PresentationNative_cor3[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
PresentationNative_cor3.dll
Size 1.2MB
Sample261102-thn8ysbt4w
SHA256 42e2e543c17e1b37499baf00d956433b8afb655348ec0fae89c926fb7d149b6e
MD5 bab524432d40b40f8deb7580db8953da
SHA1 023740d409524a8ebc09436d92dc154bd7c8a270
SHA512 fc87de8ddd3ccbba7491ca043e36a1d59195d2dab003920af6adaa8d2d0c147601fb6bda1cc21e4ef23046f3fca14f21f825403ad74178b38c60e64039747c47
SSDEEP 24576:5GD+42x2Jvddeoyo7Pkmn/V1Pt8clT3D4iLFxVCPL67uMFAC0q4dovzvfPbRIR9p:d2BzeoRPkmTP2clT31wPO7hACNYovznq
TLSH
T138454A62E2E642E5C47FC1B8C6469717FBB0740A131C66DB87608B592F27FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

PresentationNative_cor3.dll

.dll 1.2MB

PresentationNative_cor3.dll

IMPHASH 5de612d168dd4f3cbdf371592277147a
SHA256 42e2e543c17e1b37499baf00d956433b8afb655348ec0fae89c926fb7d149b6e
MD5 bab524432d40b40f8deb7580db8953da
SHA1 023740d409524a8ebc09436d92dc154bd7c8a270
SHA512 fc87de8ddd3ccbba7491ca043e36a1d59195d2dab003920af6adaa8d2d0c147601fb6bda1cc21e4ef23046f3fca14f21f825403ad74178b38c60e64039747c47
SSDEEP 24576:5GD+42x2Jvddeoyo7Pkmn/V1Pt8clT3D4iLFxVCPL67uMFAC0q4dovzvfPbRIR9p:d2BzeoRPkmTP2clT31wPO7hACNYovznq
TLSH
T138454A62E2E642E5C47FC1B8C6469717FBB0740A131C66DB87608B592F27FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

9f:f9:b1:79:12:91:20:4a:e0:82:a4:5e:7f:6e:80:8b:3c:55:1a:2d:d6:33:3e:cc:66:57:95:cc:60:92:90:fc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 6, 2026

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

5680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\bin\PresentationNative\x64\Release\PresentationNative_cor3.pdb

kernel32

UnhandledExceptionFilter GetCurrentThread GetCurrentProcess TerminateProcess IsProcessorFeaturePresent SetUnhandledExceptionFilter TerminateThread GetProcAddress VerSetConditionMask FreeLibrary GetProcessHeap HeapAlloc HeapFree HeapReAlloc OutputDebugStringW DeleteCriticalSection DisableThreadLibraryCalls LoadLibraryW InitializeCriticalSection InitializeCriticalSectionEx GlobalDeleteAtom DebugBreak OutputDebugStringA IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter LeaveCriticalSection EnterCriticalSection InterlockedFlushSList LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException EncodePointer SetLastError GetLastError

ntdll

DbgBreakPoint DbgPrompt DbgPrintEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlPcToFileHeader NtQuerySystemInformation

api-ms-win-crt-runtime-l1-1-0

terminate _cexit _crt_atexit abort _execute_onexit_table _initterm _initterm_e _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function

api-ms-win-crt-heap-l1-1-0

malloc free calloc

api-ms-win-crt-string-l1-1-0

iswpunct strlen strcmp wcsncmp strcpy_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

user32

SetWindowLongPtrW SetWindowLongW SetScrollPos SetFocus MapWindowPoints GetWindowTextLengthW GetWindowTextW GetWindowLongPtrW GetWindowLongW GetWindow GetParent GetMenuBarInfo GetKeyboardLayoutList GetAncestor EnableWindow FindWindowExW

gdi32

GetTextExtentPoint32W

ole32

CoTaskMemFree CoCreateInstance

oleaut32

VariantInit SysAllocString VariantChangeType VariantClear

CreateDocContext CreateInstalledObjectsInfo CreateTextAnalysisSink CreateTextAnalysisSource DestroyDocContext DestroyInstalledObjectsInfo EnableWindowWrapper FindWindowExWrapper FsAddFigureObstacle FsClearUpdateInfoInPage FsClearUpdateInfoInSubpage FsClearUpdateInfoInSubtrack FsClearUpdateInfoInTableSrv FsCommitFilledRectangle FsCompareSubpages FsCompareSubtrack FsCompareTableSrv FsCreateDocContext FsCreateDummyFootnoteRejector FsCreatePageBottomless FsCreatePageFinite FsCreateSubpageBottomless FsCreateSubpageFinite FsDestroyDocContext FsDestroyFootnoteRejector FsDestroyPage FsDestroyPageBreakRecord FsDestroySubpage FsDestroySubpageBreakRecord FsDestroySubtrack FsDestroySubtrackBreakRecord FsDestroyTableSrv FsDestroyTableSrvBreakRecord FsDuplicateGeometry FsDuplicatePageBreakRecord FsDuplicateSubpageBreakRecord FsDuplicateSubtrackBreakRecord FsDuplicateTableSrvBreakRecord FsFAllFootnotesAllowed FsFFootnoteAllowed FsFormatSubtrackBottomless FsFormatSubtrackFinite FsFormatTableSrvBottomless FsFormatTableSrvFinite FsGetClientHandle FsGetColumnRectangle FsGetEmptySpaces FsGetFigureObstacleData FsGetFloaterFsimethods FsGetIntervals FsGetMaxNumberEmptySpaces FsGetMaxNumberIntervals FsGetNextTick FsGetNumberSubpageFootnotes FsGetNumberSubtrackFootnotes FsGetPageRectangle FsGetShiftOffset FsGetSubpageColumnBalancingInfo FsGetSubpageFootnoteInfo FsGetSubtrackColumnBalancingInfo FsGetSubtrackFootnoteInfo FsGetTableObjFsimethods FsGetTableSrvColumnBalancingInfo FsGetTableSrvFootnoteInfo FsGetTableSrvNumberFootnotes FsJustifySubpage FsQueryAttachedObjectList FsQueryCompositeColumnDetails FsQueryCompositeColumnFootnoteList FsQueryDcpLineVariantsFromCachedTextPara FsQueryEndnoteColumnDetails FsQueryFigureObjectDetails FsQueryFloaterDetails FsQueryFootnoteColumnDetails FsQueryFootnoteColumnTrackList FsQueryHeightDefinedColumnSpanAreaList FsQueryLineCompositeElementList FsQueryLineListComposite FsQueryLineListSingle FsQueryPageDetails FsQueryPageFootnoteColumnList FsQueryPageSectionList FsQuerySectionBasicColumnList FsQuerySectionCompositeColumnList FsQuerySectionDetails FsQuerySectionEndnoteColumnList FsQuerySegmentDefinedColumnSpanAreaList FsQuerySubpageBasicColumnList FsQuerySubpageDetails FsQuerySubpageHeightDefinedColumnSpanAreaList FsQuerySubpageSegmentDefinedColumnSpanAreaList FsQuerySubtrackDetails FsQuerySubtrackParaList FsQueryTableObjCellList FsQueryTableObjDetails FsQueryTableObjFigureCountWord FsQueryTableObjFigureListWord FsQueryTableObjRowDetails FsQueryTableObjRowList FsQueryTableObjTableProperDetails FsQueryTableSrvCellList FsQueryTableSrvRowDetails FsQueryTableSrvRowList FsQueryTableSrvTableDetails FsQueryTextDetails FsQueryTrackDetails FsQueryTrackParaList FsRegisterFloatObstacle FsReleaseGeometry FsResolveOverlap FsRestoreGeometry FsShiftSubtrackVertical FsSynchronizeBottomlessSubtrack FsTransferDisplayInfoSubpage FsTransferDisplayInfoSubtrack FsTransferDisplayInfoTableSrv FsTransformBbox FsTransformPoint FsTransformRectangle FsTransformVector FsUpdateBottomlessPage FsUpdateBottomlessSubpage FsUpdateBottomlessSubtrack FsUpdateBottomlessTableSrv FsUpdateFinitePage GetAncestorWrapper GetFloaterHandlerInfo GetKeyboardLayoutListWrapper GetMenuBarInfoWrapper GetNumberSubstitutionList GetParentWrapper GetScriptAnalysisList GetTableObjHandlerInfo GetTextExtentPoint32Wrapper GetWindowLongPtrWrapper GetWindowLongWrapper GetWindowTextLengthWrapper GetWindowTextWrapper GetWindowWrapper GlobalDeleteAtomWrapper IsPrintPackageTargetSupported IsStartXpsPrintJobSupported IsWindows10OrGreater IsWindows10RS1OrGreater IsWindows10RS2OrGreater IsWindows10RS3OrGreater IsWindows10RS4OrGreater IsWindows10RS5OrGreater IsWindows10TH1OrGreater IsWindows10TH2OrGreater IsWindows7OrGreater IsWindows7SP1OrGreater IsWindows8OrGreater IsWindows8Point1OrGreater IsWindowsServer IsWindowsVistaOrGreater IsWindowsVistaSP1OrGreater IsWindowsVistaSP2OrGreater IsWindowsXPOrGreater IsWindowsXPSP1OrGreater IsWindowsXPSP2OrGreater IsWindowsXPSP3OrGreater LateBoundStartXpsPrintJob LoAcquireBreakRecord LoAcquirePenaltyModule LoCloneBreakRecord LoCreateBreaks LoCreateContext LoCreateLine LoCreateParaBreakingSession LoDestroyContext LoDisplayLine LoDisposeBreakRecord LoDisposeLine LoDisposeParaBreakingSession LoDisposePenaltyModule LoEnumLine LoGetEscString LoGetPenaltyModuleInternalHandle LoQueryLineCpPpoint LoQueryLinePointPcp LoRelievePenaltyResource LoSetBreaking LoSetDoc LoSetTabs LocbkGetObjectHandlerInfo LsDisableSpecialCharacterLigature MILGetClassificationTables MapWindowPointsWrapper NlCreateHyphenator NlDestroyHyphenator NlGetClassObject NlHyphenate NlLoad NlUnload PrintToPackageTarget SetFocusWrapper SetScrollPosWrapper SetWindowLongPtrWrapper SetWindowLongWrapper