DirectPDFEditor-Setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
DirectPDFEditor-Setup.exe
Size 6.7MB
Sample261002-pg9faavzgs
SHA256 3653ef7ffeda6e51d518c3ef8199c500a78a49f4ea55a2cd2249b670e93fc1e3
MD5 5dfe1c428e8940706e3324e18aba6305
SHA1 52d3b45d3ac2c8a7849cce0360aaa73380b44544
SHA512 22cc8457615c47cf7644a966448429016544b8c84a74fca027be45525313fadcae1cea71c76afbe72f3ac95dfeb1dc48d60b80af65df46a26ffe65576fefcf43
SSDEEP 98304:81glMnO3unkHB4UYkixEXdEqnSBNP2ZBtnH7aXLtIiRGbDnHfBe6mbZs9J53BY11:86ukHO1fEXe3WZBFeacGXdmb2Dyz2e
TLSH
T15766337F7B9C1532C93E89743F2A59BD0301BA3B51E8B68ED3982F8315A2748711D366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
DirectPDFEditor-Setup.exe
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/DirectPDFEditor.exe
unpack001/pdfium.dll

File Explorer

DirectPDFEditor-Setup.exe

.exe 6.7MB
$PLUGINSDIR/NSISdl.dll

.dll 15KB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 33KB
DirectPDFEditor.exe

.exe 16.7MB
THIRD-PARTY-NOTICES.txt

212KB
pdfium.dll

.dll 6.9MB

DirectPDFEditor-Setup.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 3653ef7ffeda6e51d518c3ef8199c500a78a49f4ea55a2cd2249b670e93fc1e3
MD5 5dfe1c428e8940706e3324e18aba6305
SHA1 52d3b45d3ac2c8a7849cce0360aaa73380b44544
SHA512 22cc8457615c47cf7644a966448429016544b8c84a74fca027be45525313fadcae1cea71c76afbe72f3ac95dfeb1dc48d60b80af65df46a26ffe65576fefcf43
SSDEEP 98304:81glMnO3unkHB4UYkixEXdEqnSBNP2ZBtnH7aXLtIiRGbDnHfBe6mbZs9J53BY11:86ukHO1fEXe3WZBFeacGXdmb2Dyz2e
TLSH
T15766337F7B9C1532C93E89743F2A59BD0301BA3B51E8B68ED3982F8315A2748711D366
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/NSISdl.dll

IMPHASH db80d5e142e716e818b7f4614dcade3c
SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
MD5 8eabbe36e8b52e69322780d0f541fd19
SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
TLSH
T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9321

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
MD5 b9b71990b37e04a56cadbcbfa694f30f
SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
TLSH
T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 2030931b38a854dde8cdd69245a8096a
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

DirectPDFEditor.exe

IMPHASH 3ec885e6887931b61ee9c400754dab46
SHA256 db0617e6027881fc9df96c838bfc5b1f2d7eeb33cfe70ece376a448dfe87b8c5
MD5 c61964bf27fef1bf7d2eee99ee470f10
SHA1 d7c0e311cb02fea214c87713ae7fac95349b7f29
SHA512 4d4b9b92f1866a6c5a79e5ca119197fa76966278feb6159c2e17db3a7a47cae93f192d959e070b5155da875de4fcf50110f5d5ebeb959aae11ac92d024659b5f
SSDEEP 98304:CyIpz46YUxJMYCVA4u6Q+8HwuowSmpN4xAbfGejwTbwyOwkgxyZoJUivc4CTeo6f:aIURwHbJKnb35MTPCZN/mzHnZglu
TLSH
T1840708157A5B99ACD15AC870C34A86631E2130DB0B36B9FF44D456383FBABF46F38258
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12206944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

pdf_editor_offline.pdb

bcryptprimitives

ProcessPrng

ntdll

NtCreateFile NtDeviceIoControlFile NtCancelIoFileEx NtWriteFile RtlGetVersion RtlNtStatusToDosError NtCreateNamedPipeFile NtReadFile NtOpenFile

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW AddVectoredExceptionHandler GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext QueryPerformanceCounter SetFileCompletionNotificationModes FreeLibrary SetThreadErrorMode QueryPerformanceFrequency CreateWaitableTimerExW GetConsoleOutputCP GetConsoleMode WriteConsoleW DeviceIoControl CreateMutexA CreateDirectoryW CreateProcessW GetStdHandle WriteFileEx FindClose SetUnhandledExceptionFilter ReleaseMutex ReadFileEx InitializeSListHead GetModuleHandleW EncodePointer FlsGetValue RaiseException RtlPcToFileHeader SetNamedPipeHandleState GetUserDefaultUILanguage LCIDToLocaleName CreateFileW SetFilePointerEx GetLastError lstrlenW WaitForSingleObject SetEvent GetSystemTimeAsFileTime CreateMutexW SleepConditionVariableSRW CompareStringOrdinal SleepEx SetLastError GetCommandLineW GetCurrentProcess DuplicateHandle GetSystemTimePreciseAsFileTime SetHandleInformation RtlLookupFunctionEntry SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW SetThreadStackGuarantee GetCurrentThread RemoveDirectoryW MoveFileExW FindFirstFileExW ExitProcess GetSystemInfo WideCharToMultiByte WaitForSingleObjectEx GetFinalPathNameByHandleW DeleteFileW HeapAlloc GetModuleFileNameW MultiByteToWideChar SetWaitableTimer GetFileAttributesW FlsFree FlsAlloc GetModuleHandleExW FlsSetValue IsThreadAFiber FormatMessageW GetTempPathW FindNextFileW GetFileSizeEx WakeAllConditionVariable LoadLibraryW CreateThread GetQueuedCompletionStatusEx CancelIoEx WriteFile GetOverlappedResult DeleteCriticalSection ReadFile CreateIoCompletionPort PostQueuedCompletionStatus CloseHandle RtlUnwindEx GetProcAddress AcquireSRWLockExclusive CreateEventW SwitchToThread HeapReAlloc GetFullPathNameW GetCurrentThreadId ReleaseSRWLockExclusive SetEnvironmentVariableW LoadLibraryA HeapFree GetProcessHeap Sleep GetModuleHandleA LoadLibraryExW GetCurrentProcessId OutputDebugStringW OutputDebugStringA InitializeCriticalSectionEx GetEnvironmentVariableW LoadLibraryExA

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

advapi32

RegCloseKey RegEnumValueW RegQueryValueExW RegGetValueW RegOpenKeyExW EventSetInformation EventUnregister EventWriteTransfer EventRegister

shell32

SHOpenFolderAndSelectItems SHGetKnownFolderPath ILFree DragFinish SHGetStockIconInfo ShellExecuteExW ILCreateFromPathW SHAppBarMessage DragQueryFileW SHCreateItemFromParsingName ShellExecuteW

combase

CoCreateFreeThreadedMarshaler CoTaskMemFree CoIncrementMTAUsage CoTaskMemAlloc

user32

SetWindowLongW GetSystemMenu ClipCursor MapVirtualKeyExW GetKeyboardState GetKeyState GetWindowDC GetWindowRect MapWindowPoints GetMenu EnumChildWindows DispatchMessageA SetPropW GetMessageA GetClientRect AllowSetForegroundWindow GetMenuBarInfo FillRect GetWindowThreadProcessId FindWindowW GetMenuItemInfoW ShowCursor VkKeyScanW ToUnicodeEx OffsetRect GetForegroundWindow ReleaseDC UpdateWindow DrawTextW MonitorFromWindow GetKeyboardLayout GetWindowTextLengthW SetCursorPos GetWindowTextW SetWindowTextW TranslateAcceleratorW FlashWindowEx InvalidateRgn SetWindowPos GetWindowPlacement GetDC IsProcessDPIAware CreateIcon SetWindowPlacement DestroyIcon SystemParametersInfoA ChangeDisplaySettingsExW GetMonitorInfoW SystemParametersInfoW SetCursor MsgWaitForMultipleObjectsEx MonitorFromRect CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SetCapture ReleaseCapture GetWindowLongW ScreenToClient RegisterWindowMessageA LoadCursorW CreateWindowExW LoadImageW AdjustWindowRectEx RegisterClassExW GetUpdateRect MapVirtualKeyW ValidateRect GetRawInputData SetWindowLongPtrW GetClipCursor GetIconInfo RegisterTouchWindow GetSystemMetrics SetWindowDisplayAffinity DefWindowProcW PostThreadMessageW PeekMessageW DestroyWindow DispatchMessageW TranslateMessage GetMessageW IsWindowEnabled EnableWindow IsIconic IsWindowVisible RegisterRawInputDevices SetWindowRgn RedrawWindow AdjustWindowRect EnumDisplayMonitors MonitorFromPoint GetWindowLongPtrW FindWindowExW GetParent SetFocus GetWindow SetParent DestroyMenu SendInput ShowWindow PostQuitMessage PostMessageW GetActiveWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos AppendMenuW InsertMenuW InvalidateRect SetMenuItemInfoW EnableMenuItem CheckMenuItem RemoveMenu CreatePopupMenu CreateMenu SendMessageW DrawMenuBar SetMenu CreateAcceleratorTableW DestroyAcceleratorTable DrawIconEx GetAsyncKeyState

gdi32

SetTextColor SetBkMode DeleteObject CreateCompatibleDC GetDeviceCaps CreateDIBSection SelectObject DeleteDC GetDIBits BitBlt CreateRectRgn CreateSolidBrush CombineRgn

comctl32

TaskDialogIndirect RemoveWindowSubclass DefSubclassProc SetWindowSubclass

ole32

RegisterDragDrop CoInitializeEx RevokeDragDrop CoInitialize CoCreateInstance CoUninitialize OleInitialize

oleaut32

GetErrorInfo SysFreeString SysStringLen SetErrorInfo

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow DwmGetWindowAttribute

imm32

ImmGetContext ImmReleaseContext ImmGetCompositionStringW

shlwapi

SHCreateMemStream

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

crypt32

CertEnumCertificatesInStore CertDuplicateCertificateChain CertFreeCertificateChain CertDuplicateStore CertVerifyCertificateChainPolicy CertGetCertificateChain CertAddCertificateContextToStore CertOpenStore CertCloseStore CertDuplicateCertificateContext CertFreeCertificateContext

ws2_32

WSACleanup WSAStartup getpeername getsockname getaddrinfo connect WSAIoctl shutdown freeaddrinfo send WSASend WSAGetLastError recv closesocket bind setsockopt ioctlsocket WSASocketW getsockopt

secur32

QueryContextAttributesW DeleteSecurityContext ApplyControlToken EncryptMessage FreeContextBuffer AcquireCredentialsHandleA FreeCredentialsHandle DecryptMessage InitializeSecurityContextW AcceptSecurityContext

api-ms-win-crt-math-l1-1-0

expf log2 trunc roundf logf cosf pow floor truncf __setusermatherr floorf sinf ceilf round

api-ms-win-crt-string-l1-1-0

strcpy_s wcscmp _wcsicmp wcslen strlen

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode _callnewh free calloc

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback __p___argc _seh_filter_exe _c_exit _set_app_type _exit _cexit _get_initial_narrow_environment _configure_narrow_argv _initterm_e exit _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _initterm abort __p___argv terminate _crt_atexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

pdfium.dll

IMPHASH 9e131570b54f9034233bbfc74383c0ea
SHA256 79d4676b656cfb1abcea88f9ade3b4b0826c5200382db5f4ec72a636c598c118
MD5 ec740cc5466468942ba546077144fcc6
SHA1 15eff99265480c200f42918480acd28dd93e57a9
SHA512 eaa51d502d6d99d6264831538ef686b6d40a87d7d051013501e0fe0e15698cb784810e76546b33f1b5a1601524a49efe05a8a1b9c3d7d9ebe468925c090f9114
SSDEEP 98304:SnYrkkBWDewFm3pXSWgTAkootwPaMrKwn+C4C1:s1eIm3pfo6PaMgC4C1
TLSH
T1B9764A03E19650A8E055F137DB27A232E6717C0907B466EF16906AE32F73BE07B78B54
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4538560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

pdfium.dll.pdb

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateFileA CreateFileMappingW CreateFileW CreateMutexW DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExA FindFirstFileExW FindNextFileA FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetFileSize GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetLogicalProcessorInformation GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetWindowsDirectoryA HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MapViewOfFile MultiByteToWideChar QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseMutex ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile VirtualAlloc VirtualProtect WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

advapi32

CryptAcquireContextW CryptGenRandom CryptReleaseContext

gdi32

BeginPath BitBlt CloseFigure CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateFontA CreateFontIndirectA CreatePen CreateRectRgn CreateSolidBrush DeleteDC DeleteObject EndPath EnumFontFamiliesExA ExtCreatePen ExtEscape FillPath GdiComment GetCharWidthW GetClipBox GetClipRgn GetDIBits GetDeviceCaps GetFontData GetObjectType GetObjectW GetOutlineTextMetricsW GetRegionData GetTextFaceA GetTextMetricsW IntersectClipRect LineTo MoveToEx PolyBezierTo RestoreDC SaveDC SelectClipPath SelectObject SetDIBitsToDevice SetMiterLimit SetPolyFillMode SetStretchBltMode StretchDIBits StrokeAndFillPath StrokePath WidenPath

user32

FillRect GetDC ReleaseDC

FORM_CanRedo FORM_CanUndo FORM_DoDocumentAAction FORM_DoDocumentJSAction FORM_DoDocumentOpenAction FORM_DoPageAAction FORM_ForceToKillFocus FORM_GetFocusedAnnot FORM_GetFocusedText FORM_GetSelectedText FORM_IsIndexSelected FORM_OnAfterLoadPage FORM_OnBeforeClosePage FORM_OnChar FORM_OnFocus FORM_OnKeyDown FORM_OnKeyUp FORM_OnLButtonDoubleClick FORM_OnLButtonDown FORM_OnLButtonUp FORM_OnMouseMove FORM_OnMouseWheel FORM_OnRButtonDown FORM_OnRButtonUp FORM_Redo FORM_ReplaceAndKeepSelection FORM_ReplaceSelection FORM_SelectAllText FORM_SetFocusedAnnot FORM_SetIndexSelected FORM_Undo FPDFAction_GetDest FPDFAction_GetFilePath FPDFAction_GetType FPDFAction_GetURIPath FPDFAnnot_AddFileAttachment FPDFAnnot_AddInkStroke FPDFAnnot_AppendAttachmentPoints FPDFAnnot_AppendObject FPDFAnnot_CountAttachmentPoints FPDFAnnot_GetAP FPDFAnnot_GetAttachmentPoints FPDFAnnot_GetBorder FPDFAnnot_GetColor FPDFAnnot_GetFileAttachment FPDFAnnot_GetFlags FPDFAnnot_GetFocusableSubtypes FPDFAnnot_GetFocusableSubtypesCount FPDFAnnot_GetFontColor FPDFAnnot_GetFontSize FPDFAnnot_GetFormAdditionalActionJavaScript FPDFAnnot_GetFormControlCount FPDFAnnot_GetFormControlIndex FPDFAnnot_GetFormFieldAlternateName FPDFAnnot_GetFormFieldAtPoint FPDFAnnot_GetFormFieldExportValue FPDFAnnot_GetFormFieldFlags FPDFAnnot_GetFormFieldName FPDFAnnot_GetFormFieldType FPDFAnnot_GetFormFieldValue FPDFAnnot_GetInkListCount FPDFAnnot_GetInkListPath FPDFAnnot_GetLine FPDFAnnot_GetLink FPDFAnnot_GetLinkedAnnot FPDFAnnot_GetNumberValue FPDFAnnot_GetObject FPDFAnnot_GetObjectCount FPDFAnnot_GetOptionCount FPDFAnnot_GetOptionLabel FPDFAnnot_GetRect FPDFAnnot_GetStringValue FPDFAnnot_GetSubtype FPDFAnnot_GetValueType FPDFAnnot_GetVertices FPDFAnnot_HasAttachmentPoints FPDFAnnot_HasKey FPDFAnnot_IsChecked FPDFAnnot_IsObjectSupportedSubtype FPDFAnnot_IsOptionSelected FPDFAnnot_IsSupportedSubtype FPDFAnnot_RemoveInkList FPDFAnnot_RemoveObject FPDFAnnot_SetAP FPDFAnnot_SetAttachmentPoints FPDFAnnot_SetBorder FPDFAnnot_SetColor FPDFAnnot_SetFlags FPDFAnnot_SetFocusableSubtypes FPDFAnnot_SetFontColor FPDFAnnot_SetFormFieldFlags FPDFAnnot_SetRect FPDFAnnot_SetStringValue FPDFAnnot_SetURI FPDFAnnot_UpdateObject FPDFAttachment_GetFile FPDFAttachment_GetName FPDFAttachment_GetStringValue FPDFAttachment_GetSubtype FPDFAttachment_GetValueType FPDFAttachment_HasKey FPDFAttachment_SetFile FPDFAttachment_SetStringValue FPDFAvail_Create FPDFAvail_Destroy FPDFAvail_GetDocument FPDFAvail_GetFirstPageNum FPDFAvail_IsDocAvail FPDFAvail_IsFormAvail FPDFAvail_IsLinearized FPDFAvail_IsPageAvail FPDFBitmap_Create FPDFBitmap_CreateEx FPDFBitmap_Destroy FPDFBitmap_FillRect FPDFBitmap_GetBuffer FPDFBitmap_GetFormat FPDFBitmap_GetHeight FPDFBitmap_GetStride FPDFBitmap_GetWidth FPDFBookmark_Find FPDFBookmark_GetAction FPDFBookmark_GetCount FPDFBookmark_GetDest FPDFBookmark_GetFirstChild FPDFBookmark_GetNextSibling FPDFBookmark_GetTitle FPDFCatalog_GetLanguage FPDFCatalog_IsTagged FPDFCatalog_SetLanguage FPDFClipPath_CountPathSegments FPDFClipPath_CountPaths FPDFClipPath_GetPathSegment FPDFDOC_ExitFormFillEnvironment FPDFDOC_InitFormFillEnvironment FPDFDest_GetDestPageIndex FPDFDest_GetLocationInPage FPDFDest_GetView FPDFDoc_AddAttachment FPDFDoc_CloseJavaScriptAction FPDFDoc_DeleteAttachment FPDFDoc_GetAttachment FPDFDoc_GetAttachmentCount FPDFDoc_GetJavaScriptAction FPDFDoc_GetJavaScriptActionCount FPDFDoc_GetPageMode FPDFFont_Close FPDFFont_GetAscent FPDFFont_GetBaseFontName FPDFFont_GetDescent FPDFFont_GetFamilyName FPDFFont_GetFlags FPDFFont_GetFontData FPDFFont_GetGlyphPath FPDFFont_GetGlyphWidth FPDFFont_GetIsEmbedded FPDFFont_GetItalicAngle FPDFFont_GetWeight FPDFFormObj_CountObjects FPDFFormObj_GetObject FPDFFormObj_RemoveObject FPDFGlyphPath_CountGlyphSegments FPDFGlyphPath_GetGlyphPathSegment FPDFImageObj_GetBitmap FPDFImageObj_GetIccProfileDataDecoded FPDFImageObj_GetImageDataDecoded FPDFImageObj_GetImageDataRaw FPDFImageObj_GetImageFilter FPDFImageObj_GetImageFilterCount FPDFImageObj_GetImageMetadata FPDFImageObj_GetImagePixelSize FPDFImageObj_GetRenderedBitmap FPDFImageObj_LoadJpegFile FPDFImageObj_LoadJpegFileInline FPDFImageObj_SetBitmap FPDFImageObj_SetMatrix FPDFJavaScriptAction_GetName FPDFJavaScriptAction_GetScript FPDFLink_CloseWebLinks FPDFLink_CountQuadPoints FPDFLink_CountRects FPDFLink_CountWebLinks FPDFLink_Enumerate FPDFLink_GetAction FPDFLink_GetAnnot FPDFLink_GetAnnotRect FPDFLink_GetDest FPDFLink_GetLinkAtPoint FPDFLink_GetLinkZOrderAtPoint FPDFLink_GetQuadPoints FPDFLink_GetRect FPDFLink_GetTextRange FPDFLink_GetURL FPDFLink_LoadWebLinks FPDFPageObjMark_CountParams FPDFPageObjMark_GetName FPDFPageObjMark_GetParamBlobValue FPDFPageObjMark_GetParamFloatValue FPDFPageObjMark_GetParamIntValue FPDFPageObjMark_GetParamKey FPDFPageObjMark_GetParamStringValue FPDFPageObjMark_GetParamValueType FPDFPageObjMark_RemoveParam FPDFPageObjMark_SetBlobParam FPDFPageObjMark_SetFloatParam FPDFPageObjMark_SetIntParam FPDFPageObjMark_SetStringParam FPDFPageObj_AddExistingMark FPDFPageObj_AddMark FPDFPageObj_CountMarks FPDFPageObj_CreateNewPath FPDFPageObj_CreateNewRect FPDFPageObj_CreateTextObj FPDFPageObj_Destroy FPDFPageObj_GetBounds FPDFPageObj_GetClipPath FPDFPageObj_GetDashArray FPDFPageObj_GetDashCount FPDFPageObj_GetDashPhase FPDFPageObj_GetFillColor FPDFPageObj_GetIsActive FPDFPageObj_GetLineCap FPDFPageObj_GetLineJoin FPDFPageObj_GetMark FPDFPageObj_GetMarkedContentID FPDFPageObj_GetMatrix FPDFPageObj_GetRotatedBounds FPDFPageObj_GetStrokeColor FPDFPageObj_GetStrokeWidth FPDFPageObj_GetType FPDFPageObj_HasTransparency FPDFPageObj_NewImageObj FPDFPageObj_NewTextObj FPDFPageObj_RemoveMark FPDFPageObj_SetBlendMode FPDFPageObj_SetDashArray FPDFPageObj_SetDashPhase FPDFPageObj_SetFillColor FPDFPageObj_SetIsActive FPDFPageObj_SetLineCap FPDFPageObj_SetLineJoin FPDFPageObj_SetMatrix FPDFPageObj_SetStrokeColor FPDFPageObj_SetStrokeWidth FPDFPageObj_Transform FPDFPageObj_TransformClipPath FPDFPageObj_TransformF FPDFPage_CloseAnnot FPDFPage_CountObjects FPDFPage_CreateAnnot FPDFPage_Delete FPDFPage_Flatten FPDFPage_FormFieldZOrderAtPoint FPDFPage_GenerateContent FPDFPage_GetAnnot FPDFPage_GetAnnotCount FPDFPage_GetAnnotIndex FPDFPage_GetArtBox FPDFPage_GetBleedBox FPDFPage_GetCropBox FPDFPage_GetDecodedThumbnailData FPDFPage_GetMediaBox FPDFPage_GetObject FPDFPage_GetRawThumbnailData FPDFPage_GetRotation FPDFPage_GetThumbnailAsBitmap FPDFPage_GetTrimBox FPDFPage_HasFormFieldAtPoint FPDFPage_HasTransparency FPDFPage_InsertClipPath FPDFPage_InsertObject FPDFPage_InsertObjectAtIndex FPDFPage_New FPDFPage_RemoveAnnot FPDFPage_RemoveObject FPDFPage_SetArtBox FPDFPage_SetBleedBox FPDFPage_SetCropBox FPDFPage_SetMediaBox FPDFPage_SetRotation FPDFPage_SetTrimBox FPDFPage_TransFormWithClip FPDFPage_TransformAnnots FPDFPathSegment_GetClose FPDFPathSegment_GetPoint FPDFPathSegment_GetType FPDFPath_BezierTo FPDFPath_Close FPDFPath_CountSegments FPDFPath_GetDrawMode FPDFPath_GetPathSegment FPDFPath_LineTo FPDFPath_MoveTo FPDFPath_SetDrawMode FPDFSignatureObj_GetByteRange FPDFSignatureObj_GetContents FPDFSignatureObj_GetDocMDPPermission FPDFSignatureObj_GetReason FPDFSignatureObj_GetSubFilter FPDFSignatureObj_GetTime FPDFTextObj_GetFont FPDFTextObj_GetFontSize FPDFTextObj_GetRenderedBitmap FPDFTextObj_GetText FPDFTextObj_GetTextRenderMode FPDFTextObj_SetFontSize FPDFTextObj_SetTextRenderMode FPDFText_ClosePage FPDFText_CountChars FPDFText_CountRects FPDFText_FindClose FPDFText_FindNext FPDFText_FindPrev FPDFText_FindStart FPDFText_GetBoundedText FPDFText_GetCharAngle FPDFText_GetCharBox FPDFText_GetCharIndexAtPos FPDFText_GetCharIndexFromTextIndex FPDFText_GetCharOrigin FPDFText_GetFillColor FPDFText_GetFontInfo FPDFText_GetFontSize FPDFText_GetFontWeight FPDFText_GetLooseCharBox FPDFText_GetMatrix FPDFText_GetRect FPDFText_GetSchCount FPDFText_GetSchResultIndex FPDFText_GetStrokeColor FPDFText_GetText FPDFText_GetTextIndexFromCharIndex FPDFText_GetTextObject FPDFText_GetUnicode FPDFText_HasUnicodeMapError FPDFText_IsGenerated FPDFText_IsHyphen FPDFText_LoadCidType2Font FPDFText_LoadFont FPDFText_LoadPage FPDFText_LoadStandardFont FPDFText_SetCharcodes FPDFText_SetPositions FPDFText_SetText FPDF_AddInstalledFont FPDF_CloseDocument FPDF_ClosePage FPDF_CloseXObject FPDF_CopyViewerPreferences FPDF_CountNamedDests FPDF_CreateClipPath FPDF_CreateNewDocument FPDF_DestroyClipPath FPDF_DestroyLibrary FPDF_DeviceToPage FPDF_DocumentHasValidCrossReferenceTable FPDF_FFLDraw FPDF_FreeDefaultSystemFontInfo FPDF_GetDefaultSystemFontInfo FPDF_GetDefaultTTFMap FPDF_GetDefaultTTFMapCount FPDF_GetDefaultTTFMapEntry FPDF_GetDocPermissions FPDF_GetDocUserPermissions FPDF_GetFileIdentifier FPDF_GetFileVersion FPDF_GetFormType FPDF_GetLastError FPDF_GetMetaText FPDF_GetNamedDest FPDF_GetNamedDestByName FPDF_GetPageAAction FPDF_GetPageBoundingBox FPDF_GetPageCount FPDF_GetPageHeight FPDF_GetPageHeightF FPDF_GetPageLabel FPDF_GetPageSizeByIndex FPDF_GetPageSizeByIndexF FPDF_GetPageWidth FPDF_GetPageWidthF FPDF_GetSecurityHandlerRevision FPDF_GetSignatureCount FPDF_GetSignatureObject FPDF_GetTrailerEnds FPDF_GetXFAPacketContent FPDF_GetXFAPacketCount FPDF_GetXFAPacketName FPDF_ImportNPagesToOne FPDF_ImportPages FPDF_ImportPagesByIndex FPDF_InitLibrary FPDF_InitLibraryWithConfig FPDF_LoadCustomDocument FPDF_LoadDocument FPDF_LoadMemDocument FPDF_LoadMemDocument64 FPDF_LoadPage FPDF_LoadXFA FPDF_MovePages FPDF_NewFormObjectFromXObject FPDF_NewXObjectFromPage FPDF_PageToDevice FPDF_RemoveFormFieldHighlight FPDF_RenderPage FPDF_RenderPageBitmap FPDF_RenderPageBitmapWithColorScheme_Start FPDF_RenderPageBitmapWithMatrix FPDF_RenderPageBitmap_Start FPDF_RenderPage_Close FPDF_RenderPage_Continue FPDF_SaveAsCopy FPDF_SaveWithVersion FPDF_SetFormFieldHighlightAlpha FPDF_SetFormFieldHighlightColor FPDF_SetPrintMode FPDF_SetSandBoxPolicy FPDF_SetSystemFontInfo FPDF_StructElement_Attr_CountChildren FPDF_StructElement_Attr_GetBlobValue FPDF_StructElement_Attr_GetBooleanValue FPDF_StructElement_Attr_GetChildAtIndex FPDF_StructElement_Attr_GetCount FPDF_StructElement_Attr_GetName FPDF_StructElement_Attr_GetNumberValue FPDF_StructElement_Attr_GetStringValue FPDF_StructElement_Attr_GetType FPDF_StructElement_Attr_GetValue FPDF_StructElement_CountChildren FPDF_StructElement_GetActualText FPDF_StructElement_GetAltText FPDF_StructElement_GetAttributeAtIndex FPDF_StructElement_GetAttributeCount FPDF_StructElement_GetChildAtIndex FPDF_StructElement_GetChildMarkedContentID FPDF_StructElement_GetExpansion FPDF_StructElement_GetID FPDF_StructElement_GetLang FPDF_StructElement_GetMarkedContentID FPDF_StructElement_GetMarkedContentIdAtIndex FPDF_StructElement_GetMarkedContentIdCount FPDF_StructElement_GetObjType FPDF_StructElement_GetParent FPDF_StructElement_GetStringAttribute FPDF_StructElement_GetTitle FPDF_StructElement_GetType FPDF_StructTree_Close FPDF_StructTree_CountChildren FPDF_StructTree_GetChildAtIndex FPDF_StructTree_GetForPage FPDF_VIEWERREF_GetDuplex FPDF_VIEWERREF_GetName FPDF_VIEWERREF_GetNumCopies FPDF_VIEWERREF_GetPrintPageRange FPDF_VIEWERREF_GetPrintPageRangeCount FPDF_VIEWERREF_GetPrintPageRangeElement FPDF_VIEWERREF_GetPrintScaling FSDK_SetLocaltimeFunction FSDK_SetTimeFunction FSDK_SetUnSpObjProcessHandler

Name

.text

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

313B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

512B

Virtual Size

416B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

920B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

DirectPDFEditor-Setup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/NSISdl.dll

advapi32

wsock32

user32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

shell32

generic

DirectPDFEditor.exe

bcryptprimitives

ntdll

kernel32

api-ms-win-core-synch-l1-2-0

advapi32

shell32

combase

user32

gdi32

comctl32

ole32

oleaut32

dwmapi

imm32

shlwapi

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

crypt32

ws2_32

secur32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

THIRD-PARTY-NOTICES.txt

pdfium.dll

kernel32

advapi32