window_manager_plugin[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
window_manager_plugin.dll
Size 127KB
Sample261006-2834ssgh73
SHA256 55bc0604a1c99cd5c60e752b4be9a1cb870c503d03be2c546304796ac9530329
MD5 97b391f73d95edec688da55bfc99f430
SHA1 d5dcc50af7c9a94db8e6125406e23521b261e0ee
SHA512 e0d70515bafd93514942f6f2849e64451b4498056b331fc9e931e738bebf6532eb54a85fd79ba0a7d4730fd3c520f3bc6d3b83647f702fae69e74af2db2e9f1a
SSDEEP 3072:V8CLcqRAwePnX6CQ9H0TvNP0Yozfd1ibJTuKFIG:iCgqRAweP6CQC2fd1ibJTuKFI
TLSH
T12BD34D2BF75900ABD16AD4B8CD438946DF72B8854B91A7CF07904A9B1F27BE41F3E601
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
window_manager_plugin.dll

File Explorer

window_manager_plugin.dll

.dll 127KB

window_manager_plugin.dll

IMPHASH 4509dfcb8923bea8c1260885eecaa60a
SHA256 55bc0604a1c99cd5c60e752b4be9a1cb870c503d03be2c546304796ac9530329
MD5 97b391f73d95edec688da55bfc99f430
SHA1 d5dcc50af7c9a94db8e6125406e23521b261e0ee
SHA512 e0d70515bafd93514942f6f2849e64451b4498056b331fc9e931e738bebf6532eb54a85fd79ba0a7d4730fd3c520f3bc6d3b83647f702fae69e74af2db2e9f1a
SSDEEP 3072:V8CLcqRAwePnX6CQ9H0TvNP0Yozfd1ibJTuKFIG:iCgqRAweP6CQC2fd1ibJTuKFI
TLSH
T12BD34D2BF75900ABD16AD4B8CD438946DF72B8854B91A7CF07904A9B1F27BE41F3E601
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

78044

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

flutter_windows

FlutterDesktopPluginRegistrarGetView FlutterDesktopPluginRegistrarSetDestructionHandler FlutterDesktopViewGetHWND FlutterDesktopPluginRegistrarRegisterTopLevelWindowProcDelegate FlutterDesktopRegistrarGetTextureRegistrar FlutterDesktopPluginRegistrarGetMessenger FlutterDesktopTextureRegistrarMarkExternalTextureFrameAvailable FlutterDesktopTextureRegistrarUnregisterExternalTexture FlutterDesktopTextureRegistrarRegisterExternalTexture FlutterDesktopMessengerUnlock FlutterDesktopMessengerLock FlutterDesktopMessengerIsAvailable FlutterDesktopMessengerRelease FlutterDesktopMessengerAddRef FlutterDesktopMessengerSetCallback FlutterDesktopMessengerSendResponse FlutterDesktopMessengerSendWithReply FlutterDesktopMessengerSend FlutterDesktopPluginRegistrarUnregisterTopLevelWindowProcDelegate

kernel32

IsDebuggerPresent InitializeSListHead DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive GetVersion FreeLibrary GetProcAddress LoadLibraryW SetUnhandledExceptionFilter ReleaseSRWLockExclusive

user32

PostQuitMessage PostMessageW ShowWindow GetAncestor GetMonitorInfoW MonitorFromWindow MonitorFromRect LoadImageW GetWindow FindWindowExW SetClassLongW GetClassLongW SetWindowLongPtrW SetWindowLongW GetWindowLongW GetCursorPos GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW SetForegroundWindow GetForegroundWindow TrackPopupMenu GetSystemMenu GetSystemMetrics ReleaseCapture IsZoomed IsWindowVisible GetWindowPlacement SetWindowPos ShowWindowAsync SetLayeredWindowAttributes SendMessageW

shell32

SHAppBarMessage

ole32

CoInitialize CoCreateInstance

advapi32

RegGetValueW

msvcp140

?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_function_call@std@@YAXXZ

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

vcruntime140

__std_type_info_destroy_list _CxxThrowException __std_exception_destroy __std_exception_copy __current_exception memcpy __std_terminate __C_specific_handler memcmp memmove memset __std_type_info_compare __current_exception_context

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll _cexit _invoke_watson _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initterm _initterm_e terminate _configure_narrow_argv _initialize_narrow_environment