file[.]0xb30d8d3363d0[.]0xb30d8d1b3870[.]DataSectionObject[.]spoolsv[.]exe[.]dat

Sharing

Copy URL

Twitter E-mail

General

Target

file.0xb30d8d3363d0.0xb30d8d1b3870.DataSectionObject.spoolsv.exe.dat
Size

784KB
MD5

2f75e4b3d7f6c15398a0b46fe5e4b178
SHA1

79017071730a80fb8494249b112da0deded7d12e
SHA256

3ef129630b9e794702119841f5ad1623b5963ecdf7af134a8db3afa432790c75
SHA512

cc2c4e936593d2b2308b196a7bd2aeeadac8b8cb4255b3c7927e3d32d67a8dde9c6d4ad3d93e1ffe5f837a9179e07f1784e7587b271044122b8cd23d2b2659bd
SSDEEP

24576:439yIEspoWm5bezm3G20JPshqDVXuV/W5RVM4ADCFfQu8WODK:4tqsvm5ezm3G20JPshqDVXuV/WXVMGFP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.0xb30d8d3363d0.0xb30d8d1b3870.DataSectionObject.spoolsv.exe.dat

Files

file.0xb30d8d3363d0.0xb30d8d1b3870.DataSectionObject.spoolsv.exe.dat
.exe windows:10 windows x64 arch:x64

ed8e7633a3f95d39af4f54d59824e481

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

UnregisterPowerSettingNotification
SendNotifyMessageW
DispatchMessageW
TranslateMessage
RegisterPowerSettingNotification
MsgWaitForMultipleObjects
PeekMessageW
RegisterDeviceNotificationW
UnregisterDeviceNotification

msvcrt

__getmainargs
__set_app_type
exit
_exit
_cexit
__setusermatherr
_initterm
_fmode
_XcptFilter
free
_callnewh
malloc
_stricmp
__C_specific_handler
memmove_s
_purecall
_commode
_lock
memcpy_s
_vsnwprintf
_unlock
__dllonexit
_onexit
?terminate@@YAXXZ
memmove
memcpy
memcmp
_amsg_exit
towupper
towlower
wcschr
swprintf_s
_wcsnicmp
__CxxFrameHandler3
_strnicmp
wcsstr
_wcsicmp
memset

ntdll

NtSetInformationThread
RtlIsThreadWithinLoaderCallout
NtOpenThreadToken
NtClose
NtOpenProcessToken
RtlFreeHeap
RtlInitUnicodeString
NtSetInformationToken
RtlAllocateHeap
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExW
EtwEventWrite
EtwEventEnabled
RtlReportException
TpAllocPool
RtlIpv4AddressToStringW
TpReleaseAlpcCompletion
TpWaitForAlpcCompletion
TpReleaseIoCompletion
TpWaitForIoCompletion
TpReleaseTimer
TpWaitForTimer
TpReleaseWait
TpWaitForWait
TpReleaseWork
TpWaitForWork
TpAllocAlpcCompletion
TpStartAsyncIoOperation
TpAllocIoCompletion
TpSetTimer
TpAllocTimer
TpAllocWait
TpPostWork
TpAllocWork
RtlNtStatusToDosError
TpSimpleTryPost
TpSetWait
TpCallbackMayRunLong
TpReleasePool
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WinSqmIsOptedIn
WinSqmSetDWORD
WinSqmAddToStreamEx
WinSqmIncrementDWORD
RtlValidRelativeSecurityDescriptor
EtwEventWriteTransfer
NtQuerySystemInformation
EtwEventRegister
EtwEventUnregister
EtwUnregisterTraceGuids
EtwEventSetInformation
EtwGetTraceEnableFlags
EtwTraceMessage
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
RtlIpv6AddressToStringW

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockShared
ReleaseMutex
InitializeCriticalSectionEx
ReleaseSemaphore
OpenEventW
CreateSemaphoreExW
ReleaseSRWLockExclusive
CreateMutexW
AcquireSRWLockExclusive
CreateMutexExW
SetEvent
CreateEventW
AcquireSRWLockShared
DeleteCriticalSection
WaitForSingleObject
LeaveCriticalSection
OpenSemaphoreW
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
InitializeCriticalSection
EnterCriticalSection

api-ms-win-core-processthreads-l1-1-0

SetPriorityClass
CreateThread
ExitProcess
GetCurrentThread
TlsAlloc
GetCurrentProcessId
GetCurrentThreadId
TlsFree
TlsGetValue
GetCurrentProcess
SetThreadToken
ExitThread
OpenThreadToken
TlsSetValue
OpenProcessToken
CreateProcessAsUserW
TerminateProcess

api-ms-win-core-processthreads-l1-1-1

OpenProcess
SetProcessMitigationPolicy

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
GetLastError
GetErrorMode
SetErrorMode
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegGetValueW
RegOpenKeyExW
RegGetKeySecurity
RegQueryInfoKeyW
RegOpenCurrentUser
RegCreateKeyExW
RegDisablePredefinedCacheEx
RegSetKeySecurity
RegSetValueExW
RegDeleteValueW
RegCloseKey
RegDeleteKeyExW
RegDeleteTreeW
RegEnumKeyExW
RegEnumValueW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemTime
GetSystemWindowsDirectoryW
GetTickCount
GetVersionExW

api-ms-win-core-synch-l1-2-0

Sleep
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapCreate
HeapFree
HeapDestroy
GetProcessHeap
HeapSetInformation

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus
StartServiceCtrlDispatcherW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

rpcrt4

I_RpcExceptionFilter
RpcServerTestCancel
RpcAsyncAbortCall
RpcSsContextLockExclusive
RpcServerInterfaceGroupDeactivate
RpcBindingToStringBindingW
RpcSmDestroyClientContext
RpcStringBindingParseW
RpcObjectSetType
RpcBindingVectorFree
RpcBindingFree
I_RpcBindingIsClientLocal
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW
RpcServerInterfaceGroupActivate
RpcServerSubscribeForNotification
RpcServerInqBindings
RpcServerRegisterIf
RpcServerRegisterIf2
RpcServerInterfaceGroupCreateW
I_RpcBindingInqTransportType
RpcServerRegisterAuthInfoW
I_RpcSessionStrictContextHandle
RpcServerInqDefaultPrincNameW
RpcServerUnsubscribeForNotification
RpcAsyncCompleteCall
RpcRevertToSelfEx
RpcRaiseException
NdrServerCall2
Ndr64AsyncServerCallAll
NdrServerCallAll
NdrAsyncServerCall
NdrClientCall3
Ndr64AsyncClientCall
RpcEpRegisterW
RpcStringFreeW
RpcBindingServerFromClient
RpcBindingInqAuthClientW
RpcMgmtSetServerStackSize
RpcRevertToSelf
RpcServerInqBindingHandle
RpcServerInqCallAttributesW
RpcImpersonateClient
RpcBindingFromStringBindingW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-security-base-l1-1-0

GetTokenInformation
GetAclInformation
FreeSid
SetSecurityDescriptorDacl
AddAccessDeniedAceEx
GetSidSubAuthorityCount
IsWellKnownSid
AddAce
InitializeSecurityDescriptor
InitializeAcl
AddAccessAllowedAceEx
SetTokenInformation
GetLengthSid
CopySid
CreateWellKnownSid
DuplicateTokenEx
EqualSid
CheckTokenMembership
GetSecurityDescriptorDacl
ImpersonateLoggedOnUser
RevertToSelf
GetAce
GetSidSubAuthority
DuplicateToken
AllocateAndInitializeSid

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

kernelbase

GetIsEdpEnabled
lstrcmpiW
LocalAlloc

kernel32

FreeLibrary
GetComputerNameW
GetTickCount64
ResetEvent
LoadLibraryExW
AddVectoredExceptionHandler

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringW

api-ms-win-core-file-l1-1-0

GetTempFileNameW
CreateFileW
ReadFile
DeleteFileW

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

dsrole

DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW
RegDeleteKeyValueW

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler

dnsapi

DnsQuery_W
DnsFree

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

bcrypt

BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptDestroyHash
BCryptCloseAlgorithmProvider

Exports

Exports

GetSpoolerTlsIndexes
PrvAbortPrinter
PrvAddFormW
PrvAddJobW
PrvAddMonitorW
PrvAddPerMachineConnectionW
PrvAddPortExW
PrvAddPortW
PrvAddPrintProcessorW
PrvAddPrintProvidorW
PrvAddPrinterConnectionW
PrvAddPrinterDriverExW
PrvAddPrinterDriverW
PrvAddPrinterExW
PrvAddPrinterW
PrvAdjustPointers
PrvAdjustPointersInStructuresArray
PrvAlignKMPtr
PrvAlignRpcPtr
PrvAllocSplStr
PrvAllowRemoteCalls
PrvAppendPrinterNotifyInfoData
PrvBuildOtherNamesFromMachineName
PrvCacheAddName
PrvCacheCreateAndAddNode
PrvCacheCreateAndAddNodeWithIPAddresses
PrvCacheDeleteNode
PrvCacheIsNameCluster
PrvCacheIsNameInNodeList
PrvCallDrvDevModeConversion
PrvCallRouterFindFirstPrinterChangeNotification
PrvCheckLocalCall
PrvClosePrinter
PrvConfigurePortW
PrvCreatePrinterIC
PrvDeleteFormW
PrvDeleteJobNamedProperty
PrvDeleteMonitorW
PrvDeletePerMachineConnectionW
PrvDeletePortW
PrvDeletePrintProcessorW
PrvDeletePrintProvidorW
PrvDeletePrinter
PrvDeletePrinterConnectionW
PrvDeletePrinterDataExW
PrvDeletePrinterDataW
PrvDeletePrinterDriverExW
PrvDeletePrinterDriverW
PrvDeletePrinterIC
PrvDeletePrinterKeyW
PrvDllAllocSplMem
PrvDllAllocSplStr
PrvDllFreeSplMem
PrvDllFreeSplStr
PrvDllReallocSplMem
PrvDllReallocSplStr
PrvEndDocPrinter
PrvEndPagePrinter
PrvEnumFormsW
PrvEnumJobsW
PrvEnumMonitorsW
PrvEnumPerMachineConnectionsW
PrvEnumPortsW
PrvEnumPrintProcessorDatatypesW
PrvEnumPrintProcessorsW
PrvEnumPrinterDataExW
PrvEnumPrinterDataW
PrvEnumPrinterDriversW
PrvEnumPrinterKeyW
PrvEnumPrintersW
PrvFindClosePrinterChangeNotification
PrvFlushPrinter
PrvFormatPrinterForRegistryKey
PrvFormatRegistryKeyForPrinter
PrvFreeOtherNames
PrvFreePrintPropertyValue
PrvGetFormW
PrvGetJobAttributes
PrvGetJobAttributesEx
PrvGetJobNamedPropertyValue
PrvGetJobW
PrvGetNetworkId
PrvGetPrintProcessorDirectoryW
PrvGetPrinterDataExW
PrvGetPrinterDataW
PrvGetPrinterDriverDirectoryW
PrvGetPrinterDriverExW
PrvGetPrinterDriverW
PrvGetPrinterW
PrvGetServerPolicy
PrvGetShrinkedSize
PrvGetSpoolerTlsIndexes
PrvImpersonatePrinterClient
PrvInitializeRouter
PrvIsNameTheLocalMachineOrAClusterSpooler
PrvIsNamedPipeRpcCall
PrvMIDL_user_allocate
PrvMIDL_user_allocate1
PrvMIDL_user_free
PrvMIDL_user_free1
PrvMarshallDownStructure
PrvMarshallDownStructuresArray
PrvMarshallUpStructure
PrvMarshallUpStructuresArray
PrvOldGetPrinterDriverW
PrvOpenPrinter2W
PrvOpenPrinterExW
PrvOpenPrinterPort2W
PrvOpenPrinterW
PrvPackStrings
PrvPartialReplyPrinterChangeNotification
PrvPlayGdiScriptOnPrinterIC
PrvPrinterHandleRundown
PrvPrinterMessageBoxW
PrvProvidorFindClosePrinterChangeNotification
PrvProvidorFindFirstPrinterChangeNotification
PrvReadPrinter
PrvReallocSplMem
PrvReallocSplStr
PrvRemoteFindFirstPrinterChangeNotification
PrvReplyClosePrinter
PrvReplyOpenPrinter
PrvReplyPrinterChangeNotification
PrvReplyPrinterChangeNotificationEx
PrvReportJobProcessingProgress
PrvResetPrinterW
PrvRevertToPrinterSelf
PrvRouterAddPrinterConnection2
PrvRouterAllocBidiMem
PrvRouterAllocBidiResponseContainer
PrvRouterAllocPrinterNotifyInfo
PrvRouterBroadcastMessage
PrvRouterCorePrinterDriverInstalled
PrvRouterCreatePrintAsyncNotificationChannel
PrvRouterDeletePrinterDriverPackage
PrvRouterFindCompatibleDriver
PrvRouterFindFirstPrinterChangeNotification
PrvRouterFindNextPrinterChangeNotification
PrvRouterFreeBidiMem
PrvRouterFreeBidiResponseContainer
PrvRouterFreePrinterNotifyInfo
PrvRouterGetCorePrinterDrivers
PrvRouterGetPrintClassObject
PrvRouterGetPrinterDriverPackagePath
PrvRouterInstallPrinterDriverFromPackage
PrvRouterInstallPrinterDriverPackageFromConnection
PrvRouterInternalGetPrinterDriver
PrvRouterRefreshPrinterChangeNotification
PrvRouterRegisterForPrintAsyncNotifications
PrvRouterReplyPrinter
PrvRouterSpoolerSetPolicy
PrvRouterUnregisterForPrintAsyncNotifications
PrvRouterUploadPrinterDriverPackage
PrvScheduleJob
PrvSeekPrinter
PrvSendRecvBidiData
PrvSetFormW
PrvSetJobW
PrvSetPortW
PrvSetPrinterDataExW
PrvSetPrinterDataW
PrvSetPrinterW
PrvSplCloseSpoolFileHandle
PrvSplCommitSpoolData
PrvSplDriverUnloadComplete
PrvSplGetClientUserHandle
PrvSplGetSpoolFileInfo
PrvSplGetUserSidStringFromToken
PrvSplInitializeWinSpoolDrv
PrvSplIsSessionZero
PrvSplIsUpgrade
PrvSplProcessPnPEvent
PrvSplProcessSessionEvent
PrvSplPromptUIInUsersSession
PrvSplQueryUserInfo
PrvSplReadPrinter
PrvSplRegisterForDeviceEvents
PrvSplRegisterForSessionEvents
PrvSplShutDownRouter
PrvSplUnregisterForDeviceEvents
PrvSplUnregisterForSessionEvents
PrvSpoolerFindClosePrinterChangeNotification
PrvSpoolerFindFirstPrinterChangeNotification
PrvSpoolerFindNextPrinterChangeNotification
PrvSpoolerFreePrinterNotifyInfo
PrvSpoolerHasInitialized
PrvSpoolerInit
PrvSpoolerRefreshPrinterChangeNotification
PrvStartDocPrinterW
PrvStartPagePrinter
PrvUndoAlignKMPtr
PrvUndoAlignRpcPtr
PrvUpdateBufferSize
PrvUpdatePrinterRegAll
PrvUpdatePrinterRegAllEx
PrvUpdatePrinterRegUser
PrvWaitForPrinterChange
PrvWaitForSpoolerInitialization
PrvWritePrinter
PrvXcvDataW
PrvbGetDevModePerUser
PrvbSetDevModePerUser
RouterLogJobInfoForBranchOffice
ServerGetPrintClassObject
SplUalCollectData
YAbortPrinter
YAddJob
YDriverUnloadComplete
YEndDocPrinter
YEndPagePrinter
YFlushPrinter
YGetPrinter
YGetPrinterDriver2
YGetPrinterDriverDirectory
YReadPrinter
YSeekPrinter
YSetJob
YSetPort
YSetPrinter
YSplReadPrinter
YStartDocPrinter
YStartPagePrinter
YWritePrinter

Sections

.text
Size: 460KB - Virtual size: 460KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 224KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ed8e7633a3f95d39af4f54d59824e481

Headers

DLL Characteristics

File Characteristics

Imports

user32

msvcrt

ntdll

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-debug-l1-1-0

rpcrt4

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-profile-l1-1-0

kernelbase

kernel32

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-libraryloader-l1-2-1

dsrole

api-ms-win-core-registry-l1-1-1

api-ms-win-core-console-l1-1-0

dnsapi

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-delayload-l1-1-1

bcrypt

Exports

Exports

Sections

.text Size: 460KB - Virtual size: 460KB

.rdata Size: 224KB - Virtual size: 223KB

.data Size: 3KB - Virtual size: 10KB

.pdata Size: 25KB - Virtual size: 24KB

.didat Size: 512B - Virtual size: 384B

.rsrc Size: 57KB - Virtual size: 56KB

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 460KB - Virtual size: 460KB

.rdata
Size: 224KB - Virtual size: 223KB

.data
Size: 3KB - Virtual size: 10KB

.pdata
Size: 25KB - Virtual size: 24KB

.didat
Size: 512B - Virtual size: 384B

.rsrc
Size: 57KB - Virtual size: 56KB

.reloc
Size: 10KB - Virtual size: 10KB