891b35ef8e50a6c35cd605e5a639799e

Sharing

Copy URL Twitter E-mail

General

Target

891b35ef8e50a6c35cd605e5a639799e
Size

68KB
MD5

891b35ef8e50a6c35cd605e5a639799e
SHA1

8bf062ac0b081273f6f6c4b93e20bde1fbafbf44
SHA256

717a7fded2965a5ccfa0808f736dcbb46ef910b94c04d70d43e280bd4aaf8284
SHA512

b63f94d40faa05fe249eb269f0ae5858209d25c9cf7294ad383f9b0476e2f127124f4a355b6a4744b15cffcda7a6b5311771e483b9c82c5790225c5c0a85f3cd
SSDEEP

1536:btMWnv+bAxGkpuylLNOlgJ/zz4677vOZT:bF8kpuylpOlgJ/nR7L8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
891b35ef8e50a6c35cd605e5a639799e

Files

891b35ef8e50a6c35cd605e5a639799e
.dll regsvr32 windows:4 windows x86 arch:x86

8ab725630cf181ab3b36d6bb677e11b0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

s:\sdcore\SASHSpoolerHandler\Release\HpqSplh08.pdb

Imports

kernel32

GetLastError
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
InterlockedIncrement
InterlockedDecrement
SetThreadLocale
GetThreadLocale
GetProcAddress
GetCurrentProcess
Sleep
WaitForSingleObject
SetLastError
CreateThread
GetVersionExA
GetLocaleInfoA
GetACP
InterlockedExchange
GetModuleFileNameW
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
HeapDestroy
HeapReAlloc
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
CloseHandle
GetTickCount
DeleteCriticalSection
RaiseException
FlushInstructionCache
lstrlenW
InterlockedCompareExchange

user32

PostMessageW
GetClassInfoExW
LoadCursorW
DefWindowProcW
RegisterClassExW
SetWindowLongW
UnregisterClassA
GetWindowLongW
CallWindowProcW
DestroyWindow
CreateWindowExW
RegisterWindowMessageW

winspool.drv

GetPrinterW
ClosePrinter
OpenPrinterW
FindClosePrinterChangeNotification
FindNextPrinterChangeNotification
FindFirstPrinterChangeNotification
EnumJobsW

ole32

CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

SysFreeString
VarBstrCat
SysAllocStringLen
SysAllocString
CreateErrorInfo
LoadRegTypeLi
LoadTypeLi
VariantInit
VariantClear
SetErrorInfo
SysStringLen

atl80

ord61
ord44
ord43
ord64
ord22
ord18
ord31
ord30
ord23
ord32
ord58
ord15

msvcr80

__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
?terminate@@YAXXZ
_except_handler4_common
_resetstkoflw
??2@YAPAXI@Z
??_U@YAPAXI@Z
calloc
_recalloc
_purecall
memmove_s
memset
malloc
swprintf_s
wcscpy_s
??_V@YAXPAX@Z
__CxxFrameHandler3
free
memcpy_s
_CxxThrowException
??3@YAXPAX@Z
_crt_debugger_hook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ab725630cf181ab3b36d6bb677e11b0

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

winspool.drv

ole32

oleaut32

atl80

msvcr80

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 25KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 8KB - Virtual size: 6KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 28KB - Virtual size: 25KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 8KB - Virtual size: 6KB

.reloc
Size: 8KB - Virtual size: 4KB