12d7777e068a1575156699c2fd6ca1e53a40ba6d61f9137dfa62c720aacb69
SSDEEP 49152:qYbdzuV9mMWdJKyzaBUPQ/MQ+emp+jhS6o:q8IydJzzgaX9p+u
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

cd:be:61:d4:d7:63:11:87:41:1e:bf:d0:47:06:95:70:ef:6d:eb:bc:4b:2d:a2:15:07:f3:9b:84:ab:5c:67:3c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2024

Minor OS version

Major OS version

Entry point

203600

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

combase.pdb

msvcrt

__dllonexit _unlock _lock __C_specific_handler _onexit _initterm _amsg_exit _XcptFilter _itoa_s memcpy_s ??_V@YAXPEAX@Z memset memcpy memcmp _local_unwind wcsnlen wcsncpy_s ??_U@YAPEAX_K@Z _wcsnicmp wcsrchr _vsnprintf wcsstr _wcslwr _wtol wcstok wcschr qsort realloc memmove_s free malloc rand_s wcsncmp memmove _wtoi _resetstkoflw _purecall _wcsicmp _vsnwprintf __CxxFrameHandler3 swprintf_s wcscmp

api-ms-win-core-heap-l1-2-0

HeapSize HeapValidate HeapAlloc HeapFree GetProcessHeap HeapCreate HeapDestroy HeapReAlloc HeapCompact

api-ms-win-core-errorhandling-l1-1-1

GetLastError SetLastError SetUnhandledExceptionFilter RaiseException UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-2

GetProcessMitigationPolicy GetCurrentThreadId TerminateProcess GetCurrentThread SetThreadStackGuarantee SwitchToThread OpenProcess ProcessIdToSessionId GetCurrentProcess SetThreadToken OpenThreadToken OpenProcessToken CreateThread GetProcessId GetCurrentProcessId

api-ms-win-core-registry-l1-1-0

RegGetValueA RegDeleteKeyExA RegCloseKey RegOpenCurrentUser RegOpenKeyExW RegOpenUserClassesRoot RegQueryInfoKeyW RegQueryValueExW RegSetValueExA RegOpenKeyExA RegQueryValueExA RegDeleteKeyExW RegEnumKeyExW RegCreateKeyExA RegSetValueExW RegGetValueW RegEnumValueW RegCreateKeyExW

api-ms-win-core-synch-l1-2-0

SleepEx InitializeCriticalSectionAndSpinCount EnterCriticalSection SetWaitableTimerEx LeaveCriticalSection Sleep WaitForSingleObject ReleaseSRWLockExclusive InitializeSRWLock CreateWaitableTimerExW ResetEvent CreateEventW DeleteCriticalSection OpenEventW SetEvent WaitForMultipleObjectsEx CreateEventA InitOnceExecuteOnce ReleaseSRWLockShared AcquireSRWLockShared WaitForSingleObjectEx AcquireSRWLockExclusive OpenEventA

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle

rpcrt4

RpcServerUseProtseqEpW RpcBindingVectorFree NdrConvert2 RpcServerUseProtseqExW RpcServerUseProtseqEpExW RpcBindingFromStringBindingW RpcServerUseProtseqW RpcBindingCreateW RpcBindingBind SimpleTypeBufferSize NdrMesTypeDecode2 NdrMesTypeAlignSize2 NdrMesTypeEncode2 RpcAsyncCompleteCall NdrClientCall2 RpcErrorAddRecord RpcMgmtSetComTimeout RpcMgmtInqComTimeout I_RpcServerSubscribeForDisconnectNotification I_RpcServerGetAssociationID I_RpcMgmtEnableDedicatedThreadPool NdrCorrelationInitialize NdrFullPointerXlatInit SimpleTypeMemorySize NdrFullPointerXlatFree NdrClearOutParameters I_RpcBCacheFree NdrCorrelationFree I_RpcExceptionFilter NdrGetTypeFlags MesEncodeFixedBufferHandleCreate MesHandleFree SimpleTypeAlignment I_RpcBCacheAllocate MesBufferHandleReset MesDecodeBufferHandleCreate I_RpcFixTransferSyntax I_RpcSendReceive RpcRaiseException RpcErrorEndEnumeration RpcErrorGetNextRecord RpcErrorStartEnumeration NdrClientInitializeNew I_RpcReceive I_RpcAsyncSetHandle NdrServerInitialize I_RpcGetBuffer I_RpcAllocate I_RpcFree I_RpcGetBufferWithObject UuidCreate I_RpcRequestMutex NdrStubCall2 I_RpcNegotiateTransferSyntax I_RpcClearMutex I_RpcMgmtQueryDedicatedThreadPool RpcBindingFree RpcBindingSetOption NdrAsyncServerCall NdrServerCall2 RpcBindingUnbind RpcBindingCopy NdrMesTypeDecode3 I_RpcSend I_RpcAsyncAbortCall RpcServerUnregisterIf RpcServerRegisterIf3 RpcImpersonateClient2 RpcServerRegisterAuthInfoW RpcCertGeneratePrincipalNameW I_RpcOpenClientProcess RpcBindingInqAuthClientW NdrMesTypeEncode3 I_RpcSetDCOMAppId I_RpcBindingInqCurrentModifiedId RpcBindingInqObject I_RpcBindingInqLocalClientPID RpcBindingServerFromClient RpcRevertToSelfEx RpcImpersonateClient RpcStringBindingParseW RpcBindingToStringBindingW I_RpcBindingInqTransportType RpcServerInqCallAttributesW I_RpcBindingSetPrivateOption RpcBindingSetAuthInfoExW RpcSmDestroyClientContext NdrClientCall3 NdrStubCall3 RpcStringFreeW RpcBindingInqAuthInfoExW RpcCancelThreadEx RpcMgmtSetCancelTimeout NdrOleAllocate NdrOleFree NdrDllGetClassObject RpcAsyncCancelCall RpcServerInqBindings RpcServerTestCancel NdrGetUserMarshalInfo I_RpcFreeBuffer RpcAsyncInitializeHandle RpcAsyncGetCallStatus

api-ms-win-core-sysinfo-l1-2-1

GetTickCount GetSystemTimeAsFileTime GetTickCount64 GetComputerNameExW GetSystemInfo GetSystemWindowsDirectoryW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW OutputDebugStringA DebugBreak IsDebuggerPresent

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork SubmitThreadpoolWork WaitForThreadpoolWorkCallbacks CreateThreadpoolWork CloseThreadpoolWait CreateThreadpoolWait SetThreadpoolWait SetEventWhenCallbackReturns WaitForThreadpoolWaitCallbacks CloseThreadpoolTimer CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks

api-ms-win-core-fibers-l1-1-1

FlsAlloc FlsSetValue FlsFree IsThreadAFiber

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetModuleHandleW LoadLibraryExA GetProcAddress LoadStringW FreeLibrary GetModuleFileNameA GetModuleFileNameW GetModuleHandleExW

api-ms-win-core-string-l1-1-0

GetStringTypeW WideCharToMultiByte CompareStringOrdinal CompareStringW MultiByteToWideChar

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW SearchPathW FreeEnvironmentStringsW GetEnvironmentStringsW

api-ms-win-security-base-l1-2-0

CreateWellKnownSid AccessCheck CheckTokenMembership SetSecurityDescriptorDacl AddAccessAllowedAce InitializeSid GetSidLengthRequired GetAppContainerAce InitializeAcl InitializeSecurityDescriptor ImpersonateLoggedOnUser GetAce MapGenericMask GetSidSubAuthorityCount GetKernelObjectSecurity GetSidSubAuthority DuplicateToken GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorControl MakeSelfRelativeSD IsValidSecurityDescriptor GetTokenInformation RevertToSelf ImpersonateAnonymousToken AccessCheckByType GetSecurityDescriptorDacl GetLengthSid IsValidSid GetSecurityDescriptorLength PrivilegeCheck CopySid EqualSid

api-ms-win-core-rtlsupport-l1-2-0

RtlCompareMemory RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

api-ms-win-core-memory-l1-1-2

UnmapViewOfFile CreateFileMappingW OpenFileMappingW VirtualProtect VirtualAlloc VirtualQuery MapViewOfFile

api-ms-win-core-localization-l1-2-1

FormatMessageW LCMapStringW

api-ms-win-core-file-l1-2-1

CreateFileW

api-ms-win-eventing-provider-l1-1-0

EventWrite EventRegister EventWriteEx EventUnregister

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled QuirkIsEnabledForProcess

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-kernel32-legacy-l1-1-1

RaiseFailFastException

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW lstrcmpiA lstrcmpiW lstrlenA

api-ms-win-core-heap-obsolete-l1-1-0

GlobalSize LocalAlloc GlobalFree LocalFree GlobalUnlock GlobalReAlloc GlobalAlloc GlobalLock

api-ms-win-core-privateprofile-l1-1-1

GetProfileStringW

api-ms-win-core-sidebyside-l1-1-0

ReleaseActCtx FindActCtxSectionGuid FindActCtxSectionStringW ActivateActCtx AddRefActCtx DeactivateActCtx GetCurrentActCtx CreateActCtxW

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock

ntdll

RtlCopySid NtQueryInformationToken RtlLengthSid NtQueryObject LdrStandardizeSystemPath RtlFreeSid RtlDelete RtlApplicationVerifierStop RtlCheckForOrphanedCriticalSections NtQueryInformationThread RtlFreeHeap RtlGetAppContainerNamedObjectPath NtTerminateProcess RtlReportException RtlInitializeCriticalSectionAndSpinCount NtQueryTimerResolution RtlLoadString RtlInitializeConditionVariable ord1 EvtIntReportEventAndSourceAsync RtlSplay RtlDeleteNoSplay RtlInitUnicodeString NtOpenKey RtlEqualUnicodeString WinSqmSetDWORD RtlInitializeCriticalSection RtlImageNtHeader RtlIsCriticalSectionLockedByThread RtlDllShutdownInProgress DbgPrint EtwEventUnregister RtlAllocateHeap NtQueryValueKey RtlQueryPackageIdentity ZwQuerySecurityAttributesToken RtlSidDominates RtlGetAppContainerSidType EtwGetTraceEnableLevel EtwGetTraceEnableFlags EtwRegisterTraceGuidsW EtwUnregisterTraceGuids EtwGetTraceLoggerHandle NtQuerySystemInformation RtlSleepConditionVariableCS RtlDeleteCriticalSection RtlWakeAllConditionVariable NtQueryInformationProcess NtApphelpCacheControl RtlInitUnicodeStringEx RtlValidRelativeSecurityDescriptor NtClose NtDuplicateObject NtCreateKey RtlRealPredecessor EtwEventRegister EtwTraceMessage EtwEventWrite RtlNtStatusToDosError NtQueryKey

api-ms-win-core-interlocked-l1-2-0

InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook ResolveDelayLoadedAPI

CLSIDFromOle1Class CLSIDFromProgID CLSIDFromString CleanupOleStateInAllTls CleanupTlsOleState ClearCleanupFlag CoAddRefServerProcess CoAllowUnmarshalerCLSID CoCancelCall CoCopyProxy CoCreateErrorInfo CoCreateFreeThreadedMarshaler CoCreateGuid CoCreateInstance CoCreateInstanceEx CoCreateInstanceFromApp CoCreateObjectInContext CoDeactivateObject CoDecodeProxy CoDecrementMTAUsage CoDisableCallCancellation CoDisconnectContext CoDisconnectObject CoEnableCallCancellation CoFreeUnusedLibraries CoFreeUnusedLibrariesEx CoGetActivationState CoGetApartmentID CoGetApartmentType CoGetCallContext CoGetCallState CoGetCallerTID CoGetCancelObject CoGetClassObject CoGetClassVersion CoGetContextToken CoGetCurrentLogicalThreadId CoGetCurrentProcess CoGetDefaultContext CoGetErrorInfo CoGetInstanceFromFile CoGetInstanceFromIStorage CoGetInterfaceAndReleaseStream CoGetMalloc CoGetMarshalSizeMax CoGetModuleType CoGetObjectContext CoGetPSClsid CoGetProcessIdentifier CoGetStandardMarshal CoGetStdMarshalEx CoGetSystemSecurityPermissions CoGetTreatAsClass CoImpersonateClient CoIncrementMTAUsage CoInitializeEx CoInitializeSecurity CoInitializeWOW CoInvalidateRemoteMachineBindings CoIsHandlerConnected CoLockObjectExternal CoMarshalHresult CoMarshalInterThreadInterfaceInStream CoMarshalInterface CoPopServiceDomain CoPushServiceDomain CoQueryAuthenticationServices CoQueryClientBlanket CoQueryProxyBlanket CoReactivateObject CoRegisterActivationFilter CoRegisterClassObject CoRegisterInitializeSpy CoRegisterMallocSpy CoRegisterMessageFilter CoRegisterPSClsid CoRegisterSurrogate CoRegisterSurrogateEx CoReleaseMarshalData CoReleaseServerProcess CoResumeClassObjects CoRetireServer CoRevertToSelf CoRevokeClassObject CoRevokeInitializeSpy CoRevokeMallocSpy CoSetCancelObject CoSetErrorInfo CoSetProxyBlanket CoSuspendClassObjects CoSwitchCallContext CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CoTestCancel CoUninitialize CoUnloadingWOW CoUnmarshalHresult CoUnmarshalInterface CoVrfCheckThreadState CoVrfGetThreadState CoVrfReleaseThreadState CoWaitForMultipleHandles CoWaitForMultipleObjects CreateErrorInfo CreateStreamOnHGlobal DcomChannelSetHResult DllDebugObjectRPCHook DllGetActivationFactory DllGetClassObject EnableHookObject FreePropVariantArray FreePropVariantArrayWorker GetCatalogHelper GetErrorInfo GetFuncDescs GetHGlobalFromStream GetHookInterface GetRestrictedErrorInfo HSTRING_UserFree HSTRING_UserFree64 HSTRING_UserMarshal HSTRING_UserMarshal64 HSTRING_UserSize HSTRING_UserSize64 HSTRING_UserUnmarshal HSTRING_UserUnmarshal64 HkOleRegisterObject IIDFromString InternalAppInvokeExceptionFilter InternalCCFreeUnused InternalCCGetClassInformationForDde InternalCCGetClassInformationFromKey InternalCCSetDdeServerWindow InternalCMLSendReceive InternalCallAsProxyExceptionFilter InternalCallFrameExceptionFilter InternalCallerIsAppContainer InternalCanMakeOutCall InternalCoIsSurrogateProcess InternalCoRegisterDisconnectCallback InternalCoRegisterSurrogatedObject InternalCoStdMarshalObject InternalCoUnregisterDisconnectCallback InternalCompleteObjRef InternalCreateCAggId InternalCreateIdentityHandler InternalDoATClassCreate InternalFillLocalOXIDInfo InternalFreeObjRef InternalGetWindowPropInterface InternalIrotEnumRunning InternalIrotEnumRunning2 InternalIrotGetObject InternalIrotGetObject2 InternalIrotGetObject3 InternalIrotGetTimeOfLastChange InternalIrotGetTimeOfLastChange2 InternalIrotIsRunning InternalIrotIsRunning2 InternalIrotNoteChangeTime InternalIrotRegister InternalIrotRevoke InternalIsApartmentInitialized InternalIsProcessInitialized InternalMarshalObjRef InternalNotifyDDStartOrStop InternalOleModalLoopBlockFn InternalRegisterWindowPropInterface InternalReleaseMarshalObjRef InternalSTAInvoke InternalServerExceptionFilter InternalSetAptCallCtrlOnTlsIfRequired InternalSetOleThunkWowPtr InternalStubInvoke InternalTlsAllocData InternalUnmarshalObjRef IsErrorPropagationEnabled NdrExtStubInitialize NdrOleDllGetClassObject NdrOleInitializeExtension NdrProxyForwardingFunction10 NdrProxyForwardingFunction11 NdrProxyForwardingFunction12 NdrProxyForwardingFunction13 NdrProxyForwardingFunction14 NdrProxyForwardingFunction15 NdrProxyForwardingFunction16 NdrProxyForwardingFunction17 NdrProxyForwardingFunction18 NdrProxyForwardingFunction19 NdrProxyForwardingFunction20 NdrProxyForwardingFunction21 NdrProxyForwardingFunction22 NdrProxyForwardingFunction23 NdrProxyForwardingFunction24 NdrProxyForwardingFunction25 NdrProxyForwardingFunction26 NdrProxyForwardingFunction27 NdrProxyForwardingFunction28 NdrProxyForwardingFunction29 NdrProxyForwardingFunction3 NdrProxyForwardingFunction30 NdrProxyForwardingFunction31 NdrProxyForwardingFunction32 NdrProxyForwardingFunction4 NdrProxyForwardingFunction5 NdrProxyForwardingFunction6 NdrProxyForwardingFunction7 NdrProxyForwardingFunction8 NdrProxyForwardingFunction9 NdrpFindInterface ObjectStublessClient10 ObjectStublessClient11 ObjectStublessClient12 ObjectStublessClient13 ObjectStublessClient14 ObjectStublessClient15 ObjectStublessClient16 ObjectStublessClient17 ObjectStublessClient18 ObjectStublessClient19 ObjectStublessClient20 ObjectStublessClient21 ObjectStublessClient22 ObjectStublessClient23 ObjectStublessClient24 ObjectStublessClient25 ObjectStublessClient26 ObjectStublessClient27 ObjectStublessClient28 ObjectStublessClient29 ObjectStublessClient3 ObjectStublessClient30 ObjectStublessClient31 ObjectStublessClient32 ObjectStublessClient4 ObjectStublessClient5 ObjectStublessClient6 ObjectStublessClient7 ObjectStublessClient8 ObjectStublessClient9 ProgIDFromCLSID PropVariantClear PropVariantCopy ReleaseFuncDescs RoActivateInstance RoCaptureErrorContext RoClearError RoFailFastWithErrorContext RoFailFastWithErrorContextInternal RoFailFastWithErrorContextInternal2 RoFreeParameterizedTypeExtra RoGetActivatableClassRegistration RoGetActivationFactory RoGetAgileReference RoGetApartmentIdentifier RoGetErrorReportingFlags RoGetMatchingRestrictedErrorInfo RoGetParameterizedTypeInstanceIID RoGetServerActivatableClasses RoInitialize RoInspectCapturedStackBackTrace RoInspectThreadErrorInfo RoOriginateError RoOriginateErrorW RoOriginateLanguageException RoParameterizedTypeExtraGetTypeSignature RoRegisterActivationFactories RoRegisterForApartmentShutdown RoReportCapabilityCheckFailure RoReportFailedDelegate RoReportUnhandledError RoResolveRestrictedErrorInfoReference RoRevokeActivationFactories RoSetErrorReportingFlags RoTransformError RoTransformErrorW RoUninitialize RoUnregisterForApartmentShutdown SetCleanupFlag SetErrorInfo SetRestrictedErrorInfo StringFromCLSID StringFromGUID2 StringFromIID UpdateDCOMSettings UpdateProcessTracing WdtpInterfacePointer_UserMarshal WdtpInterfacePointer_UserMarshal64 WdtpInterfacePointer_UserSize WdtpInterfacePointer_UserSize64 WdtpInterfacePointer_UserUnmarshal WdtpInterfacePointer_UserUnmarshal64 WindowsCompareStringOrdinal WindowsConcatString WindowsCreateString WindowsCreateStringReference WindowsDeleteString WindowsDeleteStringBuffer WindowsDuplicateString WindowsGetStringLen WindowsGetStringRawBuffer WindowsInspectString WindowsIsStringEmpty WindowsPreallocateStringBuffer WindowsPromoteStringBuffer WindowsReplaceString WindowsStringHasEmbeddedNull WindowsSubstring WindowsSubstringWithSpecifiedLength WindowsTrimStringEnd WindowsTrimStringStart

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

88KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.ndr64

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

158KB

Virtual Size

158KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

DATA PROTECTION/freebl3.dll

IMPHASH 8a564fee0e9aa5547525f921a1b23c12
SHA256 8bb27eeb3481cf8e13d27c5599176e80976231d6b1b9c956af121740d3839858
MD5 f70594c50cfdddcb73690f9fa3d79f37
SHA1 290157ea262756a5c9bafc8bbba46d6a9a0c9d10
SHA512 3f6dc0582ec99d4d05ed6dbe47111e123858e404e3a78891c6593ce582578632cf717ce2cb4010297130fd0cdf297f7923429c37498945df765b51ec086dde14
SSDEEP 12288:IP+3NkvK0MwtS2ZZELO173ycCZ0Kt3FjjwRwlbwgUfZmLqnhw:IPmkPMwtYLi7ycCZ0KNFjjwRwlcrfS+K
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/var/tmp/build/firefox-71aaf16cd119/obj-mingw/security/nss/lib/freebl/freebl_freebl3/freebl3.pdb

nss3

NSS_SecureMemcmp NSS_SecureMemcmpZero PORT_Alloc_Util PORT_ArenaAlloc_Util PORT_ArenaZAlloc_Util PORT_FreeArena_Util PORT_Free_Util PORT_GetError_Util PORT_NewArena_Util PORT_SetError_Util PORT_ZAllocAlignedOffset_Util PORT_ZAlloc_Util PORT_ZFree_Util PR_CallOnce PR_DestroyCondVar PR_DestroyLock PR_GetEnvSecure PR_Lock PR_NewCondVar PR_NewLock PR_NotifyAllCondVar PR_NotifyCondVar PR_Unlock PR_WaitCondVar SECITEM_AllocItem_Util SECITEM_CompareItem_Util SECITEM_CopyItem_Util SECITEM_FreeItem_Util SECITEM_ZfreeItem_Util SECOID_FindOIDTag_Util

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext SystemFunction036

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-private-l1-1-0

memcmp memcpy

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p___wargv _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _execute_onexit_table _exit _initialize_narrow_environment _initialize_onexit_table _initialize_wide_environment _initterm _register_onexit_function abort

api-ms-win-crt-string-l1-1-0

_strdup islower isupper memset strlen strncmp tolower toupper

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _time64 _tzset

api-ms-win-crt-utility-l1-1-0

rand

kernel32

DeleteCriticalSection EnterCriticalSection GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceA GetLastError GetLogicalDrives GetTickCount GetVolumeInformationA GlobalMemoryStatus InitializeCriticalSection LeaveCriticalSection QueryPerformanceCounter Sleep TlsGetValue VirtualProtect VirtualQuery

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf __stdio_common_vfwprintf _close _open _write fwrite

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron

Name

.text

Size

559KB

Virtual Size

558KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

170KB

Virtual Size

169KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

149B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

896B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

964B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

npp.8.4.1.Installer.x64.exe

IMPHASH 013c74198fc6e42dcf33737d6c40c012
SHA256 d7cd49477ad1b8c676dc3507372ca774a69af98280db45a1c9ad0c5f0a4c309e
MD5 9a2c573e882d31251e1bcd07ba90585f
SHA1 d46878f2ad28df08972371a617bce73ae623523c
SHA512 40ac3d1cca6bb8eb7ccfb0d1ae0467423b0355ee5cded84b1095a284f08cecbd70325b808df933d47a7af60081470ad71ee1021e724759227379052302ff3894
SSDEEP 98304:h9eCUTzzphq1G/jxZIo0YYUOJimJJQYts5JcyTcvg6BtufkCJ:PefTzVhqpP9JvgpTcvf7ufz
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

d7:33:4f:94:69:b8:9c:0e:37:6e:22:35:a8:31:16:72:09:cc:02:45:92:7d:42:eb:c5:e2:9c:34:33:78:1d:ec

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=529 991 119,CN=LEDGER SAS,O=LEDGER SAS,STREET=1 rue du Mail,L=Paris,ST=Île-de-France,C=FR,1.3.6.1.4.1.311.60.2.1.3=#13024652,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jan 24, 2022

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=529 991 119,CN=LEDGER SAS,O=LEDGER SAS,STREET=1 rue du Mail,L=Paris,ST=Île-de-France,C=FR,1.3.6.1.4.1.311.60.2.1.3=#13024652,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

04:b3:cc:d3:37:f4:7e:99:60:e6:1d:7c

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 3, 2021 - Jun 4, 2022

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

32960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wextract.pdb

advapi32

OpenProcessToken GetTokenInformation RegSetValueExA EqualSid RegQueryValueExA LookupPrivilegeValueA RegCreateKeyExA RegOpenKeyExA RegQueryInfoKeyA RegDeleteValueA AllocateAndInitializeSid FreeSid AdjustTokenPrivileges RegCloseKey

kernel32

GetPrivateProfileIntA GetFileAttributesA IsDBCSLeadByte GetSystemDirectoryA GlobalUnlock GetShortPathNameA CreateDirectoryA FindFirstFileA GetLastError GetProcAddress RemoveDirectoryA SetFileAttributesA GlobalFree FindClose GetPrivateProfileStringA LoadLibraryA LocalAlloc WritePrivateProfileStringA GetModuleFileNameA FindNextFileA CompareStringA _lopen CloseHandle LocalFree DeleteFileA ExitProcess DosDateTimeToFileTime CreateFileA FindResourceA SetFilePointer GlobalAlloc ExpandEnvironmentStringsA WaitForSingleObject SetEvent GetModuleHandleW FormatMessageA SetFileTime WriteFile GetDriveTypeA GetVolumeInformationA TerminateThread SizeofResource CreateEventA GetExitCodeProcess CreateProcessA ReadFile SetCurrentDirectoryA _llseek ResetEvent LockResource GetSystemInfo LoadLibraryExA CreateMutexA GetCurrentDirectoryA GetVersionExA GetVersion GetTempPathA CreateThread LocalFileTimeToFileTime Sleep FreeResource GetWindowsDirectoryA lstrcmpA _lclose GlobalLock GetCurrentProcess LoadResource FreeLibrary GetStartupInfoW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess OutputDebugStringA QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount EnumResourceLanguagesA MulDiv GetDiskFreeSpaceA GetTempFileNameA

gdi32

GetDeviceCaps

user32

SetForegroundWindow MsgWaitForMultipleObjects SendDlgItemMessageA GetWindowLongPtrA GetWindowRect GetDC MessageBoxA PeekMessageA ReleaseDC GetDlgItem SetWindowPos ShowWindow SetWindowLongPtrA DispatchMessageA SetWindowTextA EnableWindow CallWindowProcA DialogBoxIndirectParamA GetDlgItemTextA LoadStringA MessageBeep CharUpperA CharNextA ExitWindowsEx CharPrevA EndDialog GetDesktopWindow SetDlgItemTextA SendMessageA GetSystemMetrics

msvcrt

?terminate@@YAXXZ _fmode _acmdln __C_specific_handler _initterm __setusermatherr _ismbblead _cexit memset memcpy _exit exit __set_app_type __getmainargs _amsg_exit _XcptFilter _errno _vsnprintf _commode

comctl32

ord17

cabinet

ord22 ord23 ord21 ord20

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

Sharing

General

Malware Config

Signatures

File Explorer

1df95ebb57c93ce4374ff3ba6fcdad3662af67015abade8925c242a04e1b6b6c

npp.8.4.1.Installer.x64.zip

DATA PROTECTION/Privacy Policy.txt

DATA PROTECTION/combase.dll

PE Signature issue

msvcrt

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-handle-l1-1-0

rpcrt4

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-fibers-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-file-l1-2-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-quirks-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-privateprofile-l1-1-1

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-0

ntdll

api-ms-win-core-interlocked-l1-2-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

generic

DATA PROTECTION/freebl3.dll

nss3

advapi32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

kernel32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic

npp.8.4.1.Installer.x64.exe

PE Signature issue

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

cabinet

version

generic