AdobePIM[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AdobePIM.dll
Size 2.1MB
Sample260710-b494facz6t
SHA256 7917708a9f343067e01242423eaa73ae981e20ce07ace6274fdcc71ee2b03b51
MD5 7efc2b6852333d9ebac124d4844ba2af
SHA1 23c4a09cd6a63850c94109b7b8cbbc197f38931d
SHA512 0f9448baa5d1988c14e9b887fcf0491ad49bbdcb808d430a78e78de0e0cfa7a459988dde1a1e58413e621fc732af940a2d6d921a9d599dc495ace4e55f749c48
SSDEEP 49152:vDMuoV5iuRXAySHAf5rXXqEkZd78HGP1zQTThZOq1MSGY:vIuoVZDPrXXqEkZd78Hvyl4
TLSH
T19EA57D51B6D7C232E4FA02F066796BE9886E7A1D4B3045CF66C04DAD98306D37932F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

AdobePIM.dll

.dll 2.1MB

AdobePIM.dll

IMPHASH bad4069efbb0fea858e33d102d409210
SHA256 7917708a9f343067e01242423eaa73ae981e20ce07ace6274fdcc71ee2b03b51
MD5 7efc2b6852333d9ebac124d4844ba2af
SHA1 23c4a09cd6a63850c94109b7b8cbbc197f38931d
SHA512 0f9448baa5d1988c14e9b887fcf0491ad49bbdcb808d430a78e78de0e0cfa7a459988dde1a1e58413e621fc732af940a2d6d921a9d599dc495ace4e55f749c48
SSDEEP 49152:vDMuoV5iuRXAySHAf5rXXqEkZd78HGP1zQTThZOq1MSGY:vIuoVZDPrXXqEkZd78Hvyl4
TLSH
T19EA57D51B6D7C232E4FA02F066796BE9886E7A1D4B3045CF66C04DAD98306D37932F27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

ff:93:96:11:6c:ee:f7:27:fe:35:b5:b4:f7:f8:43:7b:42:22:59:7e:1a:75:c8:e9:6c:94:ac:49:50:ad:6c:60

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jun 25, 2021

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

Serial Number

05:35:93:bf:71:f7:48:1b:9f:b7:6b:cb:4e:cc:f5:78

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 19, 2020 - Dec 20, 2022

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

1430352

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\jenkins\CI\CCCore\build\x64\main\ccd-core\build\msvs_win32\Release\x86\sym\PIM\PIM\AdobePIM.pdb

kernel32

GetCurrentProcessId CreateSemaphoreW AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LockFileEx GetFileSize GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers ReleaseSemaphore MultiByteToWideChar GetTempPathW CreateDirectoryW GetDateFormatW GetTimeFormatW GetLocalTime GetCommandLineW GetExitCodeProcess lstrcmpW lstrcmpiW CopyFileW CreateProcessW LocalFree ResetEvent CreateThread CloseHandle OpenSemaphoreW Process32FirstW GetDiskFreeSpaceExW ReleaseMutex SetEvent Process32NextW Sleep CreateEventW CreateToolhelp32Snapshot SetFileAttributesW OpenProcess GetVersionExW LocalAlloc WaitForSingleObject FindClose RemoveDirectoryW TerminateProcess FindNextFileW FindFirstFileW DeleteCriticalSection DecodePointer RaiseException GetLastError WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetConsoleCP ReadConsoleW GetConsoleMode GetFileType GetStdHandle EnumSystemLocalesW IsValidLocale ExitProcess GetTimeZoneInformation GetModuleHandleExW ExitThread RtlUnwind InterlockedFlushSList InterlockedPushEntrySList LoadLibraryExW FreeLibraryAndExitThread GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent GetCPInfo QueryPerformanceFrequency GetLocaleInfoW CompareStringW InitializeCriticalSectionEx EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc CreateMutexW InitializeCriticalSectionAndSpinCount GetExitCodeThread SwitchToThread GetStringTypeW GetCurrentProcess GetFileSizeEx lstrlenW GetACP SetFilePointerEx GlobalFree ResumeThread TerminateThread SetThreadPriority GetCurrentThread SizeofResource GetModuleFileNameW LockResource LoadResource FindResourceW MoveFileExW GlobalAlloc VerSetConditionMask GetModuleHandleW VerifyVersionInfoW SetLastError DuplicateHandle ProcessIdToSessionId FindResourceExW lstrcpyW GetThreadTimes QueryFullProcessImageNameW GetUserDefaultLangID GetUserDefaultLCID LCMapStringW FileTimeToSystemTime OpenMutexW VirtualFree VirtualAlloc GetUserDefaultUILanguage

user32

wsprintfW GetWindowThreadProcessId GetShellWindow EnumWindows

advapi32

CryptAcquireContextW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW GetNamedSecurityInfoW SetNamedSecurityInfoW LookupAccountSidW CreateWellKnownSid EqualSid GetTokenInformation DuplicateTokenEx GetUserNameW ConvertSidToStringSidW ImpersonateLoggedOnUser ConvertStringSidToSidW RevertToSelf CryptReleaseContext SetSecurityDescriptorDacl RegCloseKey RegDeleteKeyExW AllocateAndInitializeSid SetEntriesInAclW RegCreateKeyExW RegSetValueExW FreeSid InitializeSecurityDescriptor RegOpenKeyExW RegDeleteValueW RegQueryValueExW CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash

shell32

SHGetKnownFolderPath ord680 SHGetFolderLocation SHGetFolderPathW SHGetPathFromIDListW ShellExecuteExW SHCreateDirectoryExW SHCreateItemFromParsingName SHGetSpecialFolderPathW CommandLineToArgvW ord51

ole32

OleRun CLSIDFromProgID StringFromGUID2 CoCreateGuid CoInitializeSecurity CoSetProxyBlanket CoUninitialize CoCreateInstance CoInitializeEx CoInitialize CLSIDFromString CoTaskMemFree

oleaut32

VariantInit SysFreeString SysAllocString VariantClear GetErrorInfo VariantCopy SysStringLen VariantChangeType

msi

ord145 ord74 ord147

winhttp

WinHttpSendRequest WinHttpSetCredentials WinHttpConnect WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpQueryHeaders WinHttpOpenRequest WinHttpOpen WinHttpGetProxyForUrl WinHttpQueryAuthSchemes WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle WinHttpSetOption WinHttpReadData WinHttpSetTimeouts

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

psapi

GetProcessImageFileNameW GetModuleFileNameExW EnumProcessModules

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory

shlwapi

PathFileExistsW PathIsDirectoryW PathRenameExtensionW PathAppendW PathRemoveBackslashW PathStripPathW PathAppendA PathFindFileNameW PathRemoveFileSpecW PathFileExistsA PathIsRootW PathIsSystemFolderW PathIsDirectoryEmptyW PathIsDirectoryA PathRemoveFileSpecA PathRemoveExtensionW PathAddExtensionW PathIsFileSpecW

crypt32

CertGetNameStringW

wintrust

WinVerifyTrust WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WTHelperGetProvCertFromChain

bcrypt

BCryptOpenAlgorithmProvider BCryptFinishHash BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData

Sharing

General

Malware Config

Signatures

File Explorer

AdobePIM.dll

kernel32

user32

advapi32

shell32

ole32

oleaut32

msi

winhttp

version

psapi

wtsapi32

shlwapi

crypt32

wintrust

bcrypt

generic