1115b3ebb724bd4547cc656d85c6f2e85200ad80738f8351c9817e8c97ba8656

Analysis

custom tags

oss_ak

Sharing

Copy URL Twitter E-mail

General

Target
1115b3ebb724bd4547cc656d85c6f2e85200ad80738f8351c9817e8c97ba8656
Size 13.7MB
Sample260731-c685labe59
SHA256 1115b3ebb724bd4547cc656d85c6f2e85200ad80738f8351c9817e8c97ba8656
MD5 4820a312ac92a283b15656ea122c4c5a
SHA1 f64e211c8a5e3f4ec9564a8bf05f045efdf8049b
SHA512 f9f65b4176fe92bc4f3dfd1b07d99c168458f8ff83989aea686032808be2914a273f4f115c2203f32dcf366a7363a5cf181847ccc027fbff57f5d8c1cd038014
SSDEEP 393216:MF0fV+Gvy+NtIfWUQb7XUpgSHRfW3rb1onjB:MF0DvzJJb7XegKCxont
TLSH
T140E63305F458911ED490B072952A37B029DA1B263B19CBA3833A70F7FF57C23664F76A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

oss_ak

Malware Config

Signatures

detect oss ak 1 IoCs

oss ak information detected.

oss_ak

resource	yara_rule
static1/unpack001/KnowledgeBase.exe	detect_ak_stuff

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
1115b3ebb724bd4547cc656d85c6f2e85200ad80738f8351c9817e8c97ba8656
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/KnowledgeBase.exe
unpack001/kb-mcp.exe
unpack001/resources/pdfium/pdfium.dll

File Explorer

1115b3ebb724bd4547cc656d85c6f2e85200ad80738f8351c9817e8c97ba8656

.exe 13.7MB
$PLUGINSDIR/LangDLL.dll

.dll 5KB
$PLUGINSDIR/NSISdl.dll

.dll 15KB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsExec.dll

.dll 7KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 33KB
KnowledgeBase.exe

.exe 27.1MB
kb-mcp.exe

.exe 2.9MB
resources/pdfium/LICENSE.txt

1KB
resources/pdfium/pdfium.dll

.dll 6.8MB

1115b3ebb724bd4547cc656d85c6f2e85200ad80738f8351c9817e8c97ba8656

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 1115b3ebb724bd4547cc656d85c6f2e85200ad80738f8351c9817e8c97ba8656
MD5 4820a312ac92a283b15656ea122c4c5a
SHA1 f64e211c8a5e3f4ec9564a8bf05f045efdf8049b
SHA512 f9f65b4176fe92bc4f3dfd1b07d99c168458f8ff83989aea686032808be2914a273f4f115c2203f32dcf366a7363a5cf181847ccc027fbff57f5d8c1cd038014
SSDEEP 393216:MF0fV+Gvy+NtIfWUQb7XUpgSHRfW3rb1onjB:MF0DvzJJb7XegKCxont
TLSH
T140E63305F458911ED490B072952A37B029DA1B263B19CBA3833A70F7FF57C23664F76A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/LangDLL.dll

IMPHASH fe3375e7e4529b73ba45ab2246b9269b
SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
MD5 4b8a750993567ac9a350ba9768fabfa0
SHA1 7ee7a8c313b292d62561b085c9d490c0f8065624
SHA512 c2a06e352815a2f5340e8244cf2c5a4a5cd7e7848ea67e454ab207262cb33130008491e83d053c778bea97720f7387de737bf15355db3cd5477b94f3571107bb
SSDEEP 48:S46+/TTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mkGofjLl:zxuPbO5tCZBVEAWyMEFv2CmqL
TLSH
T171C1A370B3D248B9D591413778AB33D36612AE746784500FDB6311AA3820AE7AD3EBC2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NSISdl.dll

IMPHASH db80d5e142e716e818b7f4614dcade3c
SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
MD5 8eabbe36e8b52e69322780d0f541fd19
SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
TLSH
T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9321

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
MD5 b9b71990b37e04a56cadbcbfa694f30f
SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
TLSH
T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 2030931b38a854dde8cdd69245a8096a
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

KnowledgeBase.exe

IMPHASH fd15042fb4e09c4d911ce7f4f3035cbe
SHA256 1f2b23ccfb227eb902ec3ff3b0896021fe1a38c9388ab69ec0d312f434574c5b
MD5 3ac972d31a0ce8e6fece41170d03b095
SHA1 c9479ef6a67a10c45afeae7287b0238b4574a44f
SHA512 a693837a0585203ed40f97d41a4a996eed437f2ec5e80d2854193879d425af5f7dd5ab434b8bcb2a2919b81393ccdb51265b3bd93eb1b2d85c17bb7e3f1b55b9
SSDEEP 196608:OXCBfi8WXXK2cAiVy4zCZ3Ils4q8okJHjzysYZbD9OIpOuXU7EXZp/irLUs4CJjr:OX4rCSXUsbJjF9O3fXHtKvFKrsR
TLSH
T178573A017E8A5C99E0D8CC70C34B8B634E2130EB1536FABF49D516293F6E7B49B29359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

detect oss ak

oss ak information detected.

oss_ak
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17010668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

knowledge_base.pdb

kernel32

MultiByteToWideChar TlsGetValue TlsSetValue GlobalLock GlobalAlloc TlsFree TlsAlloc GlobalUnlock HeapReAlloc GetModuleHandleA EncodePointer SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetTimeZoneInformationForYear IsDebuggerPresent RtlPcToFileHeader FormatMessageW HeapAlloc HeapFree GetProcessHeap LoadLibraryExA GetProcAddress UnhandledExceptionFilter SetUnhandledExceptionFilter CreateMutexW LocalFree SleepConditionVariableSRW InitializeSListHead LoadLibraryA RtlUnwindEx UnregisterWaitEx TerminateProcess SetWaitableTimer LoadLibraryExW CreateWaitableTimerExW CompareStringOrdinal GlobalSize DeviceIoControl WakeAllConditionVariable WaitForMultipleObjects DuplicateHandle CreateProcessW GetExitCodeProcess CancelIo CreateEventW ExitProcess lstrlenW LoadLibraryW CreateThread SetHandleInformation SleepEx GetModuleHandleW RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW WaitForSingleObject ReleaseMutex DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext SetEnvironmentVariableW AddVectoredExceptionHandler SetThreadErrorMode CreateMutexA AreFileApisANSI GetDiskFreeSpaceW LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetCurrentProcess GetFileAttributesExW CreateFileA DeleteFileA UnlockFile LockFileEx GetFileSize CreateFileMappingW GetFileSizeEx FindNextFileW SetFilePointerEx AcquireSRWLockExclusive CreateSymbolicLinkW MoveFileExW CopyFileExW GetFinalPathNameByHandleW DeleteFileW ReleaseSRWLockExclusive GetTempPathW GetFileAttributesW CreateDirectoryW FlushFileBuffers GetFileInformationByHandleEx FindFirstFileExW SetFileInformationByHandle SetFileTime InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx GetFullPathNameW WriteFileEx IsProcessorFeaturePresent ReadFileEx WriteConsoleW GetUserDefaultUILanguage GetSystemInfo GetConsoleOutputCP GetConsoleMode GetStdHandle SetLastError RegisterWaitForSingleObject GetProcessId GetTickCount MapViewOfFile FormatMessageA GetSystemTime GetSystemTimeAsFileTime HeapDestroy HeapCompact FlushViewOfFile OutputDebugStringW HeapSize HeapValidate UnmapViewOfFile OutputDebugStringA HeapCreate RaiseException Sleep GetFileInformationByHandle CancelIoEx CreateIoCompletionPort GetQueuedCompletionStatusEx LCIDToLocaleName FreeEnvironmentStringsW PostQueuedCompletionStatus GetOverlappedResult FreeLibrary GetCurrentThreadId GetCurrentProcessId GlobalFree CloseHandle SwitchToThread WriteFile ReadFile FindClose GetLastError GetCurrentThread SetThreadStackGuarantee SetFileCompletionNotificationModes CreateFileW GetComputerNameExW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

advapi32

RegGetValueW RegSetValueExW RegCloseKey EventRegister EventUnregister RegQueryValueExW RegDeleteValueW EventWriteTransfer RegOpenKeyExW ImpersonateAnonymousToken RevertToSelf EventSetInformation SystemFunction036

ntdll

NtDeviceIoControlFile NtCreateFile NtCancelIoFileEx RtlNtStatusToDosError NtReadFile NtCreateNamedPipeFile NtWriteFile NtOpenFile RtlGetVersion

oleaut32

SysFreeString GetErrorInfo SetErrorInfo SysStringLen

combase

CoTaskMemFree CoCreateFreeThreadedMarshaler CoIncrementMTAUsage CoTaskMemAlloc

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

bcryptprimitives

ProcessPrng

user32

TrackMouseEvent SetCursorPos GetForegroundWindow IsWindow IsIconic RegisterTouchWindow EmptyClipboard OpenClipboard IsWindowEnabled EnableWindow RegisterClipboardFormatW UpdateWindow SetClipboardData GetClipboardData CloseClipboard InvalidateRect IsWindowVisible GetWindowTextW GetWindowTextLengthW SetWindowTextW SetParent SetPropW GetKeyboardState EnumDisplayMonitors MonitorFromPoint SetWindowDisplayAffinity MonitorFromRect ToUnicodeEx GetKeyState MapVirtualKeyExW GetKeyboardLayout ShowCursor UnregisterHotKey ClipCursor GetSystemMetrics ScreenToClient GetClipCursor SetCursor SetWindowLongW GetSystemMenu GetWindowPlacement GetMonitorInfoW SetWindowPlacement ChangeDisplaySettingsExW RegisterRawInputDevices AdjustWindowRectEx GetMenu GetWindowLongW InvalidateRgn ReleaseCapture SetCapture GetTouchInputInfo CloseTouchInputHandle RegisterWindowMessageA LoadCursorW DefWindowProcW GetAsyncKeyState RegisterHotKey IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos EnableMenuItem DrawIconEx GetDC AppendMenuW InsertMenuW SendInput CheckMenuItem DrawTextW ReleaseDC FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo SystemParametersInfoA PostQuitMessage ShowWindow GetActiveWindow SetMenu RemoveMenu CreateIcon SetMenuItemInfoW DrawMenuBar CreatePopupMenu CreateMenu CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu FindWindowExW SetWindowRgn GetParent KillTimer SetTimer IsClipboardFormatAvailable TranslateAcceleratorW GetMenuItemInfoW DestroyWindow SendMessageW ChangeWindowMessageFilterEx RegisterClassW MsgWaitForMultipleObjectsEx DispatchMessageW MapVirtualKeyW GetUpdateRect PeekMessageW PostThreadMessageW ValidateRect GetRawInputData GetMessageW SetWindowLongPtrW SystemParametersInfoW PostMessageW AdjustWindowRect GetWindow EnumChildWindows DispatchMessageA TranslateMessage GetMessageA SetWindowPos CreateWindowExW RegisterClassExW SetFocus GetWindowLongPtrW RedrawWindow FlashWindowEx

shell32

SHCreateItemFromParsingName ILCreateFromPathW ShellExecuteExW ShellExecuteW SHOpenFolderAndSelectItems DragFinish DragQueryFileW SHAppBarMessage Shell_NotifyIconW ILFree Shell_NotifyIconGetRect SHGetKnownFolderPath

comctl32

SetWindowSubclass DefSubclassProc TaskDialogIndirect RemoveWindowSubclass

ole32

CoCreateInstance OleInitialize CoUninitialize CoInitialize RevokeDragDrop RegisterDragDrop CoInitializeEx

shlwapi

SHCreateMemStream

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

gdi32

CreateRectRgn CombineRgn BitBlt SetBkMode GetDeviceCaps DeleteDC SelectObject CreateDIBSection CreateCompatibleDC DeleteObject SetTextColor CreateSolidBrush

ws2_32

select WSAStartup WSACleanup bind shutdown getpeername getsockname recv getsockopt freeaddrinfo getaddrinfo send WSASend closesocket setsockopt WSAGetLastError WSASocketW ioctlsocket WSAIoctl connect

bcrypt

BCryptGenRandom

crypt32

CertCloseStore CertEnumCertificatesInStore CertDuplicateStore CertVerifyTimeValidity CertDuplicateCertificateChain CertVerifyCertificateChainPolicy CertFreeCertificateChain CertDuplicateCertificateContext CertSetCertificateContextProperty CertAddCertificateContextToStore CertOpenStore CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateContext CertGetEnhancedKeyUsage CertAddEncodedCertificateToStore

secur32

QueryContextAttributesW InitializeSecurityContextW AcceptSecurityContext FreeContextBuffer DeleteSecurityContext EncryptMessage ApplyControlToken DecryptMessage FreeCredentialsHandle AcquireCredentialsHandleA

api-ms-win-crt-string-l1-1-0

strspn wcscmp strcpy_s strncmp strcmp wcsncmp wcslen _wcsicmp strcspn strlen

api-ms-win-crt-runtime-l1-1-0

exit _initterm_e _initterm _exit strerror __p___argc __p___argv _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _cexit _c_exit _wassert _register_thread_local_exe_atexit_callback abort terminate _set_app_type _seh_filter_exe _crt_atexit _register_onexit_function _initialize_onexit_table _endthreadex _beginthreadex

api-ms-win-crt-math-l1-1-0

fabs roundf fmod round trunc floor pow log2 _dclass __setusermatherr log

api-ms-win-crt-heap-l1-1-0

malloc calloc realloc _set_new_mode free _callnewh _msize

api-ms-win-crt-utility-l1-1-0

qsort _rotl64

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-convert-l1-1-0

wcstol _wtoi _ultow_s

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

kb-mcp.exe

IMPHASH a4e9dbfe9e9253c36aff03696bba6e87
SHA256 11e432c66cb90abd08028b9d3a34f126725a8f9db4c0163f9435db1c3169f7cb
MD5 fbb0985b1887dcfa862ebbe98340de2e
SHA1 cd2211b63ad2edb63118248da543781af272b4ca
SHA512 1b3f9011a1235e7b6df9888d1f94e32d417f557109a012208990c64c7e22aa6302ee9acb95f78c240033bbb821504b830ec8b9e612f094fe97ec81c721c31999
SSDEEP 49152:je5DufqOG1pyeKj1bVrP4xSXX9PmClj+ZGTW5MSMSbabDwKLOoiNkzhp3:7JWMcZoZzhp3
TLSH
T172E54A026F8A18A9D0D9CC70C34B8B538F2170CB1636F6BF45DA56662F6E6B15F2D318
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2295308

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kb_mcp.pdb

kernel32

FreeLibrary SystemTimeToFileTime SetConsoleTextAttribute GetConsoleScreenBufferInfo CloseHandle GetStdHandle GetConsoleOutputCP SetLastError WriteConsoleW ReadConsoleW GetTimeZoneInformationForYear LocalFree GetLastError SetConsoleMode GetConsoleMode CreateMutexW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection RaiseException AreFileApisANSI ReadFile HeapCreate WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetSystemInfo GetCommandLineW GetModuleFileNameW GetFullPathNameW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetSystemTimePreciseAsFileTime GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA GetProcAddress GetCurrentProcess lstrlenW GetCurrentProcessId CreateMutexA WideCharToMultiByte ReleaseMutex WaitForSingleObject MultiByteToWideChar HeapAlloc GetEnvironmentVariableW QueryPerformanceFrequency GetModuleHandleW FormatMessageW QueryPerformanceCounter GetModuleHandleA CreateFileW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileExW FindClose ExitProcess GetFileType CreateThread FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact LoadLibraryW DeleteFileW DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA Sleep HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW GetTempPathW

ntdll

RtlNtStatusToDosError NtWriteFile NtReadFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

vcruntime140

memcpy memmove __current_exception_context __CxxFrameHandler3 __current_exception __C_specific_handler strrchr strchr memchr _CxxThrowException memcmp memset

api-ms-win-crt-string-l1-1-0

strspn strncmp strlen strcmp strcspn

api-ms-win-crt-math-l1-1-0

__setusermatherr log fabs pow _dclass

api-ms-win-crt-heap-l1-1-0

_msize _set_new_mode malloc free realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_crt_atexit terminate _register_thread_local_exe_atexit_callback _register_onexit_function _c_exit _cexit __p___argv __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment _beginthreadex _endthreadex _seh_filter_exe _set_app_type _initialize_narrow_environment _configure_narrow_argv _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

resources/pdfium/pdfium.dll

IMPHASH 9e131570b54f9034233bbfc74383c0ea
SHA256 f1bdfac9323cb4ff5d71cbddea7e38c53c663201135a8a0369794b5d76ebb8a6
MD5 787c986ce89f90cde660b1be40f745c1
SHA1 e1403500fca9afa5e4cff2f109f21dd0ff009ca7
SHA512 581f7d33471691c2901928bfda7815a14c6ddaabd9708f73c8e23eec3c256de3cef2e6a3ec8a42a5b2e5a55769934a03f224021ba7b171848a24a7afe76919d8
SSDEEP 98304:o1jUL4EtPmYlOtA5vx+1xdjPaTAKwn+C4C:LAmOt/xxPaTJC4C
TLSH
T1C8765B03F19650A8E015F137DB27A632E6717C180BB466EF16906AD32F73AE07B78B54
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4501584

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

pdfium.dll.pdb

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateFileA CreateFileMappingW CreateFileW CreateMutexW DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExA FindFirstFileExW FindNextFileA FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetFileSize GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetLogicalProcessorInformation GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetWindowsDirectoryA HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MapViewOfFile MultiByteToWideChar QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseMutex ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile VirtualAlloc VirtualProtect WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

advapi32

CryptAcquireContextW CryptGenRandom CryptReleaseContext

gdi32

BeginPath BitBlt CloseFigure CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateFontA CreateFontIndirectA CreatePen CreateRectRgn CreateSolidBrush DeleteDC DeleteObject EndPath EnumFontFamiliesExA ExtCreatePen ExtEscape FillPath GdiComment GetCharWidthW GetClipBox GetClipRgn GetDIBits GetDeviceCaps GetFontData GetObjectType GetObjectW GetOutlineTextMetricsW GetRegionData GetTextFaceA GetTextMetricsW IntersectClipRect LineTo MoveToEx PolyBezierTo RestoreDC SaveDC SelectClipPath SelectObject SetDIBitsToDevice SetMiterLimit SetPolyFillMode SetStretchBltMode StretchDIBits StrokeAndFillPath StrokePath WidenPath

user32

FillRect GetDC ReleaseDC

FORM_CanRedo FORM_CanUndo FORM_DoDocumentAAction FORM_DoDocumentJSAction FORM_DoDocumentOpenAction FORM_DoPageAAction FORM_ForceToKillFocus FORM_GetFocusedAnnot FORM_GetFocusedText FORM_GetSelectedText FORM_IsIndexSelected FORM_OnAfterLoadPage FORM_OnBeforeClosePage FORM_OnChar FORM_OnFocus FORM_OnKeyDown FORM_OnKeyUp FORM_OnLButtonDoubleClick FORM_OnLButtonDown FORM_OnLButtonUp FORM_OnMouseMove FORM_OnMouseWheel FORM_OnRButtonDown FORM_OnRButtonUp FORM_Redo FORM_ReplaceAndKeepSelection FORM_ReplaceSelection FORM_SelectAllText FORM_SetFocusedAnnot FORM_SetIndexSelected FORM_Undo FPDFAction_GetDest FPDFAction_GetFilePath FPDFAction_GetType FPDFAction_GetURIPath FPDFAnnot_AddFileAttachment FPDFAnnot_AddInkStroke FPDFAnnot_AppendAttachmentPoints FPDFAnnot_AppendObject FPDFAnnot_CountAttachmentPoints FPDFAnnot_GetAP FPDFAnnot_GetAttachmentPoints FPDFAnnot_GetBorder FPDFAnnot_GetColor FPDFAnnot_GetFileAttachment FPDFAnnot_GetFlags FPDFAnnot_GetFocusableSubtypes FPDFAnnot_GetFocusableSubtypesCount FPDFAnnot_GetFontColor FPDFAnnot_GetFontSize FPDFAnnot_GetFormAdditionalActionJavaScript FPDFAnnot_GetFormControlCount FPDFAnnot_GetFormControlIndex FPDFAnnot_GetFormFieldAlternateName FPDFAnnot_GetFormFieldAtPoint FPDFAnnot_GetFormFieldExportValue FPDFAnnot_GetFormFieldFlags FPDFAnnot_GetFormFieldName FPDFAnnot_GetFormFieldType FPDFAnnot_GetFormFieldValue FPDFAnnot_GetInkListCount FPDFAnnot_GetInkListPath FPDFAnnot_GetLine FPDFAnnot_GetLink FPDFAnnot_GetLinkedAnnot FPDFAnnot_GetNumberValue FPDFAnnot_GetObject FPDFAnnot_GetObjectCount FPDFAnnot_GetOptionCount FPDFAnnot_GetOptionLabel FPDFAnnot_GetRect FPDFAnnot_GetStringValue FPDFAnnot_GetSubtype FPDFAnnot_GetValueType FPDFAnnot_GetVertices FPDFAnnot_HasAttachmentPoints FPDFAnnot_HasKey FPDFAnnot_IsChecked FPDFAnnot_IsObjectSupportedSubtype FPDFAnnot_IsOptionSelected FPDFAnnot_IsSupportedSubtype FPDFAnnot_RemoveInkList FPDFAnnot_RemoveObject FPDFAnnot_SetAP FPDFAnnot_SetAttachmentPoints FPDFAnnot_SetBorder FPDFAnnot_SetColor FPDFAnnot_SetFlags FPDFAnnot_SetFocusableSubtypes FPDFAnnot_SetFontColor FPDFAnnot_SetFormFieldFlags FPDFAnnot_SetRect FPDFAnnot_SetStringValue FPDFAnnot_SetURI FPDFAnnot_UpdateObject FPDFAttachment_GetFile FPDFAttachment_GetName FPDFAttachment_GetStringValue FPDFAttachment_GetSubtype FPDFAttachment_GetValueType FPDFAttachment_HasKey FPDFAttachment_SetFile FPDFAttachment_SetStringValue FPDFAvail_Create FPDFAvail_Destroy FPDFAvail_GetDocument FPDFAvail_GetFirstPageNum FPDFAvail_IsDocAvail FPDFAvail_IsFormAvail FPDFAvail_IsLinearized FPDFAvail_IsPageAvail FPDFBitmap_Create FPDFBitmap_CreateEx FPDFBitmap_Destroy FPDFBitmap_FillRect FPDFBitmap_GetBuffer FPDFBitmap_GetFormat FPDFBitmap_GetHeight FPDFBitmap_GetStride FPDFBitmap_GetWidth FPDFBookmark_Find FPDFBookmark_GetAction FPDFBookmark_GetCount FPDFBookmark_GetDest FPDFBookmark_GetFirstChild FPDFBookmark_GetNextSibling FPDFBookmark_GetTitle FPDFCatalog_GetLanguage FPDFCatalog_IsTagged FPDFCatalog_SetLanguage FPDFClipPath_CountPathSegments FPDFClipPath_CountPaths FPDFClipPath_GetPathSegment FPDFDOC_ExitFormFillEnvironment FPDFDOC_InitFormFillEnvironment FPDFDest_GetDestPageIndex FPDFDest_GetLocationInPage FPDFDest_GetView FPDFDoc_AddAttachment FPDFDoc_CloseJavaScriptAction FPDFDoc_DeleteAttachment FPDFDoc_GetAttachment FPDFDoc_GetAttachmentCount FPDFDoc_GetJavaScriptAction FPDFDoc_GetJavaScriptActionCount FPDFDoc_GetPageMode FPDFFont_Close FPDFFont_GetAscent FPDFFont_GetBaseFontName FPDFFont_GetDescent FPDFFont_GetFamilyName FPDFFont_GetFlags FPDFFont_GetFontData FPDFFont_GetGlyphPath FPDFFont_GetGlyphWidth FPDFFont_GetIsEmbedded FPDFFont_GetItalicAngle FPDFFont_GetWeight FPDFFormObj_CountObjects FPDFFormObj_GetObject FPDFFormObj_RemoveObject FPDFGlyphPath_CountGlyphSegments FPDFGlyphPath_GetGlyphPathSegment FPDFImageObj_GetBitmap FPDFImageObj_GetIccProfileDataDecoded FPDFImageObj_GetImageDataDecoded FPDFImageObj_GetImageDataRaw FPDFImageObj_GetImageFilter FPDFImageObj_GetImageFilterCount FPDFImageObj_GetImageMetadata FPDFImageObj_GetImagePixelSize FPDFImageObj_GetRenderedBitmap FPDFImageObj_LoadJpegFile FPDFImageObj_LoadJpegFileInline FPDFImageObj_SetBitmap FPDFImageObj_SetMatrix FPDFJavaScriptAction_GetName FPDFJavaScriptAction_GetScript FPDFLink_CloseWebLinks FPDFLink_CountQuadPoints FPDFLink_CountRects FPDFLink_CountWebLinks FPDFLink_Enumerate FPDFLink_GetAction FPDFLink_GetAnnot FPDFLink_GetAnnotRect FPDFLink_GetDest FPDFLink_GetLinkAtPoint FPDFLink_GetLinkZOrderAtPoint FPDFLink_GetQuadPoints FPDFLink_GetRect FPDFLink_GetTextRange FPDFLink_GetURL FPDFLink_LoadWebLinks FPDFPageObjMark_CountParams FPDFPageObjMark_GetName FPDFPageObjMark_GetParamBlobValue FPDFPageObjMark_GetParamFloatValue FPDFPageObjMark_GetParamIntValue FPDFPageObjMark_GetParamKey FPDFPageObjMark_GetParamStringValue FPDFPageObjMark_GetParamValueType FPDFPageObjMark_RemoveParam FPDFPageObjMark_SetBlobParam FPDFPageObjMark_SetFloatParam FPDFPageObjMark_SetIntParam FPDFPageObjMark_SetStringParam FPDFPageObj_AddMark FPDFPageObj_CountMarks FPDFPageObj_CreateNewPath FPDFPageObj_CreateNewRect FPDFPageObj_CreateTextObj FPDFPageObj_Destroy FPDFPageObj_GetBounds FPDFPageObj_GetClipPath FPDFPageObj_GetDashArray FPDFPageObj_GetDashCount FPDFPageObj_GetDashPhase FPDFPageObj_GetFillColor FPDFPageObj_GetIsActive FPDFPageObj_GetLineCap FPDFPageObj_GetLineJoin FPDFPageObj_GetMark FPDFPageObj_GetMarkedContentID FPDFPageObj_GetMatrix FPDFPageObj_GetRotatedBounds FPDFPageObj_GetStrokeColor FPDFPageObj_GetStrokeWidth FPDFPageObj_GetType FPDFPageObj_HasTransparency FPDFPageObj_NewImageObj FPDFPageObj_NewTextObj FPDFPageObj_RemoveMark FPDFPageObj_SetBlendMode FPDFPageObj_SetDashArray FPDFPageObj_SetDashPhase FPDFPageObj_SetFillColor FPDFPageObj_SetIsActive FPDFPageObj_SetLineCap FPDFPageObj_SetLineJoin FPDFPageObj_SetMatrix FPDFPageObj_SetStrokeColor FPDFPageObj_SetStrokeWidth FPDFPageObj_Transform FPDFPageObj_TransformClipPath FPDFPageObj_TransformF FPDFPage_CloseAnnot FPDFPage_CountObjects FPDFPage_CreateAnnot FPDFPage_Delete FPDFPage_Flatten FPDFPage_FormFieldZOrderAtPoint FPDFPage_GenerateContent FPDFPage_GetAnnot FPDFPage_GetAnnotCount FPDFPage_GetAnnotIndex FPDFPage_GetArtBox FPDFPage_GetBleedBox FPDFPage_GetCropBox FPDFPage_GetDecodedThumbnailData FPDFPage_GetMediaBox FPDFPage_GetObject FPDFPage_GetRawThumbnailData FPDFPage_GetRotation FPDFPage_GetThumbnailAsBitmap FPDFPage_GetTrimBox FPDFPage_HasFormFieldAtPoint FPDFPage_HasTransparency FPDFPage_InsertClipPath FPDFPage_InsertObject FPDFPage_InsertObjectAtIndex FPDFPage_New FPDFPage_RemoveAnnot FPDFPage_RemoveObject FPDFPage_SetArtBox FPDFPage_SetBleedBox FPDFPage_SetCropBox FPDFPage_SetMediaBox FPDFPage_SetRotation FPDFPage_SetTrimBox FPDFPage_TransFormWithClip FPDFPage_TransformAnnots FPDFPathSegment_GetClose FPDFPathSegment_GetPoint FPDFPathSegment_GetType FPDFPath_BezierTo FPDFPath_Close FPDFPath_CountSegments FPDFPath_GetDrawMode FPDFPath_GetPathSegment FPDFPath_LineTo FPDFPath_MoveTo FPDFPath_SetDrawMode FPDFSignatureObj_GetByteRange FPDFSignatureObj_GetContents FPDFSignatureObj_GetDocMDPPermission FPDFSignatureObj_GetReason FPDFSignatureObj_GetSubFilter FPDFSignatureObj_GetTime FPDFTextObj_GetFont FPDFTextObj_GetFontSize FPDFTextObj_GetRenderedBitmap FPDFTextObj_GetText FPDFTextObj_GetTextRenderMode FPDFTextObj_SetTextRenderMode FPDFText_ClosePage FPDFText_CountChars FPDFText_CountRects FPDFText_FindClose FPDFText_FindNext FPDFText_FindPrev FPDFText_FindStart FPDFText_GetBoundedText FPDFText_GetCharAngle FPDFText_GetCharBox FPDFText_GetCharIndexAtPos FPDFText_GetCharIndexFromTextIndex FPDFText_GetCharOrigin FPDFText_GetFillColor FPDFText_GetFontInfo FPDFText_GetFontSize FPDFText_GetFontWeight FPDFText_GetLooseCharBox FPDFText_GetMatrix FPDFText_GetRect FPDFText_GetSchCount FPDFText_GetSchResultIndex FPDFText_GetStrokeColor FPDFText_GetText FPDFText_GetTextIndexFromCharIndex FPDFText_GetTextObject FPDFText_GetUnicode FPDFText_HasUnicodeMapError FPDFText_IsGenerated FPDFText_IsHyphen FPDFText_LoadCidType2Font FPDFText_LoadFont FPDFText_LoadPage FPDFText_LoadStandardFont FPDFText_SetCharcodes FPDFText_SetText FPDF_AddInstalledFont FPDF_CloseDocument FPDF_ClosePage FPDF_CloseXObject FPDF_CopyViewerPreferences FPDF_CountNamedDests FPDF_CreateClipPath FPDF_CreateNewDocument FPDF_DestroyClipPath FPDF_DestroyLibrary FPDF_DeviceToPage FPDF_DocumentHasValidCrossReferenceTable FPDF_FFLDraw FPDF_FreeDefaultSystemFontInfo FPDF_GetDefaultSystemFontInfo FPDF_GetDefaultTTFMap FPDF_GetDefaultTTFMapCount FPDF_GetDefaultTTFMapEntry FPDF_GetDocPermissions FPDF_GetDocUserPermissions FPDF_GetFileIdentifier FPDF_GetFileVersion FPDF_GetFormType FPDF_GetLastError FPDF_GetMetaText FPDF_GetNamedDest FPDF_GetNamedDestByName FPDF_GetPageAAction FPDF_GetPageBoundingBox FPDF_GetPageCount FPDF_GetPageHeight FPDF_GetPageHeightF FPDF_GetPageLabel FPDF_GetPageSizeByIndex FPDF_GetPageSizeByIndexF FPDF_GetPageWidth FPDF_GetPageWidthF FPDF_GetSecurityHandlerRevision FPDF_GetSignatureCount FPDF_GetSignatureObject FPDF_GetTrailerEnds FPDF_GetXFAPacketContent FPDF_GetXFAPacketCount FPDF_GetXFAPacketName FPDF_ImportNPagesToOne FPDF_ImportPages FPDF_ImportPagesByIndex FPDF_InitLibrary FPDF_InitLibraryWithConfig FPDF_LoadCustomDocument FPDF_LoadDocument FPDF_LoadMemDocument FPDF_LoadMemDocument64 FPDF_LoadPage FPDF_LoadXFA FPDF_MovePages FPDF_NewFormObjectFromXObject FPDF_NewXObjectFromPage FPDF_PageToDevice FPDF_RemoveFormFieldHighlight FPDF_RenderPage FPDF_RenderPageBitmap FPDF_RenderPageBitmapWithColorScheme_Start FPDF_RenderPageBitmapWithMatrix FPDF_RenderPageBitmap_Start FPDF_RenderPage_Close FPDF_RenderPage_Continue FPDF_SaveAsCopy FPDF_SaveWithVersion FPDF_SetFormFieldHighlightAlpha FPDF_SetFormFieldHighlightColor FPDF_SetPrintMode FPDF_SetSandBoxPolicy FPDF_SetSystemFontInfo FPDF_StructElement_Attr_CountChildren FPDF_StructElement_Attr_GetBlobValue FPDF_StructElement_Attr_GetBooleanValue FPDF_StructElement_Attr_GetChildAtIndex FPDF_StructElement_Attr_GetCount FPDF_StructElement_Attr_GetName FPDF_StructElement_Attr_GetNumberValue FPDF_StructElement_Attr_GetStringValue FPDF_StructElement_Attr_GetType FPDF_StructElement_Attr_GetValue FPDF_StructElement_CountChildren FPDF_StructElement_GetActualText FPDF_StructElement_GetAltText FPDF_StructElement_GetAttributeAtIndex FPDF_StructElement_GetAttributeCount FPDF_StructElement_GetChildAtIndex FPDF_StructElement_GetChildMarkedContentID FPDF_StructElement_GetExpansion FPDF_StructElement_GetID FPDF_StructElement_GetLang FPDF_StructElement_GetMarkedContentID FPDF_StructElement_GetMarkedContentIdAtIndex FPDF_StructElement_GetMarkedContentIdCount FPDF_StructElement_GetObjType FPDF_StructElement_GetParent FPDF_StructElement_GetStringAttribute FPDF_StructElement_GetTitle FPDF_StructElement_GetType FPDF_StructTree_Close FPDF_StructTree_CountChildren FPDF_StructTree_GetChildAtIndex FPDF_StructTree_GetForPage FPDF_VIEWERREF_GetDuplex FPDF_VIEWERREF_GetName FPDF_VIEWERREF_GetNumCopies FPDF_VIEWERREF_GetPrintPageRange FPDF_VIEWERREF_GetPrintPageRangeCount FPDF_VIEWERREF_GetPrintPageRangeElement FPDF_VIEWERREF_GetPrintScaling FSDK_SetLocaltimeFunction FSDK_SetTimeFunction FSDK_SetUnSpObjProcessHandler

Name

.text

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

98KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

313B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

512B

Virtual Size

418B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

920B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Analysis

Sharing

General

Malware Config

Signatures

File Explorer

1115b3ebb724bd4547cc656d85c6f2e85200ad80738f8351c9817e8c97ba8656

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/NSISdl.dll

advapi32

wsock32

user32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

shell32

generic

KnowledgeBase.exe

kernel32

api-ms-win-core-synch-l1-2-0

advapi32

ntdll

oleaut32

combase

api-ms-win-core-winrt-l1-1-0

bcryptprimitives

user32

shell32

comctl32

ole32

shlwapi

dwmapi

gdi32

ws2_32

bcrypt

crypt32

secur32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0