General

  • Target
    PXCEditorCore.x64.dll
  • Size 71.0MB
  • Sample260519-gdpygags6s
  • SHA256 79a99261814b35a58ef6804e919c4ade683bb73b2536196979905309cc88e4b5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10

Malware Config

Signatures

  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

File Explorer

  • PXCEditorCore.x64.dll
    .dll 71.0MB

PXCEditorCore.x64.dll

  • IMPHASH 8b60c69eb6be2d3b3a2f01472556ad8b
  • SHA256 79a99261814b35a58ef6804e919c4ade683bb73b2536196979905309cc88e4b5
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Codesign digest Mismatch

    File was altered after it was signed.

PE Signature issue

Digest
c7:ee:63:54:c5:da:4d:b1:6c:ec:b9:fa:66:93:65:41:9c:ea:77:11:98:36:39:b1:c1:72:fc:4d:c3:69:6e:d4
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=BC0831950,CN=PDF-XCHANGE CO. LTD.,O=PDF-XCHANGE CO. LTD.,STREET=9622 Chemainus Rd,L=Chemainus,ST=British Columbia,C=CA,1.2.840.113549.1.9.1=#0c17737570706f7274407064662d786368616e67652e636f6d,1.3.6.1.4.1.311.60.2.1.2=#13104272697469736820436f6c756d626961,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

PE Signature issue

Digest
c7:ee:63:54:c5:da:4d:b1:6c:ec:b9:fa:66:93:65:41:9c:ea:77:11:98:36:39:b1:c1:72:fc:4d:c3:69:6e:d4
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=BC0831950,CN=TRACKER SOFTWARE PRODUCTS (CANADA) LIMITED,O=TRACKER SOFTWARE PRODUCTS (CANADA) LIMITED,STREET=9622 Chemainus Rd,L=Chemainus,ST=British Columbia,C=CA,1.3.6.1.4.1.311.60.2.1.2=#13104272697469736820436f6c756d626961,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Minor OS version
0
Major OS version
10
Entry point
15834696
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL
PDB paths
F:\Development\pdfxchange\Editor\_build\Release.x64\PXCEditorCore.x64.pdb