General

  • Target

    gs10020w64.exe

  • Size

    61.7MB

  • MD5

    5acc156bb25ec222aa328b4ee2795d23

  • SHA1

    0d7d22dde3110f65daf479e2c369907d51f15abb

  • SHA256

    a794ac78882a744b97acebed7a6a76ac8b3cfdef9d38bd891aa262081e303d52

  • SHA512

    25012e5f217ab4c3055932c8f55916ed2ab47a1da351461049365f3290d4b924c3b00ecbd97fef26956a89524562110b3d0cc24d86b64a52e874358b9bfcebbb

  • SSDEEP

    1572864:LxGsyJtoUaahN5YImcXbpZHfzYvN074A8A0:LxhAaahAcXn7S0kAV0

Score
3/10

Malware Config

Signatures

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • gs10020w64.exe
    .exe windows:4 windows x86 arch:x86

    4ea4df5d94204fc550be1874e1b77ea7


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/EnVar.dll
    .dll windows:5 windows x86 arch:x86

    7a358eff6eca345b20696b23815b7f73


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    e2ee55bddad4241d619d6a8a38e2d869


    Headers

    Imports

    Exports

    Sections

  • doc/COPYING
  • doc/GS9_Color_Management.pdf
    .pdf
    • http://USAwww.artifex.com

    • http://ArtifexSoftwareInc.www.artifex.com

    • http://034le.int

    • http://034le.gs

    • http://050gsicc_link_t.procs.map

    • http://050gs-icc_link_t.procs.map

    • http://www.color.org/ICC1v42_2006-05.pdf

    • http://partners.adobe.com/public/developer/ps/index_specs.html

    • http://www.adobe.com/devnet/pdf/pdf_reference.html

    • Show all
  • doc/Ghostscript.pdf
    .pdf
    • http://www.ghostscript.com/download

    • http://www.gnu.org/licenses/agpl-3.0.html

    • https://artifex.com/licensing/commercial/

    • https://artifex.com

    • https://en.wikipedia.org/wiki/Aladdin_Free_Public_License

    • https://bugs.ghostscript.com

    • https://github.com/ArtifexSoftware/ghostpdl/blob/master/doc/COPYING

    • http://www.ghostscript.com/

    • https://discord.gg/TSpYGBW4eq

    • Show all
  • doc/HowToBuildTheDocs.txt
  • doc/News.html
  • doc/colormanage/GS9_Color_Management.tex
  • doc/colormanage/figures/DeviceN_Figure1.pdf
    .pdf
  • doc/colormanage/figures/Object_Color.pdf
    .pdf
  • doc/colormanage/figures/architecture.pdf
    .pdf
  • doc/colormanage/figures/des_profile_intent.pdf
    .pdf
  • doc/colormanage/figures/destination_profile.pdf
    .pdf
  • doc/colormanage/figures/ghostscriptR_stack_RGBclr_CS6.pdf
    .pdf
  • doc/colormanage/figures/proof_link.pdf
    .pdf
  • doc/colormanage/figures/source_intent.pdf
    .pdf
  • doc/colormanage/figures/source_profile.pdf
    .pdf
  • doc/colormanage/figures/text_graph_image_cmyk_rgb.pdf
    .pdf
  • doc/index.htm
    .html
  • doc/language-bindings/images/export-jar.png
    .png
  • doc/language-bindings/images/ghostnet-wpf-example.png
    .png
  • doc/language-bindings/images/gsviewer.png
    .png
  • doc/language-bindings/images/linking-jar.png
    .png
  • doc/pclxps/Makefile
  • doc/pclxps/README
  • doc/pclxps/ghostpdl.pdf
    .pdf
  • doc/pclxps/ghostpdl.tex
  • doc/pclxps/ghostpdl.txt
  • doc/src/API.rst
  • doc/src/C-style.rst
  • doc/src/Develop.rst
  • doc/src/DeviceSubclassing.rst
  • doc/src/Devices.rst
  • doc/src/Drivers.rst
  • doc/src/Fonts.rst
  • doc/src/GPDL.rst
  • doc/src/Ghostscript-Enterprise.rst
  • doc/src/GhostscriptColorManagement.rst
    .vbs
  • doc/src/Install.rst
    .vbs
  • doc/src/Language.rst
  • doc/src/LanguageBindings.rst
  • doc/src/LanguageBindingsCSharp.rst
  • doc/src/LanguageBindingsJava.rst
  • doc/src/LanguageBindingsPython.rst
    .vbs
  • doc/src/Lib.rst
  • doc/src/Make.rst
  • doc/src/News.rst
  • doc/src/Ps-style.rst
  • doc/src/Ps2epsi.rst
  • doc/src/Psfiles.rst
  • doc/src/Readme.rst
  • doc/src/ReleaseDates.rst
  • doc/src/SampleDownscaleDevice.rst
  • doc/src/SavedPages.rst
  • doc/src/Source.rst
  • doc/src/Unix-lpr.rst
  • doc/src/UnsupportedDevices.rst
  • doc/src/Use.rst
    .pdf
  • doc/src/VectorDevices.rst
  • doc/src/_static/cm-fig1.png
    .png
  • doc/src/_static/cm-fig2.png
    .png
  • doc/src/_static/cm-fig3.png
    .png
  • doc/src/_static/cm-fig4.png
    .png
  • doc/src/_static/cm-fig5.png
    .png
  • doc/src/_static/cm-fig6.png
    .png
  • doc/src/_static/cm-fig7.png
    .png
  • doc/src/_static/custom.css
  • doc/src/_static/export-jar.png
    .png
  • doc/src/_static/favicon.ico
  • doc/src/_static/ghostnet-wpf-example.png
    .png
  • doc/src/_static/ghostscript-white-plus-text.png
    .png
  • doc/src/_static/gsviewer.png
    .png
  • doc/src/_static/linking-jar.png
    .png
  • doc/src/conf.py
  • doc/src/footer.rst
    .js
  • doc/src/header.rst
    .js
  • doc/src/images/discord-mark-blue.svg
  • doc/src/images/ghostscript-logo.png
    .png
  • doc/src/images/icon-docx.svg
    .xml
  • doc/src/images/icon-odt.svg
  • doc/src/images/icon-pptx.svg
    .xml
  • doc/src/images/icon-txt.svg
  • doc/src/images/icon-xlsx.svg
    .xml
  • doc/src/index.rst
  • doc/src/requirements.txt
  • doc/src/thirdparty.rst
  • doc/src/toc.rst
  • examples/alphabet.ps
  • examples/annots.pdf
    .pdf
  • examples/cjk/all_ac1.ps
  • examples/cjk/all_ag1.ps
  • examples/cjk/all_aj1.ps
  • examples/cjk/all_aj2.ps
  • examples/cjk/all_ak1.ps
  • examples/cjk/article9.ps
  • examples/cjk/gscjk_ac.ps
  • examples/cjk/gscjk_ag.ps
  • examples/cjk/gscjk_aj.ps
  • examples/cjk/gscjk_ak.ps
  • examples/cjk/iso2022.ps
  • examples/cjk/iso2022v.ps
  • examples/colorcir.ps
  • examples/doretree.ps
  • examples/escher.ps
  • examples/golfer.eps
  • examples/grayalph.ps
  • examples/ridt91.eps
  • examples/snowflak.ps
  • examples/spots.ps
  • examples/spots2.pdf
    .pdf
  • examples/text_graph_image_cmyk_rgb.pdf
    .pdf
  • examples/text_graphic_image.pdf
    .pdf
  • examples/tiger.eps
  • examples/transparency_example.ps
  • examples/vasarely.ps
  • examples/waterfal.ps
  • lib/FAPIconfig-FCO
  • lib/FCOfontmap-PCLPS3
  • lib/FCOfontmap-PS3
  • lib/Fontmap.ATB
  • lib/Fontmap.ATM
  • lib/Fontmap.OS2
  • lib/Fontmap.OSF
  • lib/Fontmap.SGI
  • lib/Fontmap.Sol
  • lib/Fontmap.Ult
  • lib/Fontmap.VMS
  • lib/Info-macos.plist
    .xml
  • lib/PDFA_def.ps
  • lib/PDFX_def.ps
  • lib/acctest.ps
  • lib/afmdiff.awk
    .sh linux
  • lib/align.ps
  • lib/bj8.rpd
  • lib/bj8gc12f.upp
  • lib/bj8hg12f.upp
  • lib/bj8oh06n.upp
  • lib/bj8pa06n.upp
  • lib/bj8pp12f.upp
  • lib/bj8ts06n.upp
  • lib/bjc610a0.upp
  • lib/bjc610a1.upp
  • lib/bjc610a2.upp
  • lib/bjc610a3.upp
  • lib/bjc610a4.upp
  • lib/bjc610a5.upp
  • lib/bjc610a6.upp
  • lib/bjc610a7.upp
  • lib/bjc610a8.upp
  • lib/bjc610b1.upp
  • lib/bjc610b2.upp
  • lib/bjc610b3.upp
  • lib/bjc610b4.upp
  • lib/bjc610b6.upp
  • lib/bjc610b7.upp
  • lib/bjc610b8.upp
  • lib/caption.ps
  • lib/cat.ps
  • lib/cbjc600.ppd
  • lib/cbjc800.ppd
  • lib/cdj550.upp
  • lib/cdj690.upp
  • lib/cdj690ec.upp
  • lib/cid2code.ps
  • lib/dnj750c.upp
  • lib/dnj750m.upp
  • lib/docie.ps
  • lib/dvipdf
    .sh linux
  • lib/eps2eps
    .sh linux
  • lib/eps2eps.bat
  • lib/eps2eps.cmd
  • lib/font2pcl.ps
  • lib/ghostpdf.README
  • lib/ghostpdf.cat
  • lib/ghostpdf.inf
  • lib/ghostpdf.ppd
  • lib/gs_ce_e.ps
  • lib/gs_css_e.ps
  • lib/gs_il2_e.ps
  • lib/gs_kanji.ps
  • lib/gs_ksb_e.ps
  • lib/gs_l.xbm
  • lib/gs_l.xpm
  • lib/gs_l_m.xbm
  • lib/gs_lgo_e.ps
  • lib/gs_lgx_e.ps
  • lib/gs_m.xbm
  • lib/gs_m.xpm
  • lib/gs_m_m.xbm
  • lib/gs_s.xbm
  • lib/gs_s.xpm
  • lib/gs_s_m.xbm
  • lib/gs_t.xbm
  • lib/gs_t.xpm
  • lib/gs_t_m.xbm
  • lib/gs_wl1_e.ps
  • lib/gs_wl2_e.ps
  • lib/gs_wl5_e.ps
  • lib/gsbj
    .sh linux
  • lib/gsbj.bat
  • lib/gsdj
    .sh linux
  • lib/gsdj.bat
  • lib/gsdj500
    .sh linux
  • lib/gsdj500.bat
  • lib/gslj
    .sh linux
  • lib/gslj.bat
  • lib/gslp
    .sh linux
  • lib/gslp.bat
  • lib/gslp.ps
    .vbs
  • lib/gsnd
    .sh linux
  • lib/gsnd.bat
  • lib/gsndt.bat
  • lib/gsnup.ps
  • lib/gssetgs.bat
  • lib/gssetgs32.bat