419f4b89f080ee9aa726df0f9c2217fac41101c867994124c85d68b3cb6c6332.bin
- SHA256 419f4b89f080ee9aa726df0f9c2217fac41101c867994124c85d68b3cb6c6332
Overview
overview
8Static
static
5MO_TA_VIEC...DF.exe
windows10-2004-x64
6MO_TA_VIEC...DF.exe
windows11-ltsc_2024-x64
6MO_TA_VIEC...me.dll
windows10-2004-x64
8MO_TA_VIEC...me.dll
windows11-ltsc_2024-x64
1MO_TA_VIEC...DF.exe
windows10-2004-x64
6MO_TA_VIEC...DF.exe
windows11-ltsc_2024-x64
6uxtheme.dll
windows10-2004-x64
8uxtheme.dll
windows11-ltsc_2024-x64
8Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
MO_TA_VIEC_LAM_PDF (1)/MO_TA_VIEC_LAM_PDF.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
MO_TA_VIEC_LAM_PDF (1)/MO_TA_VIEC_LAM_PDF.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
MO_TA_VIEC_LAM_PDF (1)/uxtheme.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
MO_TA_VIEC_LAM_PDF (1)/uxtheme.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
MO_TA_VIEC_LAM_PDF.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral6
Sample
MO_TA_VIEC_LAM_PDF.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral7
Sample
uxtheme.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral8
Sample
uxtheme.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target 419f4b89f080ee9aa726df0f9c2217fac41101c867994124c85d68b3cb6c6332.bin
- Size 16.7MB
- Sample260626-py547act4j
- SHA256 419f4b89f080ee9aa726df0f9c2217fac41101c867994124c85d68b3cb6c6332
- MD5 6c3814ac025e31d2cda7ffcc13dfc215
- SHA1 1ab297cdaba02c59cbfb1f8c6fa11d4fef8db590
- SHA512 e67794765a44d72181d50fcaa8aa19a92b0e186c88e3ce031af9b2416d082adb871bc207a648e85e648601b4c8cd0d563416223535e4e479f5283f71efcb9d0b
- SSDEEP 393216:7TdDKmLomTnYdSrW0fMTdDKmLomTnYdSrk0fy:7pDFomvrW1pDFomvrkf
- TLSH T15407330201792BB243A52D790D422DFB0E85E39F84A763A81CAC2D72B95766D7D3CCF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 2 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/uxtheme.dll unpack001/MO_TA_VIEC_LAM_PDF (1)/uxtheme.dll - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/MO_TA_VIEC_LAM_PDF (1)/uxtheme.dll unpack001/uxtheme.dll
File Explorer
-
419f4b89f080ee9aa726df0f9c2217fac41101c867994124c85d68b3cb6c6332.bin.rar 16.7MB
-
MO_TA_VIEC_LAM_PDF (1)/MO_TA_VIEC_LAM_PDF.exe.exe 19.4MB
-
MO_TA_VIEC_LAM_PDF (1)/SumatraPDF-settings.txt2KB
-
MO_TA_VIEC_LAM_PDF (1)/uxtheme.dll.dll 220KB
-
MO_TA_VIEC_LAM_PDF.exe.exe 19.4MB
-
SumatraPDF-settings.txt2KB
-
uxtheme.dll.dll 220KB
MO_TA_VIEC_LAM_PDF (1)/MO_TA_VIEC_LAM_PDF.exe
- IMPHASH 78e6f0e6be71df8616cab6af699ca676
- SHA256 719f689b34f47be8ca105ce8484948474dafde0e106bab599e4a89326070c3d0
- MD5 79435213ab241b13a9d8da354c088868
- SHA1 6232326f3da33c340c57e7370e038085d5f86d88
- SHA512 1fe4766426e145aad9215830cab225cdf9151de23fe56877654aa5b84bb8af65486a8a0d8466b3f8cbeaea32baa6c5ffe04347893e945085a73a3a85e5f969c1
- SSDEEP 393216:rcwPySz6s9X5xZ08RBCxXJq3o4I5y/+uuPZ:L6s9X5xZ08RBCxXJxd5yGuuPZ
- TLSH T1FC17BE96B2949AB8D542FA3CC911827EF229FC2C5B61834741D97D747E733680C29FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
61:08:69:30:cd:ef:47:92:e5:aa:48:6c:ff:33:7f:45:82:1c:83:87:bb:cc:41:99:f5:64:72:2c:09:57:52:02
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,L=Kraków,ST=małopolskie,C=PL
Chains
Apr 6, 2026
CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,L=Kraków,ST=małopolskie,C=PL
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,L=Kraków,ST=małopolskie,C=PL
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Subject
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
Serial Number
99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 19, 2021 - May 18, 2036
Subject
CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,L=Kraków,ST=małopolskie,C=PL
Serial Number
59:e4:e6:b0:f4:f8:5a:50:10:8c:7f:79:55:39:2a:1b
Issuer
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 31, 2025 - Dec 31, 2026
Subject
CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL
Serial Number
28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03
Issuer
CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 11, 2026 - Feb 27, 2036
Subject
CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL
Serial Number
e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 19, 2021 - May 18, 2036
Subject
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 31, 2021 - Sep 17, 2029
Minor OS version
0
Major OS version
6
Entry point
6600860
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\kjk\src\sumatrapdf-3.6\out\rel64\SumatraPDF.pdb
comctl32
ImageList_DragEnter
ImageList_DragMove
ord345
ImageList_BeginDrag
ImageList_Create
ImageList_Add
ImageList_Destroy
CreatePropertySheetPageW
ImageList_GetIconSize
ImageList_Draw
ord413
ImageList_Remove
ord412
ord411
ImageList_ReplaceIcon
ord410
ImageList_EndDrag
InitCommonControlsEx
uxtheme
DrawThemeTextEx
GetThemeBackgroundContentRect
GetThemeFont
OpenThemeData
SetWindowTheme
CloseThemeData
GetThemePartSize
DrawThemeBackground
BeginBufferedAnimation
BufferedPaintRenderAnimation
DrawThemeParentBackground
GetThemeTransitionDuration
EndBufferedAnimation
BufferedPaintStopAllAnimations
kernel32
OutputDebugStringW
WakeConditionVariable
InitOnceComplete
InitOnceBeginInitialize
GetThreadGroupAffinity
InitializeConditionVariable
InitializeSRWLock
LCMapStringEx
DecodePointer
DosDateTimeToFileTime
ReleaseMutex
CreateMutexW
MulDiv
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
VirtualProtect
EnterCriticalSection
LeaveCriticalSection
Sleep
QueryPerformanceFrequency
SystemTimeToFileTime
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetLogicalDrives
FindResourceW
LoadLibraryExA
WriteConsoleW
HeapSize
GetProcessHeap
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetConsoleOutputCP
ReadConsoleW
SetEnvironmentVariableW
FreeLibraryAndExitThread
ExitThread
SetFilePointerEx
PeekNamedPipe
GetModuleHandleExW
TlsFree
InitializeCriticalSectionAndSpinCount
RtlUnwind
EncodePointer
RtlPcToFileHeader
RtlUnwindEx
GetStartupInfoW
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
InitializeCriticalSectionEx
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateSemaphoreW
GetProcessAffinityMask
ReleaseSemaphore
GetConsoleMode
MoveFileW
GetFileType
SetEndOfFile
CreateHardLinkW
RemoveDirectoryW
DeviceIoControl
SetThreadPriority
SetLastError
SetConsoleCtrlHandler
GetCurrentDirectoryW
FoldStringW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime
IsDBCSLeadByte
GetCPInfo
CompareStringW
AreFileApisANSI
RaiseException
FileTimeToDosDateTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
GetSystemDirectoryW
OpenThread
VirtualQuery
GetThreadContext
ResumeThread
SuspendThread
Thread32First
Thread32Next
ReadDirectoryChangesW
QueueUserAPC
ResetEvent
WaitForMultipleObjectsEx
CompareFileTime
CancelIo
AllocConsole
FormatMessageA
QueryFullProcessImageNameW
CreateProcessW
LocalFree
SetCurrentDirectoryW
LoadLibraryA
GetCurrentThread
AttachConsole
GetVersionExW
GetStdHandle
SetConsoleScreenBufferSize
GetConsoleScreenBufferInfo
GetFileTime
GetDriveTypeW
GetTempFileNameW
CopyFileW
DeleteFileW
GetFileAttributesExW
GetFileInformationByHandle
SetFileAttributesW
GetFileAttributesW
OutputDebugStringA
GetTempPathW
GetUserDefaultUILanguage
MapViewOfFile
CreateFileA
DisconnectNamedPipe
GetModuleHandleA
UnmapViewOfFile
SetErrorMode
GetDateFormatW
GetTimeFormatW
MoveFileExW
LoadResource
LockResource
SizeofResource
SetThreadExecutionState
GlobalAddAtomW
GlobalDeleteAtom
GetTickCount
GetSystemTime
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
FlushFileBuffers
ConnectNamedPipe
CreateProcessA
WriteFile
CreateNamedPipeA
Process32FirstW
Process32NextW
OpenProcess
ExitProcess
GetCommandLineW
LoadLibraryW
GetExitCodeProcess
GetEnvironmentVariableW
MultiByteToWideChar
TryEnterCriticalSection
CreateFileMappingW
SetFilePointer
ReadFile
SetUnhandledExceptionFilter
IsDebuggerPresent
DebugBreak
Module32NextW
GlobalMemoryStatusEx
GetCurrentProcessId
HeapDestroy
AddVectoredExceptionHandler
Module32FirstW
HeapAlloc
CreateThread
GetModuleFileNameW
GetVolumePathNameW
SetFileTime
GetDriveTypeA
GetPrivateProfileIntW
GetShortPathNameW
GetLongPathNameW
WritePrivateProfileStringW
GetSystemInfo
CloseHandle
HeapReAlloc
SetEvent
GetLastError
CreateEventW
CreateToolhelp32Snapshot
GetLocaleInfoA
GetCurrentThreadId
WaitForSingleObject
GetEnvironmentVariableA
GetFileSizeEx
GetVolumeInformationW
CreateDirectoryW
CreateFileW
SetNamedPipeHandleState
GetLocaleInfoW
GetStringTypeExW
WideCharToMultiByte
GetWindowsDirectoryW
lstrcpynW
FindNextFileW
GetFullPathNameW
FindFirstFileW
FindClose
GetFullPathNameA
GetModuleFileNameA
CreateEventA
TlsGetValue
TlsAlloc
TlsSetValue
VerSetConditionMask
VerifyVersionInfoW
GetACP
TerminateProcess
InitializeCriticalSection
DeleteCriticalSection
GetCurrentProcess
HeapFree
HeapCreate
HeapQueryInformation
user32
DestroyIcon
CreateIconIndirect
GetSysColor
GetForegroundWindow
IsWindowEnabled
WindowFromDC
GetUpdateRect
GetClassInfoExW
RegisterWindowMessageW
GetMessagePos
ClientToScreen
SetLayeredWindowAttributes
DeferWindowPos
GetPropW
RemovePropW
BeginDeferWindowPos
SetPropW
EndDeferWindowPos
HideCaret
SetClassLongPtrW
ShowCaret
IsCharAlphaNumericW
WindowFromPoint
GetWindowThreadProcessId
GetMessageW
AllowSetForegroundWindow
LoadBitmapW
TranslateAcceleratorW
LoadCursorW
SetParent
MapVirtualKeyW
CharLowerBuffW
GetAncestor
IsCharUpperW
CheckRadioButton
EndDialog
SetDlgItemTextW
SendDlgItemMessageW
DialogBoxIndirectParamW
IsDlgButtonChecked
SetWindowLongW
CheckDlgButton
DialogBoxParamW
OpenClipboard
CloseClipboard
EmptyClipboard
ShowWindowAsync
PackDDElParam
IsWindowUnicode
BringWindowToTop
ModifyMenuW
CheckMenuRadioItem
GetMenuItemID
GetMenu
SetMenuItemInfoW
SetMenuInfo
SetMenu
DrawTextExW
InsertMenuW
GetMenuInfo
GetWindowLongW
GetWindow
FindWindowExW
MessageBeep
GetDesktopWindow
UpdateWindow
MsgWaitForMultipleObjects
DispatchMessageW
IsDialogMessageW
PeekMessageW
TranslateMessage
GetDlgItem
PostQuitMessage
EnableWindow
MoveWindow
CreateMenu
IsChild
LoadIconW
GetClassNameW
DestroyWindow
GetSystemMenu
CallWindowProcW
IsWindowVisible
GetMenuItemCount
CreateWindowExW
CreatePopupMenu
RegisterClassExW
GetClassLongPtrW
TrackPopupMenu
ShowWindow
InvalidateRgn
SetMenuDefaultItem
DestroyMenu
FindWindowW
TrackPopupMenuEx
RemoveMenu
IsZoomed
AppendMenuW
DrawIconEx
EnableMenuItem
DrawEdge
DrawFrameControl
SetScrollInfo
ShowScrollBar
GetCursor
GetScrollInfo
GetScrollPos
IsWindow
GetCapture
SetTimer
SetCapture
SetCursor
KillTimer
ReleaseCapture
IsIconic
PostMessageW
VkKeyScanExW
DestroyAcceleratorTable
GetKeyboardLayout
CreateAcceleratorTableW
GetMenuItemInfoW
GetWindowRect
GetWindowTextLengthW
DefWindowProcW
GetFocus
InflateRect
EqualRect
ScreenToClient
OffsetRect
RedrawWindow
GetDlgCtrlID
MapWindowPoints
TrackMouseEvent
FrameRect
DrawFocusRect
IntersectRect
GetWindowDC
DrawTextW
PtInRect
InvalidateRect
SendInput
DdeFreeStringHandle
DdeDisconnect
CheckMenuItem
SetClipboardData
SetFocus
DdeFreeDataHandle
DdeClientTransaction
DdeUninitialize
DdeInitializeW
GetMonitorInfoW
GetWindowInfo
DdeConnect
DdeCreateStringHandleW
DestroyCursor
EnumDisplayMonitors
MonitorFromWindow
MonitorFromRect
CopyImage
GetKeyState
AdjustWindowRectEx
RegisterWindowMessageA
CharToOemA
CharLowerW
CharUpperW
CharToOemBuffW
OemToCharBuffA
OemToCharA
GetCursorPos
BeginPaint
EndPaint
GetWindowTextW
FillRect
SystemParametersInfoW
GetComboBoxInfo
GetDC
SetWindowPos
MessageBoxW
EnumChildWindows
SetWindowLongPtrW
SendMessageW
GetSystemMetrics
GetWindowLongPtrW
GetActiveWindow
GetClientRect
GetParent
SetForegroundWindow
ReleaseDC
SetActiveWindow
gdi32
SetGraphicsMode
SetDIBits
SetWorldTransform
GetDIBColorTable
SetStretchBltMode
SetDIBColorTable
GetTextColor
GetObjectA
SetROP2
StartPage
AbortDoc
EndDoc
CreateDCW
SetMapMode
StartDocW
EndPage
GetDIBits
LineTo
MoveToEx
Ellipse
CreatePatternBrush
CreateBitmap
CreateRoundRectRgn
CreateDIBSection
SetLayout
ExtTextOutW
GetClipBox
SetViewportOrgEx
ExtSelectClipRgn
SetBrushOrgEx
PatBlt
StretchBlt
Rectangle
BitBlt
SaveDC
GetClipRgn
CreateRectRgnIndirect
Polyline
CreateRectRgn
GetTextExtentPoint32W
SetBkMode
SelectClipRgn
Polygon
ExcludeClipRect
RestoreDC
IntersectClipRect
RoundRect
GetStockObject
GetDeviceCaps
GetObjectW
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteDC
SetTextColor
CreatePen
SetBkColor
DeleteObject
CreateSolidBrush
CreateFontIndirectW
winspool.drv
ord203
EnumPrintersW
DeviceCapabilitiesW
ClosePrinter
DocumentPropertiesW
GetPrinterW
OpenPrinterW
comdlg32
GetOpenFileNameW
GetSaveFileNameW
PrintDlgExW
advapi32
RegSetKeySecurity
RegQueryValueExW
RegQueryInfoKeyW
RegCloseKey
RegEnumKeyW
RegOpenKeyExW
InitializeSecurityDescriptor
CheckTokenMembership
FreeSid
OpenProcessToken
AllocateAndInitializeSid
RegGetValueW
SetFileSecurityW
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
SetSecurityDescriptorDacl
shell32
ShellExecuteExW
SHFileOperationW
ord155
CommandLineToArgvW
SHGetFolderPathW
SHOpenFolderAndSelectItems
SHAddToRecentDocs
DragAcceptFiles
SHChangeNotify
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetMalloc
SHGetFileInfoW
DragFinish
DragQueryFileW
ord190
ole32
CoCreateGuid
OleUninitialize
OleInitialize
CoCreateInstance
ReleaseStgMedium
CoTaskMemFree
CoGetMalloc
CoInitialize
CoUninitialize
CoTaskMemAlloc
CoSetProxyBlanket
CreateStreamOnHGlobal
oleaut32
VariantInit
SafeArrayCreateVector
SafeArrayPutElement
SysFreeString
VariantClear
SysAllocString
dwmapi
DwmExtendFrameIntoClientArea
DwmSetWindowAttribute
crypt32
CertCloseStore
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringA
CertFreeCertificateContext
CryptMsgClose
CryptQueryObject
Name
.text
Size
6.6MB
Virtual Size
6.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7.2MB
Virtual Size
7.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
164KB
Virtual Size
163KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=37, id=259, version=33145,
count=12, id=253, version=35207,
count=12, id=259, version=35207,
count=20, id=260, version=35207,
count=61, id=260, version=33145,
count=1, id=262, version=33145,
count=234, id=261, version=33145,
count=1, id=263, version=33145,
count=104, id=261, version=35207,
count=31, id=257, version=33145,
count=804, id=1, productName=Unmarked objects,
count=89, productName=Unmarked objects (old),
count=861, id=265, version=35224,
count=1, id=255, version=35224,
count=1, id=258, version=35224,
MO_TA_VIEC_LAM_PDF (1)/SumatraPDF-settings.txt
- SHA256 3733a4bec392e84a25ec2a62b712ff033d60045a82783b4e43153dde59e60b36
- MD5 546c8871fb80036a3dbf85cbcfb4562f
- SHA1 b9748f9162e3680682c627d861451e3817e97081
- SHA512 3441be47ff910b9b0694af0bb6f2501724c228c02122668ca696e3ff262ef998a05e808392222b304223268e4585da494f28ccbb918bcfddcc90640cae2cb950
- TLSH T1AB41D02C3557603CCE26775DAEB7E0734EE238A061DB7998B9EE581C345096C819DD0E
- MD5 SHA1 SHA512 TLSH
MO_TA_VIEC_LAM_PDF (1)/uxtheme.dll
- SHA256 20471a44987c563b0701f18e5fa20b797fe046674f67563c8904b9a90e056394
- MD5 019b1572141a19a705df8b7f9c69cb4b
- SHA1 d7d7798b17fd584cd4726c292e53a70a0f37f2ff
- SHA512 78d257770b559402c8e64db82d64ea5509a0d126281af5be88ec05bd878c7f63559a0fbc26f745c0527d9ce5e2be3144d7498487902fef2684a1b807074962bc
- SSDEEP 6144:PAskkjLGeh/c+5MZkaVYmcXRBkDKyLh8dUFZzk/zlpePF:PAskU/vjaVYmoRGzUUFeLy
- TLSH T10524126190D17539E8B906BC18C53374ADB0AC952AAE42CFE53AFB72193035C9673BC7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7808
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
BeginBufferedAnimation
BeginBufferedPaint
BeginPanningFeedback
BufferedPaintClear
BufferedPaintInit
BufferedPaintRenderAnimation
BufferedPaintSetAlpha
BufferedPaintStopAllAnimations
BufferedPaintUnInit
CloseThemeData
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DrawThemeBackground
DrawThemeBackgroundEx
DrawThemeEdge
DrawThemeIcon
DrawThemeParentBackground
DrawThemeParentBackgroundEx
DrawThemeText
DrawThemeTextEx
EnableThemeDialogTexture
EnableTheming
EndBufferedAnimation
EndBufferedPaint
EndPanningFeedback
EntryPoint
GetBufferedPaintBits
GetBufferedPaintDC
GetBufferedPaintTargetDC
GetBufferedPaintTargetRect
GetColorFromPreference
GetCurrentThemeName
GetImmersiveColorFromColorSetEx
GetImmersiveUserColorSetPreference
GetThemeAnimationProperty
GetThemeAnimationTransform
GetThemeAppProperties
GetThemeBackgroundContentRect
GetThemeBackgroundExtent
GetThemeBackgroundRegion
GetThemeBitmap
GetThemeBool
GetThemeColor
GetThemeDocumentationProperty
GetThemeEnumValue
GetThemeFilename
GetThemeFont
GetThemeInt
GetThemeIntList
GetThemeMargins
GetThemeMetric
GetThemePartSize
GetThemePosition
GetThemePropertyOrigin
GetThemeRect
GetThemeStream
GetThemeString
GetThemeSysBool
GetThemeSysColor
GetThemeSysColorBrush
GetThemeSysFont
GetThemeSysInt
GetThemeSysSize
GetThemeSysString
GetThemeTextExtent
GetThemeTextMetrics
GetThemeTimingFunction
GetThemeTransitionDuration
GetUserColorPreference
GetWindowTheme
HitTestThemeBackground
IndirectSetup
IndirectSystemCall
IsAppThemed
IsCompositionActive
IsThemeActive
IsThemeBackgroundPartiallyTransparent
IsThemeDialogTextureEnabled
IsThemePartDefined
OpenThemeData
OpenThemeDataEx
OpenThemeDataForDpi
SetThemeAppProperties
SetWindowTheme
SetWindowThemeAttribute
ThemeInitApiHook
UpdatePanningFeedback
atexit
gido
main
pp
xooo
Name
.text
Size
213KB
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
MO_TA_VIEC_LAM_PDF.exe
- IMPHASH 78e6f0e6be71df8616cab6af699ca676
- SHA256 719f689b34f47be8ca105ce8484948474dafde0e106bab599e4a89326070c3d0
- MD5 79435213ab241b13a9d8da354c088868
- SHA1 6232326f3da33c340c57e7370e038085d5f86d88
- SHA512 1fe4766426e145aad9215830cab225cdf9151de23fe56877654aa5b84bb8af65486a8a0d8466b3f8cbeaea32baa6c5ffe04347893e945085a73a3a85e5f969c1
- SSDEEP 393216:rcwPySz6s9X5xZ08RBCxXJq3o4I5y/+uuPZ:L6s9X5xZ08RBCxXJxd5yGuuPZ
- TLSH T1FC17BE96B2949AB8D542FA3CC911827EF229FC2C5B61834741D97D747E733680C29FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
61:08:69:30:cd:ef:47:92:e5:aa:48:6c:ff:33:7f:45:82:1c:83:87:bb:cc:41:99:f5:64:72:2c:09:57:52:02
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,L=Kraków,ST=małopolskie,C=PL
Chains
Apr 6, 2026
CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,L=Kraków,ST=małopolskie,C=PL
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,L=Kraków,ST=małopolskie,C=PL
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Subject
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
Serial Number
99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 19, 2021 - May 18, 2036
Subject
CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,L=Kraków,ST=małopolskie,C=PL
Serial Number
59:e4:e6:b0:f4:f8:5a:50:10:8c:7f:79:55:39:2a:1b
Issuer
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 31, 2025 - Dec 31, 2026
Subject
CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL
Serial Number
28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03
Issuer
CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 11, 2026 - Feb 27, 2036
Subject
CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL
Serial Number
e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 19, 2021 - May 18, 2036
Subject
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 31, 2021 - Sep 17, 2029
Minor OS version
0
Major OS version
6
Entry point
6600860
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\kjk\src\sumatrapdf-3.6\out\rel64\SumatraPDF.pdb
comctl32
ImageList_DragEnter
ImageList_DragMove
ord345
ImageList_BeginDrag
ImageList_Create
ImageList_Add
ImageList_Destroy
CreatePropertySheetPageW
ImageList_GetIconSize
ImageList_Draw
ord413
ImageList_Remove
ord412
ord411
ImageList_ReplaceIcon
ord410
ImageList_EndDrag
InitCommonControlsEx
uxtheme
DrawThemeTextEx
GetThemeBackgroundContentRect
GetThemeFont
OpenThemeData
SetWindowTheme
CloseThemeData
GetThemePartSize
DrawThemeBackground
BeginBufferedAnimation
BufferedPaintRenderAnimation
DrawThemeParentBackground
GetThemeTransitionDuration
EndBufferedAnimation
BufferedPaintStopAllAnimations
kernel32
OutputDebugStringW
WakeConditionVariable
InitOnceComplete
InitOnceBeginInitialize
GetThreadGroupAffinity
InitializeConditionVariable
InitializeSRWLock
LCMapStringEx
DecodePointer
DosDateTimeToFileTime
ReleaseMutex
CreateMutexW
MulDiv
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
VirtualProtect
EnterCriticalSection
LeaveCriticalSection
Sleep
QueryPerformanceFrequency
SystemTimeToFileTime
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetLogicalDrives
FindResourceW
LoadLibraryExA
WriteConsoleW
HeapSize
GetProcessHeap
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetConsoleOutputCP
ReadConsoleW
SetEnvironmentVariableW
FreeLibraryAndExitThread
ExitThread
SetFilePointerEx
PeekNamedPipe
GetModuleHandleExW
TlsFree
InitializeCriticalSectionAndSpinCount
RtlUnwind
EncodePointer
RtlPcToFileHeader
RtlUnwindEx
GetStartupInfoW
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
InitializeCriticalSectionEx
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateSemaphoreW
GetProcessAffinityMask
ReleaseSemaphore
GetConsoleMode
MoveFileW
GetFileType
SetEndOfFile
CreateHardLinkW
RemoveDirectoryW
DeviceIoControl
SetThreadPriority
SetLastError
SetConsoleCtrlHandler
GetCurrentDirectoryW
FoldStringW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime
IsDBCSLeadByte
GetCPInfo
CompareStringW
AreFileApisANSI
RaiseException
FileTimeToDosDateTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
GetSystemDirectoryW
OpenThread
VirtualQuery
GetThreadContext
ResumeThread
SuspendThread
Thread32First
Thread32Next
ReadDirectoryChangesW
QueueUserAPC
ResetEvent
WaitForMultipleObjectsEx
CompareFileTime
CancelIo
AllocConsole
FormatMessageA
QueryFullProcessImageNameW
CreateProcessW
LocalFree
SetCurrentDirectoryW
LoadLibraryA
GetCurrentThread
AttachConsole
GetVersionExW
GetStdHandle
SetConsoleScreenBufferSize
GetConsoleScreenBufferInfo
GetFileTime
GetDriveTypeW
GetTempFileNameW
CopyFileW
DeleteFileW
GetFileAttributesExW
GetFileInformationByHandle
SetFileAttributesW
GetFileAttributesW
OutputDebugStringA
GetTempPathW
GetUserDefaultUILanguage
MapViewOfFile
CreateFileA
DisconnectNamedPipe
GetModuleHandleA
UnmapViewOfFile
SetErrorMode
GetDateFormatW
GetTimeFormatW
MoveFileExW
LoadResource
LockResource
SizeofResource
SetThreadExecutionState
GlobalAddAtomW
GlobalDeleteAtom
GetTickCount
GetSystemTime
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
FlushFileBuffers
ConnectNamedPipe
CreateProcessA
WriteFile
CreateNamedPipeA
Process32FirstW
Process32NextW
OpenProcess
ExitProcess
GetCommandLineW
LoadLibraryW
GetExitCodeProcess
GetEnvironmentVariableW
MultiByteToWideChar
TryEnterCriticalSection
CreateFileMappingW
SetFilePointer
ReadFile
SetUnhandledExceptionFilter
IsDebuggerPresent
DebugBreak
Module32NextW
GlobalMemoryStatusEx
GetCurrentProcessId
HeapDestroy
AddVectoredExceptionHandler
Module32FirstW
HeapAlloc
CreateThread
GetModuleFileNameW
GetVolumePathNameW
SetFileTime
GetDriveTypeA
GetPrivateProfileIntW
GetShortPathNameW
GetLongPathNameW
WritePrivateProfileStringW
GetSystemInfo
CloseHandle
HeapReAlloc
SetEvent
GetLastError
CreateEventW
CreateToolhelp32Snapshot
GetLocaleInfoA
GetCurrentThreadId
WaitForSingleObject
GetEnvironmentVariableA
GetFileSizeEx
GetVolumeInformationW
CreateDirectoryW
CreateFileW
SetNamedPipeHandleState
GetLocaleInfoW
GetStringTypeExW
WideCharToMultiByte
GetWindowsDirectoryW
lstrcpynW
FindNextFileW
GetFullPathNameW
FindFirstFileW
FindClose
GetFullPathNameA
GetModuleFileNameA
CreateEventA
TlsGetValue
TlsAlloc
TlsSetValue
VerSetConditionMask
VerifyVersionInfoW
GetACP
TerminateProcess
InitializeCriticalSection
DeleteCriticalSection
GetCurrentProcess
HeapFree
HeapCreate
HeapQueryInformation
user32
DestroyIcon
CreateIconIndirect
GetSysColor
GetForegroundWindow
IsWindowEnabled
WindowFromDC
GetUpdateRect
GetClassInfoExW
RegisterWindowMessageW
GetMessagePos
ClientToScreen
SetLayeredWindowAttributes
DeferWindowPos
GetPropW
RemovePropW
BeginDeferWindowPos
SetPropW
EndDeferWindowPos
HideCaret
SetClassLongPtrW
ShowCaret
IsCharAlphaNumericW
WindowFromPoint
GetWindowThreadProcessId
GetMessageW
AllowSetForegroundWindow
LoadBitmapW
TranslateAcceleratorW
LoadCursorW
SetParent
MapVirtualKeyW
CharLowerBuffW
GetAncestor
IsCharUpperW
CheckRadioButton
EndDialog
SetDlgItemTextW
SendDlgItemMessageW
DialogBoxIndirectParamW
IsDlgButtonChecked
SetWindowLongW
CheckDlgButton
DialogBoxParamW
OpenClipboard
CloseClipboard
EmptyClipboard
ShowWindowAsync
PackDDElParam
IsWindowUnicode
BringWindowToTop
ModifyMenuW
CheckMenuRadioItem
GetMenuItemID
GetMenu
SetMenuItemInfoW
SetMenuInfo
SetMenu
DrawTextExW
InsertMenuW
GetMenuInfo
GetWindowLongW
GetWindow
FindWindowExW
MessageBeep
GetDesktopWindow
UpdateWindow
MsgWaitForMultipleObjects
DispatchMessageW
IsDialogMessageW
PeekMessageW
TranslateMessage
GetDlgItem
PostQuitMessage
EnableWindow
MoveWindow
CreateMenu
IsChild
LoadIconW
GetClassNameW
DestroyWindow
GetSystemMenu
CallWindowProcW
IsWindowVisible
GetMenuItemCount
CreateWindowExW
CreatePopupMenu
RegisterClassExW
GetClassLongPtrW
TrackPopupMenu
ShowWindow
InvalidateRgn
SetMenuDefaultItem
DestroyMenu
FindWindowW
TrackPopupMenuEx
RemoveMenu
IsZoomed
AppendMenuW
DrawIconEx
EnableMenuItem
DrawEdge
DrawFrameControl
SetScrollInfo
ShowScrollBar
GetCursor
GetScrollInfo
GetScrollPos
IsWindow
GetCapture
SetTimer
SetCapture
SetCursor
KillTimer
ReleaseCapture
IsIconic
PostMessageW
VkKeyScanExW
DestroyAcceleratorTable
GetKeyboardLayout
CreateAcceleratorTableW
GetMenuItemInfoW
GetWindowRect
GetWindowTextLengthW
DefWindowProcW
GetFocus
InflateRect
EqualRect
ScreenToClient
OffsetRect
RedrawWindow
GetDlgCtrlID
MapWindowPoints
TrackMouseEvent
FrameRect
DrawFocusRect
IntersectRect
GetWindowDC
DrawTextW
PtInRect
InvalidateRect
SendInput
DdeFreeStringHandle
DdeDisconnect
CheckMenuItem
SetClipboardData
SetFocus
DdeFreeDataHandle
DdeClientTransaction
DdeUninitialize
DdeInitializeW
GetMonitorInfoW
GetWindowInfo
DdeConnect
DdeCreateStringHandleW
DestroyCursor
EnumDisplayMonitors
MonitorFromWindow
MonitorFromRect
CopyImage
GetKeyState
AdjustWindowRectEx
RegisterWindowMessageA
CharToOemA
CharLowerW
CharUpperW
CharToOemBuffW
OemToCharBuffA
OemToCharA
GetCursorPos
BeginPaint
EndPaint
GetWindowTextW
FillRect
SystemParametersInfoW
GetComboBoxInfo
GetDC
SetWindowPos
MessageBoxW
EnumChildWindows
SetWindowLongPtrW
SendMessageW
GetSystemMetrics
GetWindowLongPtrW
GetActiveWindow
GetClientRect
GetParent
SetForegroundWindow
ReleaseDC
SetActiveWindow
gdi32
SetGraphicsMode
SetDIBits
SetWorldTransform
GetDIBColorTable
SetStretchBltMode
SetDIBColorTable
GetTextColor
GetObjectA
SetROP2
StartPage
AbortDoc
EndDoc
CreateDCW
SetMapMode
StartDocW
EndPage
GetDIBits
LineTo
MoveToEx
Ellipse
CreatePatternBrush
CreateBitmap
CreateRoundRectRgn
CreateDIBSection
SetLayout
ExtTextOutW
GetClipBox
SetViewportOrgEx
ExtSelectClipRgn
SetBrushOrgEx
PatBlt
StretchBlt
Rectangle
BitBlt
SaveDC
GetClipRgn
CreateRectRgnIndirect
Polyline
CreateRectRgn
GetTextExtentPoint32W
SetBkMode
SelectClipRgn
Polygon
ExcludeClipRect
RestoreDC
IntersectClipRect
RoundRect
GetStockObject
GetDeviceCaps
GetObjectW
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteDC
SetTextColor
CreatePen
SetBkColor
DeleteObject
CreateSolidBrush
CreateFontIndirectW
winspool.drv
ord203
EnumPrintersW
DeviceCapabilitiesW
ClosePrinter
DocumentPropertiesW
GetPrinterW
OpenPrinterW
comdlg32
GetOpenFileNameW
GetSaveFileNameW
PrintDlgExW
advapi32
RegSetKeySecurity
RegQueryValueExW
RegQueryInfoKeyW
RegCloseKey
RegEnumKeyW
RegOpenKeyExW
InitializeSecurityDescriptor
CheckTokenMembership
FreeSid
OpenProcessToken
AllocateAndInitializeSid
RegGetValueW
SetFileSecurityW
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
SetSecurityDescriptorDacl
shell32
ShellExecuteExW
SHFileOperationW
ord155
CommandLineToArgvW
SHGetFolderPathW
SHOpenFolderAndSelectItems
SHAddToRecentDocs
DragAcceptFiles
SHChangeNotify
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetMalloc
SHGetFileInfoW
DragFinish
DragQueryFileW
ord190
ole32
CoCreateGuid
OleUninitialize
OleInitialize
CoCreateInstance
ReleaseStgMedium
CoTaskMemFree
CoGetMalloc
CoInitialize
CoUninitialize
CoTaskMemAlloc
CoSetProxyBlanket
CreateStreamOnHGlobal
oleaut32
VariantInit
SafeArrayCreateVector
SafeArrayPutElement
SysFreeString
VariantClear
SysAllocString
dwmapi
DwmExtendFrameIntoClientArea
DwmSetWindowAttribute
crypt32
CertCloseStore
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringA
CertFreeCertificateContext
CryptMsgClose
CryptQueryObject
Name
.text
Size
6.6MB
Virtual Size
6.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7.2MB
Virtual Size
7.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
164KB
Virtual Size
163KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=37, id=259, version=33145,
count=12, id=253, version=35207,
count=12, id=259, version=35207,
count=20, id=260, version=35207,
count=61, id=260, version=33145,
count=1, id=262, version=33145,
count=234, id=261, version=33145,
count=1, id=263, version=33145,
count=104, id=261, version=35207,
count=31, id=257, version=33145,
count=804, id=1, productName=Unmarked objects,
count=89, productName=Unmarked objects (old),
count=861, id=265, version=35224,
count=1, id=255, version=35224,
count=1, id=258, version=35224,
SumatraPDF-settings.txt
- SHA256 3733a4bec392e84a25ec2a62b712ff033d60045a82783b4e43153dde59e60b36
- MD5 546c8871fb80036a3dbf85cbcfb4562f
- SHA1 b9748f9162e3680682c627d861451e3817e97081
- SHA512 3441be47ff910b9b0694af0bb6f2501724c228c02122668ca696e3ff262ef998a05e808392222b304223268e4585da494f28ccbb918bcfddcc90640cae2cb950
- TLSH T1AB41D02C3557603CCE26775DAEB7E0734EE238A061DB7998B9EE581C345096C819DD0E
- MD5 SHA1 SHA512 TLSH
uxtheme.dll
- SHA256 20471a44987c563b0701f18e5fa20b797fe046674f67563c8904b9a90e056394
- MD5 019b1572141a19a705df8b7f9c69cb4b
- SHA1 d7d7798b17fd584cd4726c292e53a70a0f37f2ff
- SHA512 78d257770b559402c8e64db82d64ea5509a0d126281af5be88ec05bd878c7f63559a0fbc26f745c0527d9ce5e2be3144d7498487902fef2684a1b807074962bc
- SSDEEP 6144:PAskkjLGeh/c+5MZkaVYmcXRBkDKyLh8dUFZzk/zlpePF:PAskU/vjaVYmoRGzUUFeLy
- TLSH T10524126190D17539E8B906BC18C53374ADB0AC952AAE42CFE53AFB72193035C9673BC7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7808
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
BeginBufferedAnimation
BeginBufferedPaint
BeginPanningFeedback
BufferedPaintClear
BufferedPaintInit
BufferedPaintRenderAnimation
BufferedPaintSetAlpha
BufferedPaintStopAllAnimations
BufferedPaintUnInit
CloseThemeData
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DrawThemeBackground
DrawThemeBackgroundEx
DrawThemeEdge
DrawThemeIcon
DrawThemeParentBackground
DrawThemeParentBackgroundEx
DrawThemeText
DrawThemeTextEx
EnableThemeDialogTexture
EnableTheming
EndBufferedAnimation
EndBufferedPaint
EndPanningFeedback
EntryPoint
GetBufferedPaintBits
GetBufferedPaintDC
GetBufferedPaintTargetDC
GetBufferedPaintTargetRect
GetColorFromPreference
GetCurrentThemeName
GetImmersiveColorFromColorSetEx
GetImmersiveUserColorSetPreference
GetThemeAnimationProperty
GetThemeAnimationTransform
GetThemeAppProperties
GetThemeBackgroundContentRect
GetThemeBackgroundExtent
GetThemeBackgroundRegion
GetThemeBitmap
GetThemeBool
GetThemeColor
GetThemeDocumentationProperty
GetThemeEnumValue
GetThemeFilename
GetThemeFont
GetThemeInt
GetThemeIntList
GetThemeMargins
GetThemeMetric
GetThemePartSize
GetThemePosition
GetThemePropertyOrigin
GetThemeRect
GetThemeStream
GetThemeString
GetThemeSysBool
GetThemeSysColor
GetThemeSysColorBrush
GetThemeSysFont
GetThemeSysInt
GetThemeSysSize
GetThemeSysString
GetThemeTextExtent
GetThemeTextMetrics
GetThemeTimingFunction
GetThemeTransitionDuration
GetUserColorPreference
GetWindowTheme
HitTestThemeBackground
IndirectSetup
IndirectSystemCall
IsAppThemed
IsCompositionActive
IsThemeActive
IsThemeBackgroundPartiallyTransparent
IsThemeDialogTextureEnabled
IsThemePartDefined
OpenThemeData
OpenThemeDataEx
OpenThemeDataForDpi
SetThemeAppProperties
SetWindowTheme
SetWindowThemeAttribute
ThemeInitApiHook
UpdatePanningFeedback
atexit
gido
main
pp
xooo
Name
.text
Size
213KB
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ