Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3gs10020w64.exe
windows11-21h2-x64
7$PLUGINSDIR/EnVar.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3doc/GS9_Co...nt.pdf
windows11-21h2-x64
1doc/Ghostscript.pdf
windows11-21h2-x64
1doc/News.html
windows11-21h2-x64
1doc/colorm...e1.pdf
windows11-21h2-x64
1doc/colorm...or.pdf
windows11-21h2-x64
1doc/colorm...re.pdf
windows11-21h2-x64
1doc/colorm...nt.pdf
windows11-21h2-x64
1doc/colorm...le.pdf
windows11-21h2-x64
1doc/colorm...S6.pdf
windows11-21h2-x64
1doc/colorm...nk.pdf
windows11-21h2-x64
1doc/colorm...nt.pdf
windows11-21h2-x64
1doc/colorm...le.pdf
windows11-21h2-x64
1doc/colorm...gb.pdf
windows11-21h2-x64
1doc/index.htm
windows11-21h2-x64
1doc/pclxps...dl.pdf
windows11-21h2-x64
1doc/src/Gh...nt.vbs
windows11-21h2-x64
1doc/src/Install.vbs
windows11-21h2-x64
1doc/src/La...on.vbs
windows11-21h2-x64
1doc/src/Use.pdf
windows11-21h2-x64
1doc/src/conf.py
windows11-21h2-x64
3doc/src/footer.js
windows11-21h2-x64
1doc/src/header.js
windows11-21h2-x64
1examples/annots.pdf
windows11-21h2-x64
1examples/spots2.pdf
windows11-21h2-x64
1examples/t...gb.pdf
windows11-21h2-x64
1examples/t...ge.pdf
windows11-21h2-x64
1lib/afmdiff.awk
windows11-21h2-x64
3lib/dvipdf
windows11-21h2-x64
1Analysis
-
max time kernel
86s -
max time network
98s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
01/02/2024, 15:22
Behavioral task
behavioral1
Sample
gs10020w64.exe
Resource
win11-20231215-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/EnVar.dll
Resource
win11-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win11-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20231215-en
Behavioral task
behavioral5
Sample
doc/GS9_Color_Management.pdf
Resource
win11-20231215-en
Behavioral task
behavioral6
Sample
doc/Ghostscript.pdf
Resource
win11-20231222-en
Behavioral task
behavioral7
Sample
doc/News.html
Resource
win11-20231215-en
Behavioral task
behavioral8
Sample
doc/colormanage/figures/DeviceN_Figure1.pdf
Resource
win11-20231215-en
Behavioral task
behavioral9
Sample
doc/colormanage/figures/Object_Color.pdf
Resource
win11-20231222-en
Behavioral task
behavioral10
Sample
doc/colormanage/figures/architecture.pdf
Resource
win11-20231215-en
Behavioral task
behavioral11
Sample
doc/colormanage/figures/des_profile_intent.pdf
Resource
win11-20231215-en
Behavioral task
behavioral12
Sample
doc/colormanage/figures/destination_profile.pdf
Resource
win11-20231215-en
Behavioral task
behavioral13
Sample
doc/colormanage/figures/ghostscriptR_stack_RGBclr_CS6.pdf
Resource
win11-20231215-en
Behavioral task
behavioral14
Sample
doc/colormanage/figures/proof_link.pdf
Resource
win11-20231215-en
Behavioral task
behavioral15
Sample
doc/colormanage/figures/source_intent.pdf
Resource
win11-20231215-en
Behavioral task
behavioral16
Sample
doc/colormanage/figures/source_profile.pdf
Resource
win11-20231215-en
Behavioral task
behavioral17
Sample
doc/colormanage/figures/text_graph_image_cmyk_rgb.pdf
Resource
win11-20231215-en
Behavioral task
behavioral18
Sample
doc/index.htm
Resource
win11-20231215-en
Behavioral task
behavioral19
Sample
doc/pclxps/ghostpdl.pdf
Resource
win11-20231215-en
Behavioral task
behavioral20
Sample
doc/src/GhostscriptColorManagement.vbs
Resource
win11-20231215-en
Behavioral task
behavioral21
Sample
doc/src/Install.vbs
Resource
win11-20231222-en
Behavioral task
behavioral22
Sample
doc/src/LanguageBindingsPython.vbs
Resource
win11-20231222-en
Behavioral task
behavioral23
Sample
doc/src/Use.pdf
Resource
win11-20231215-en
Behavioral task
behavioral24
Sample
doc/src/conf.py
Resource
win11-20231215-en
Behavioral task
behavioral25
Sample
doc/src/footer.js
Resource
win11-20231215-en
Behavioral task
behavioral26
Sample
doc/src/header.js
Resource
win11-20231215-en
Behavioral task
behavioral27
Sample
examples/annots.pdf
Resource
win11-20231215-en
Behavioral task
behavioral28
Sample
examples/spots2.pdf
Resource
win11-20231215-en
Behavioral task
behavioral29
Sample
examples/text_graph_image_cmyk_rgb.pdf
Resource
win11-20231215-en
Behavioral task
behavioral30
Sample
examples/text_graphic_image.pdf
Resource
win11-20231222-en
Behavioral task
behavioral31
Sample
lib/afmdiff.awk
Resource
win11-20231215-en
Behavioral task
behavioral32
Sample
lib/dvipdf
Resource
win11-20231215-en
General
-
Target
$PLUGINSDIR/EnVar.dll
-
Size
10KB
-
MD5
4ee6c0578960bcb5dad78947e0cbffe9
-
SHA1
dd90488ffde0b0df76e0a5e8dca8192c77619d8b
-
SHA256
eb182d049ba19f697628e20228af329780aaf62c3585a1e36b9fb988911fe697
-
SHA512
0592166761c32aa804a26fb90191f636173b6e5144e4c10b100841fcb4d05cc30d8ffc3716e823d02dd3bcc73cfb9106639cf8ae2aeeba409213f2f40df5932c
-
SSDEEP
192:hjD5Bzu8mRd7ylc01dOF6Nr4mNiFHFEH3HGH8t+zaY6GVIb6:V9BXI4cqxCa+WFAzUeC6
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1900 3040 WerFault.exe 76 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1428 wrote to memory of 3040 1428 rundll32.exe 76 PID 1428 wrote to memory of 3040 1428 rundll32.exe 76 PID 1428 wrote to memory of 3040 1428 rundll32.exe 76
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\EnVar.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\EnVar.dll,#12⤵PID:3040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 4683⤵
- Program crash
PID:1900
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3040 -ip 30401⤵PID:5080