PrintConfig[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

PrintConfig.dll
Size

2.4MB
MD5

0b255f75f730d522282bfc0413a5b059
SHA1

54da5ca20b80a28454f8384cdf3a4b230e199377
SHA256

9766fa952822bcf2b911a04fd4d7cb87c2ae638cb5ff68da1ae9bd0d1f926040
SHA512

03709faa492bac6a40f1e61c5d52165a0a1e444137286857f4e2c693087d1d8b87c74488e9c8211084cbdbd9e66b9ea3306f48a428c524803099cf7d899abd99
SSDEEP

49152:CBamPI+IKtUPf3P7B9KTD2BD7qgFdyhsiysMUrVJbD2+FK:WPI+IKtUn3FQTSBD7FFHiysMcv2+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PrintConfig.dll

Files

PrintConfig.dll
.dll regsvr32 windows x86

d525511057d64c17830ae0b5d6b23cb9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

localeconv
sprintf_s
memchr
_ftol2_sse
calloc
___mb_cur_max_func
__crtLCMapStringW
strerror
__uncaught_exception
isspace
tolower
_wtol
___lc_collate_cp_func
??3@YAXPAX@Z
__crtCompareStringW
memcmp
abort
_XcptFilter
_amsg_exit
_initterm
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
_except_handler4_common
vfprintf
_wmakepath_s
_wsplitpath_s
_errno
strncmp
_ftol2
wcstol
_wtoi
wcschr
strchr
realloc
wcstoul
memset
_callnewh
_CxxThrowException
setlocale
__CxxFrameHandler3
memcpy
__pctype_func
___lc_handle_func
strtod
memmove_s
wcscat_s
wcsncpy_s
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
_wcsnicmp
wcscpy_s
memcpy_s
___lc_codepage_func
fprintf
strcspn
atoi
_itow
_wcsdup
wcstok_s
wcsncmp
_stricmp
qsort
_vsnprintf
ceil
wcstod
iswspace
_ultoa
strrchr
_strnicmp
iswctype
towupper
wcsnlen
??8type_info@@QBEHABV0@@Z
?what@exception@@UBEPBDXZ
memmove
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_vsnwprintf
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
wcsrchr
wcsstr
_resetstkoflw
free
malloc
_purecall
_wcsicmp
??_V@YAXPAX@Z
ldexp
floor

kernel32

GetFinalPathNameByHandleW
MulDiv
GetTempFileNameW
HeapCreate
SetErrorMode
FindFirstFileW
FindNextFileW
FindClose
SetFilePointer
GetFileTime
GetSystemDirectoryW
LoadLibraryW
CloseHandle
GetLastError
FreeLibrary
GetProcAddress
CreateFileW
ReadFile
GetFileAttributesExW
WaitForSingleObject
GetFileSize
GetCurrentProcess
GetCurrentThread
MapViewOfFile
UnmapViewOfFile
ReleaseMutex
OpenMutexW
CreateMutexW
GetPrivateProfileStringW
RemoveDirectoryW
GetTickCount
MoveFileExW
DeleteFileW
WriteFile
SetFileInformationByHandle
CreateFileMappingW
CreateProcessW
SetEvent
GetModuleFileNameW
CreateActCtxW
ReleaseActCtx
CreateEventW
QueueUserWorkItem
HeapAlloc
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetTickCount64
MultiByteToWideChar
RaiseException
LoadResource
SizeofResource
FindResourceExW
GetModuleHandleW
LoadLibraryExW
lstrcmpiW
TerminateJobObject
CreateWaitableTimerW
WaitForMultipleObjects
GetModuleHandleExW
IsWow64Process
WideCharToMultiByte
GetSystemWindowsDirectoryW
SetWaitableTimer
LocalFree
GetVersionExW
VerSetConditionMask
VerifyVersionInfoW
GlobalSize
GlobalLock
GlobalUnlock
OpenProcess
ResetEvent
GetFileAttributesW
lstrcmpW
GetProcessId
LocalAlloc
CreateJobObjectW
AssignProcessToJobObject
ResumeThread
TerminateProcess
IsDebuggerPresent
IsProcessInJob
CompareFileTime
CreateThread
GetComputerNameW
GetCurrentThreadId
SystemTimeToTzSpecificLocalTime
OpenEventW
GetLocaleInfoW
HeapDestroy
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetStringTypeW
Sleep
EncodePointer
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
OutputDebugStringA
GetPrivateProfileIntW
GetPrivateProfileSectionW
CreateDirectoryW
FindResourceW
LockResource
CopyFileW
lstrlenW
GetSystemDefaultLCID
GetACP
GetUserDefaultUILanguage
GetFullPathNameW
GetCPInfo
VirtualFree
VirtualAlloc
GetSystemInfo

oleaut32

BSTR_UserMarshal
BSTR_UserUnmarshal
BSTR_UserFree
VariantChangeType
VariantClear
SysStringLen
SysAllocString
BSTR_UserSize
VarBstrCat
SystemTimeToVariantTime
VariantCopy
LoadRegTypeLi
SysAllocStringLen
VarBstrCmp
SysAllocStringByteLen
SysStringByteLen
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysFreeString
VariantInit

ole32

StringFromGUID2
CLSIDFromProgID
CoCreateGuid
CoUninitialize
CoInitializeEx
CoTaskMemAlloc
CoTaskMemRealloc
CoRevokeClassObject
CoRegisterClassObject
PropVariantClear
StgCreateStorageEx
StgOpenStorageEx
CoGetCallerTID
CoRevertToSelf
CoImpersonateClient
CoGetContextToken
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
GetHGlobalFromStream
CreateStreamOnHGlobal
CoSetProxyBlanket
CoGetClassObject
CoSuspendClassObjects
CoResumeClassObjects
CoCreateInstance
CoTaskMemFree

rpcrt4

CStdStubBuffer_Connect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
NdrDllUnregisterProxy
UuidToStringW
RpcStringFreeW
RpcServerInqCallAttributesW
UuidFromStringW
UuidCreate
NdrCStdStubBuffer_Release
NdrDllRegisterProxy
NdrDllCanUnloadNow
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
CStdStubBuffer_Disconnect
CStdStubBuffer_AddRef
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrStubForwardingFunction
NdrOleAllocate
CStdStubBuffer_CountRefs
NdrStubCall2
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerRelease

winspool.drv

ClosePrinter
GetPrinterDataExW
GetPrinterDataW
OpenPrinter2W
SetPrinterDataW
GetPrinterDriverDirectoryW
GetPrinterW
SetJobW
FindClosePrinterChangeNotification
FindFirstPrinterChangeNotification
EnumPrintersW
FreePrinterNotifyInfo
FindNextPrinterChangeNotification
GetPrinterDriverW
EnumJobsW
SetPrinterDataExW
OpenPrinterW
DeleteFormW
AddFormW
SetPrinterW
EnumFormsW
DeviceCapabilitiesW
DeletePrinterDataW
GetFormW

advapi32

IsWellKnownSid
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
CopySid
GetLengthSid
IsValidSid
EqualSid
InitializeAcl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
OpenProcessToken
OpenThreadToken
TraceMessage
CreateWellKnownSid
AddAccessAllowedAceEx
RegDeleteKeyW
SetThreadToken
SaferCloseLevel
SaferComputeTokenFromLevel
SaferCreateLevel
CreateProcessAsUserW
DuplicateTokenEx
CreateRestrictedToken
ConvertSidToStringSidW
RegNotifyChangeKeyValue
RegOpenKeyW
RegCreateKeyW
EventUnregister
EventRegister
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
DeleteService
OpenServiceW
ChangeServiceConfig2W
CreateServiceW
OpenSCManagerW
RegisterServiceCtrlHandlerExW
SetServiceStatus
CloseServiceHandle
RegQueryInfoKeyW
RegEnumKeyExW
EventWrite

prntvpt

ord1
ord3
ord6
ord9
ord8
ord10
ord7
ord4

user32

SetActiveWindow
GetGUIThreadInfo
GetAppCompatFlags2
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
CheckDlgButton
InvalidateRect
LoadCursorW
SetCursor
GetDlgItemTextW
SendDlgItemMessageW
WinHelpW
MessageBeep
MessageBoxW
CheckRadioButton
EndDialog
SetDlgItemTextW
SetDlgItemTextA
LoadIconW
DialogBoxParamW
UnregisterClassA
AllowSetForegroundWindow
GetWindowThreadProcessId
LoadStringW
CharNextW
GetDlgItem
PostMessageW
ShowWindow
SendMessageW
GetParent
GetWindowLongW
SetWindowLongW
GetAncestor
SetFocus
SetForegroundWindow
EnableWindow
GetFocus
GetActiveWindow
IsGUIThread
DispatchMessageW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

gdi32

SetGraphicsMode
CreateDCW
GetDeviceCaps
DeleteDC
EnumFontFamiliesW
CreateICW
ExtEscape

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock
UnloadUserProfile

Exports

Exports

DevQueryPrintEx
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
DrvConvertDevMode
DrvDeviceCapabilities
DrvDevicePropertySheets
DrvDocumentEvent
DrvDocumentPropertySheets
DrvDriverEvent
DrvPopulateFilterServices
DrvPrinterEvent
DrvQueryColorProfile
DrvQueryJobAttributes
DrvResetConfigCache
DrvSplDeviceCaps
DrvUpgradePrinter
GetStandardMessageForPrinterStatus
MxdcGetPDEVAdjustment
NotifyEntry
ServiceMain

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 290B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 3B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 870KB - Virtual size: 872KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d525511057d64c17830ae0b5d6b23cb9

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

oleaut32

ole32

rpcrt4

winspool.drv

advapi32

prntvpt

user32

version

gdi32

userenv

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.orpc Size: 512B - Virtual size: 290B

.data Size: 55KB - Virtual size: 57KB

.idata Size: 11KB - Virtual size: 10KB

.tls Size: 512B - Virtual size: 3B

.rsrc Size: 870KB - Virtual size: 872KB

.reloc Size: 87KB - Virtual size: 87KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.orpc
Size: 512B - Virtual size: 290B

.data
Size: 55KB - Virtual size: 57KB

.idata
Size: 11KB - Virtual size: 10KB

.tls
Size: 512B - Virtual size: 3B

.rsrc
Size: 870KB - Virtual size: 872KB

.reloc
Size: 87KB - Virtual size: 87KB