PresentationNative_cor3[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
PresentationNative_cor3.dll
Size 1.2MB
Sample260728-t5mnmsac55
SHA256 3fb36edaa2c4fe4ac8be075a3a4e903da159bbe38fb77e51c32b58e2adecb2d6
MD5 b43c09fd1eab8feb0d9d87e6eeb8fa95
SHA1 d8935765faf6e12d1d7f7e8b0f54f8e0f077a43c
SHA512 1432fefe98029f475c0a53e0c551dd917713da346e9b7d5ee5ee5314fb43072cfb24f95b4e2ceef2f67d7f01084d398428b075bf09812a9f90f510f0a40bdfc8
SSDEEP 24576:mhNpKcF6kPHmTw+MLYpX7T3hjnHFOcJqCPoG5MupGJvaCbztQcfRYQXLFGvHLPa7:mxKcdPHmMLYpX7T35/fPoGPpGFjztQcT
TLSH
T1F0453A22E2E642E5C47FC1B8C646972BFBB07449131C66CB87608B552F67FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

PresentationNative_cor3.dll

.dll 1.2MB

PresentationNative_cor3.dll

IMPHASH 5de612d168dd4f3cbdf371592277147a
SHA256 3fb36edaa2c4fe4ac8be075a3a4e903da159bbe38fb77e51c32b58e2adecb2d6
MD5 b43c09fd1eab8feb0d9d87e6eeb8fa95
SHA1 d8935765faf6e12d1d7f7e8b0f54f8e0f077a43c
SHA512 1432fefe98029f475c0a53e0c551dd917713da346e9b7d5ee5ee5314fb43072cfb24f95b4e2ceef2f67d7f01084d398428b075bf09812a9f90f510f0a40bdfc8
SSDEEP 24576:mhNpKcF6kPHmTw+MLYpX7T3hjnHFOcJqCPoG5MupGJvaCbztQcfRYQXLFGvHLPa7:mxKcdPHmMLYpX7T35/fPoGPpGFjztQcT
TLSH
T1F0453A22E2E642E5C47FC1B8C646972BFBB07449131C66CB87608B552F67FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Password

dawdadfghfgh

Digest

3a:a4:46:2c:c1:e3:0d:59:3f:b4:12:c3:b8:1b:14:0e:6e:1e:14:e5:94:8a:0d:93:1f:e4:42:c7:51:53:17:e8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 10, 2026

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:c7:9a:a1:ee:dc:27:e2:f8:b7:00:00:00:00:01:c7

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:10:ab:cd:e4:16:18:ef:39:b0:00:01:00:00:02:10

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

5680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\bin\PresentationNative\x64\Release\PresentationNative_cor3.pdb

kernel32

UnhandledExceptionFilter GetCurrentThread GetCurrentProcess TerminateProcess IsProcessorFeaturePresent SetUnhandledExceptionFilter TerminateThread GetProcAddress VerSetConditionMask FreeLibrary GetProcessHeap HeapAlloc HeapFree HeapReAlloc OutputDebugStringW DeleteCriticalSection DisableThreadLibraryCalls LoadLibraryW InitializeCriticalSection InitializeCriticalSectionEx GlobalDeleteAtom DebugBreak OutputDebugStringA IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter LeaveCriticalSection EnterCriticalSection InterlockedFlushSList LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException EncodePointer SetLastError GetLastError

ntdll

DbgBreakPoint DbgPrompt DbgPrintEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlPcToFileHeader NtQuerySystemInformation

api-ms-win-crt-runtime-l1-1-0

terminate _cexit _crt_atexit abort _execute_onexit_table _initterm _initterm_e _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function

api-ms-win-crt-heap-l1-1-0

malloc free calloc

api-ms-win-crt-string-l1-1-0

iswpunct strlen strcmp wcsncmp strcpy_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

user32

SetWindowLongPtrW SetWindowLongW SetScrollPos SetFocus MapWindowPoints GetWindowTextLengthW GetWindowTextW GetWindowLongPtrW GetWindowLongW GetWindow GetParent GetMenuBarInfo GetKeyboardLayoutList GetAncestor EnableWindow FindWindowExW

gdi32

GetTextExtentPoint32W

ole32

CoTaskMemFree CoCreateInstance

oleaut32

VariantInit SysAllocString VariantChangeType VariantClear

CreateDocContext CreateInstalledObjectsInfo CreateTextAnalysisSink CreateTextAnalysisSource DestroyDocContext DestroyInstalledObjectsInfo EnableWindowWrapper FindWindowExWrapper FsAddFigureObstacle FsClearUpdateInfoInPage FsClearUpdateInfoInSubpage FsClearUpdateInfoInSubtrack FsClearUpdateInfoInTableSrv FsCommitFilledRectangle FsCompareSubpages FsCompareSubtrack FsCompareTableSrv FsCreateDocContext FsCreateDummyFootnoteRejector FsCreatePageBottomless FsCreatePageFinite FsCreateSubpageBottomless FsCreateSubpageFinite FsDestroyDocContext FsDestroyFootnoteRejector FsDestroyPage FsDestroyPageBreakRecord FsDestroySubpage FsDestroySubpageBreakRecord FsDestroySubtrack FsDestroySubtrackBreakRecord FsDestroyTableSrv FsDestroyTableSrvBreakRecord FsDuplicateGeometry FsDuplicatePageBreakRecord FsDuplicateSubpageBreakRecord FsDuplicateSubtrackBreakRecord FsDuplicateTableSrvBreakRecord FsFAllFootnotesAllowed FsFFootnoteAllowed FsFormatSubtrackBottomless FsFormatSubtrackFinite FsFormatTableSrvBottomless FsFormatTableSrvFinite FsGetClientHandle FsGetColumnRectangle FsGetEmptySpaces FsGetFigureObstacleData FsGetFloaterFsimethods FsGetIntervals FsGetMaxNumberEmptySpaces FsGetMaxNumberIntervals FsGetNextTick FsGetNumberSubpageFootnotes FsGetNumberSubtrackFootnotes FsGetPageRectangle FsGetShiftOffset FsGetSubpageColumnBalancingInfo FsGetSubpageFootnoteInfo FsGetSubtrackColumnBalancingInfo FsGetSubtrackFootnoteInfo FsGetTableObjFsimethods FsGetTableSrvColumnBalancingInfo FsGetTableSrvFootnoteInfo FsGetTableSrvNumberFootnotes FsJustifySubpage FsQueryAttachedObjectList FsQueryCompositeColumnDetails FsQueryCompositeColumnFootnoteList FsQueryDcpLineVariantsFromCachedTextPara FsQueryEndnoteColumnDetails FsQueryFigureObjectDetails FsQueryFloaterDetails FsQueryFootnoteColumnDetails FsQueryFootnoteColumnTrackList FsQueryHeightDefinedColumnSpanAreaList FsQueryLineCompositeElementList FsQueryLineListComposite FsQueryLineListSingle FsQueryPageDetails FsQueryPageFootnoteColumnList FsQueryPageSectionList FsQuerySectionBasicColumnList FsQuerySectionCompositeColumnList FsQuerySectionDetails FsQuerySectionEndnoteColumnList FsQuerySegmentDefinedColumnSpanAreaList FsQuerySubpageBasicColumnList FsQuerySubpageDetails FsQuerySubpageHeightDefinedColumnSpanAreaList FsQuerySubpageSegmentDefinedColumnSpanAreaList FsQuerySubtrackDetails FsQuerySubtrackParaList FsQueryTableObjCellList FsQueryTableObjDetails FsQueryTableObjFigureCountWord FsQueryTableObjFigureListWord FsQueryTableObjRowDetails FsQueryTableObjRowList FsQueryTableObjTableProperDetails FsQueryTableSrvCellList FsQueryTableSrvRowDetails FsQueryTableSrvRowList FsQueryTableSrvTableDetails FsQueryTextDetails FsQueryTrackDetails FsQueryTrackParaList FsRegisterFloatObstacle FsReleaseGeometry FsResolveOverlap FsRestoreGeometry FsShiftSubtrackVertical FsSynchronizeBottomlessSubtrack FsTransferDisplayInfoSubpage FsTransferDisplayInfoSubtrack FsTransferDisplayInfoTableSrv FsTransformBbox FsTransformPoint FsTransformRectangle FsTransformVector FsUpdateBottomlessPage FsUpdateBottomlessSubpage FsUpdateBottomlessSubtrack FsUpdateBottomlessTableSrv FsUpdateFinitePage GetAncestorWrapper GetFloaterHandlerInfo GetKeyboardLayoutListWrapper GetMenuBarInfoWrapper GetNumberSubstitutionList GetParentWrapper GetScriptAnalysisList GetTableObjHandlerInfo GetTextExtentPoint32Wrapper GetWindowLongPtrWrapper GetWindowLongWrapper GetWindowTextLengthWrapper GetWindowTextWrapper GetWindowWrapper GlobalDeleteAtomWrapper IsPrintPackageTargetSupported IsStartXpsPrintJobSupported IsWindows10OrGreater IsWindows10RS1OrGreater IsWindows10RS2OrGreater IsWindows10RS3OrGreater IsWindows10RS4OrGreater IsWindows10RS5OrGreater IsWindows10TH1OrGreater IsWindows10TH2OrGreater IsWindows7OrGreater IsWindows7SP1OrGreater IsWindows8OrGreater IsWindows8Point1OrGreater IsWindowsServer IsWindowsVistaOrGreater IsWindowsVistaSP1OrGreater IsWindowsVistaSP2OrGreater IsWindowsXPOrGreater IsWindowsXPSP1OrGreater IsWindowsXPSP2OrGreater IsWindowsXPSP3OrGreater LateBoundStartXpsPrintJob LoAcquireBreakRecord LoAcquirePenaltyModule LoCloneBreakRecord LoCreateBreaks LoCreateContext LoCreateLine LoCreateParaBreakingSession LoDestroyContext LoDisplayLine LoDisposeBreakRecord LoDisposeLine LoDisposeParaBreakingSession LoDisposePenaltyModule LoEnumLine LoGetEscString LoGetPenaltyModuleInternalHandle LoQueryLineCpPpoint LoQueryLinePointPcp LoRelievePenaltyResource LoSetBreaking LoSetDoc LoSetTabs LocbkGetObjectHandlerInfo MILGetClassificationTables MapWindowPointsWrapper NlCreateHyphenator NlDestroyHyphenator NlGetClassObject NlHyphenate NlLoad NlUnload PrintToPackageTarget SetFocusWrapper SetScrollPosWrapper SetWindowLongPtrWrapper SetWindowLongWrapper

Sharing

General

Malware Config

Signatures

File Explorer

PresentationNative_cor3.dll

kernel32

ntdll

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

user32

gdi32

ole32

oleaut32

generic