PrismXL[.]sys | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

PrismXL.sys
Size

536KB
MD5

60182126e751e67379d4bcdda567e0db
SHA1

1237bd00d0109ca9344e3d125ba95e467484d927
SHA256

4f54f6c3b01355e619b5299aa2a696cbd04f683f8202b96ac474bb2cc9a31370
SHA512

51397638994875159edd167c187d8c8416b1baa84770f535fa76fb69e26e865b34aa3f27db1341cbe21262c3161627aec23952ad85c41cd3c74be20b4fa84380
SSDEEP

12288:ZOljnLsgtb0NxAbF2fifoxn+K6Jfi/+QXX1:ZONLsgtb0NxY2gtK6Jfrc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PrismXL.sys

Files

PrismXL.sys
.exe windows x86

23578a8141d56e77536a185abfffdba8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

UuidFromStringA
UuidCreate
UuidToStringA
RpcStringFreeA

psapi

GetModuleFileNameExW
EnumProcessModules

kernel32

SetLastError
SetFileAttributesA
GetFullPathNameA
ReadFile
FindFirstFileA
GetFileType
CreateFileA
WritePrivateProfileStringA
MoveFileA
CloseHandle
GetFileAttributesA
FindNextFileA
DeleteFileA
FlushFileBuffers
CreateDirectoryA
GetThreadLocale
GetVersionExA
GetCurrentThreadId
GetFileTime
SetErrorMode
GetLocalTime
GetSystemTime
FileTimeToSystemTime
GetLocaleInfoW
RaiseException
QueryPerformanceCounter
EnumResourceLanguagesA
GetACP
SetConsoleCtrlHandler
InterlockedDecrement
InterlockedIncrement
lstrcmpA
ConvertDefaultLocale
GlobalDeleteAtom
lstrcmpW
GlobalFindAtomA
GlobalGetAtomNameA
TlsGetValue
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
GetCurrentDirectoryA
GetCPInfo
GetOEMCP
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
VirtualAlloc
ExitThread
CreateThread
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
RtlUnwind
ExitProcess
SetStdHandle
HeapSize
IsValidCodePage
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
GetStdHandle
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
FreeEnvironmentStringsA
GetEnvironmentStrings
SetHandleCount
GetConsoleCP
GetConsoleMode
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
GetDriveTypeA
WriteFile
FindClose
DuplicateHandle
GetComputerNameA
ResumeThread
GetLocaleInfoA
CompareStringA
GetVersion
GetEnvironmentVariableA
InterlockedExchange
lstrlenA
GlobalAlloc
GlobalReAlloc
GlobalFree
GlobalUnlock
GlobalLock
GetSystemDirectoryA
GetWindowsDirectoryA
FormatMessageA
CompareFileTime
FileTimeToLocalFileTime
SystemTimeToFileTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
LoadLibraryA
GetModuleHandleA
FreeLibrary
GetProcAddress
LocalAlloc
LocalFree
HeapFree
GetProcessHeap
HeapAlloc
CreateProcessA
UnmapViewOfFile
CreateMutexA
MapViewOfFile
CreateFileMappingA
GetCurrentProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
Sleep
GetLastError
GetExitCodeProcess
GetProcessTimes
GetTickCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetEvent
GetCurrentThread
SetThreadPriority
WaitForMultipleObjects
CreateEventA
GetCurrentProcessId
ReleaseMutex
OpenProcess
WaitForSingleObject
InterlockedCompareExchange
FindResourceExA
GlobalAddAtomA
GetModuleFileNameA
MultiByteToWideChar
FindResourceA
LoadResource
WideCharToMultiByte
LockResource
SizeofResource

user32

GetMessageTime
DestroyWindow
GetTopWindow
GetDlgItem
GetForegroundWindow
GetWindowTextA
RemovePropA
GetPropA
SetPropA
GetClassNameA
GetClassLongA
GetCapture
WinHelpA
LoadIconA
SetWindowTextA
ShowWindow
DrawTextA
DrawTextExA
GrayStringA
ClientToScreen
DestroyMenu
GetSysColorBrush
UnregisterClassA
GetMessagePos
MapWindowPoints
GetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
CopyRect
PtInRect
DefWindowProcA
CallWindowProcA
SetWindowLongA
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
GetWindow
GetLastActivePopup
GetMessageA
GetActiveWindow
GetKeyState
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuState
GetMenuItemID
GetMenuItemCount
GetWindowThreadProcessId
IsIconic
IsWindowVisible
GetCursorPos
GetSubMenu
RegisterWindowMessageA
TabbedTextOutA
GetWindowLongA
IsWindow
GetDlgCtrlID
KillTimer
SetTimer
IsWindowEnabled
PostQuitMessage
GetClientRect
GetParent
ReleaseDC
GetDC
GetSystemMetrics
SetWindowsHookExA
CallNextHookEx
UnhookWindowsHookEx
SetCursor
LoadCursorA
GetUserObjectSecurity
CloseWindowStation
CloseDesktop
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
SetUserObjectSecurity
MessageBoxA
DispatchMessageA
TranslateMessage
PeekMessageA
EnableWindow
SendMessageA
PostMessageA
SetForegroundWindow
SetWindowPos

gdi32

DeleteDC
TextOutA
GetStockObject
GetClipBox
SetTextColor
SetBkColor
SaveDC
RestoreDC
SelectObject
PtVisible
RectVisible
ExtTextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
CreateBitmap
SetMapMode
GetDeviceCaps
DeleteObject

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

shell32

ShellExecuteA

ole32

OleUninitialize
OleInitialize
CoCreateInstance
CoTaskMemFree

Sections

.text
Size: 304KB - Virtual size: 301KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 100KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

23578a8141d56e77536a185abfffdba8

Headers

File Characteristics

Imports

rpcrt4

psapi

kernel32

user32

gdi32

winspool.drv

shell32

ole32

Sections

.text Size: 304KB - Virtual size: 301KB

.rdata Size: 100KB - Virtual size: 96KB

.data Size: 20KB - Virtual size: 37KB

.rsrc Size: 108KB - Virtual size: 105KB

.text
Size: 304KB - Virtual size: 301KB

.rdata
Size: 100KB - Virtual size: 96KB

.data
Size: 20KB - Virtual size: 37KB

.rsrc
Size: 108KB - Virtual size: 105KB