PMHODFLG[.]DLL | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PMHODFLG.DLL
Size 28KB
Sample261023-amn9zavwf1
SHA256 ee7fce9960f933eb8c428300437e3a79365cf8dd0a68e6df5358148017ef3fdc
MD5 16610eea3a82800bb720244d59654856
SHA1 139a72ac5aec2bdc27a09d128abf1fd607bc83f7
SHA512 128033f935b33d125cf2180f18aeb71685ab815cbdd0f30ce9fcb5d3ebfd4d41e35dc60f2c6310a2fb303e53a0a4970fdeeebc62252c1f8a8843b0601ea6cfd7
SSDEEP 384:kch5w0slaEJfYMOwWFjjiIO1jWiCaWz/zB//0GftpBjDFH3HRN7V80lzThwJa:k8K8J8iVFHVLTKJa
TLSH
T16CD2079247BCD413EA926D7239B4FD837E3AF3D348E45A1A1029E1992CA73D55F10E2C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

PMHODFLG.DLL

.dll 28KB

PMHODFLG.DLL

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ee7fce9960f933eb8c428300437e3a79365cf8dd0a68e6df5358148017ef3fdc
MD5 16610eea3a82800bb720244d59654856
SHA1 139a72ac5aec2bdc27a09d128abf1fd607bc83f7
SHA512 128033f935b33d125cf2180f18aeb71685ab815cbdd0f30ce9fcb5d3ebfd4d41e35dc60f2c6310a2fb303e53a0a4970fdeeebc62252c1f8a8843b0601ea6cfd7
SSDEEP 384:kch5w0slaEJfYMOwWFjjiIO1jWiCaWz/zB//0GftpBjDFH3HRN7V80lzThwJa:k8K8J8iVFHVLTKJa
TLSH
T16CD2079247BCD413EA926D7239B4FD837E3AF3D348E45A1A1029E1992CA73D55F10E2C
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

36:19:86:09:24:19:71:d4:f4:2c:25:f6:7f:02:1f:32:9a:16:d0:9c:57:79:27:9e:e5:fa:00:1d:23:4f:02:64

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 21, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

8a:8a:52:71:60:1a:f1:7a:b0:1e:2d:ea:0a:2d:77:44:a2:7a:e2:68

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 21, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:4c:a1:e8:4d:cc:b4:74:7b:3b:00:00:00:00:00:4c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 11, 2013 - Feb 11, 2015

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 24, 2013 - Apr 24, 2014

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 24, 2013 - Dec 24, 2014

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:29:97:4e:7c:82:cb:20:16:41:00:00:00:00:00:29

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 27, 2013 - Jun 27, 2014

Minor OS version

Major OS version

Entry point

18846

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.SqlServer.SqlClrProvider.pdb

PMHODFLG.DLL

PE Signature issue

mscoree

dotnet