D:\software_20201106\test\新建文件夹 (3)\新建文件夹 (15)\office批量打印改造\OfficeBatchPrint_V140_20221214-1\Release\OfficeBatchPrint.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c84a847239c5cfabeec2508f13efd2a89df3a458c25e26bb67e93fbf10d1cbd2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
c84a847239c5cfabeec2508f13efd2a89df3a458c25e26bb67e93fbf10d1cbd2.exe
Resource
win10v2004-20231222-en
General
-
Target
c84a847239c5cfabeec2508f13efd2a89df3a458c25e26bb67e93fbf10d1cbd2
-
Size
10.1MB
-
MD5
1e7d546ffd620340ee1078428b0b544a
-
SHA1
1f632e4fc2640bee183e37d2237e20e2363e4be7
-
SHA256
c84a847239c5cfabeec2508f13efd2a89df3a458c25e26bb67e93fbf10d1cbd2
-
SHA512
03a3b21977dac1211ae2aead6fb0a2d6a0bf3663cd9ff4b00adf13d73de0de751a08eb83101eca39ccea49fc4369849e763361d5b78b3a28380019c278855156
-
SSDEEP
196608:lmkAmK8+oPygmWSYnIkqNPUdljNf4vM64CJSN36DZ4pgFLOyomFHKnPLl:lwmKQPygZFqNOxgzFceF4l
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c84a847239c5cfabeec2508f13efd2a89df3a458c25e26bb67e93fbf10d1cbd2
Files
-
c84a847239c5cfabeec2508f13efd2a89df3a458c25e26bb67e93fbf10d1cbd2.exe windows:6 windows x86 arch:x86
111df8c06f6d54500b89ce94627df5fb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetVersionExW
GetTickCount
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
OffsetRect
gdi32
CreateCompatibleDC
msimg32
TransparentBlt
winspool.drv
GetPrinterW
advapi32
RegCreateKeyExW
shell32
SHBrowseForFolderW
comctl32
InitCommonControlsEx
shlwapi
StrFormatKBSizeW
uxtheme
DrawThemeBackground
ole32
CoFreeUnusedLibraries
oleaut32
VariantTimeToSystemTime
oledlg
OleUIBusyW
gdiplus
GdipTranslateWorldTransform
setupapi
SetupDiEnumDeviceInterfaces
oleacc
LresultFromObject
imm32
ImmGetOpenStatus
winmm
PlaySoundW
Exports
Exports
h����5`�?9���rz�{�ڗR�pZ��BА�E�����+�Z��$#����V���\%x�^.�lf��T���D�@�@m0 :�XEkx4j8�e͔Q R�{��g����Ҩ�*�d�K�'�mwj@}h?�z�ȈN�Ff���S�T\:�:�q��[���ʹ�������qu�����;����Ȇh(&8DQMg��e��, ���ıW��u�0����Tdf���芬�������� Dd�T6 `�=����eU�7C�˪%ӑL4��N��D�|r茕e� ������?m�6��qM�o&�f�m$�S*��R�^�p �Ԡ�6��s��>1#RFϫ���-p�3�@�SKc|G�.Ъ��Ƴ*I۾�1�DĖu�|7X�:H�����>U��I��zu�Hj�zI�i��3��Or��SR;�P�1O��vۺկ}@L}N��� ��*0߭��0$N6��k�:�y �6<P��Ç���%p�ݩLd�M����.��P|L=�k�EL 9ȓ=���d]0}<�TJ��|�$$�O ��5 g��x���6Z)�Vk������Γ����n� �G��GM:���>������[�9,�a��go�b�f�RC��ŀtK�J���,mQg�u�6�gFb&�8Z�*#���b��$=��L�������~>��.��� ��30e�;r�cT�oW+���i`+��3i�����d�� p��4T�7�^d�z��AG�M�<PdZ�Lcg���H �s���L�w�OE�M�1bv¼�NA;˺�Y�|[�*��XUR�3��-H}.2h�Np��6`U�q6��<��*�c=U��Q�9݃��D?��ɽ�~��L��9\62�8AvC�VŴ�&�O��}SA �mS� ̄�y�Wɜ��X5|�k�z� U��ۏq:;�C߽�c鈤�W���_ʚ[��V8r�h�Qh�Q��wT�����xB��S��tV���D|�u��-B D���-*����x!������i�Y�8T����!�I״^���n�V�ʷ����ye���6(�t0�l�55:�ݧ8�v.��K?���������;��s����z�sY�(���^#����yɼٕ҇�;y�U�� �@�R�(��`K�U4�Fk��G|Ц��[-%-o��'q{����I��y�B��H��J�3\�:�+�ט�{��#�u�Ԗ�&g6�lr�䌀vR�� ��[�֩`6k� ��ZG�"X[��u��$�\�_"���yh��/n������r�͕��;�U���Ԯ:!7�ۘ��=��j?B�I� �w�L`��ٚ��ׄ�c阥J��ϑx���A=W:[pU;8����g��M�����H�a����h~!�Η��0H1��s�:@bx�5]$ߖ`�2�@�Z���{x�6_�h�{|�oъ��~{�m=C���Rqx����[�SC�MiھaL��Cp�9-lp�X�ȕ��zߡ���:VNA�n6Wj���ݺ����9(l(s����o�0O��:Z��v"IAsJf��ș� E�4i�|�J!��J��[&����ܷX_۰q��g����ꖨ��U��K���w���s���^OV�17\0�p�(3T�ˢ%�v̅����,><�-� ��i=!�+B�XN���ӍFgKA-t�oa����.=�S�ؙџe�G=�%�*�]UXZ����D�eD��� ��'"h�����i�4���Ee����F~����B��0(�����ڟ���+,�����M�!����O��<�+��~l���z��;0�R��y��\�%C$#�]�C-!���0i������6�L��KwY�>����$�!$i����c�`�q��<�*����L����p��i����g\v��+{4�����`<m~�D�!����<���>���h�ӹ'����h�pl#j��?熷h~�Jm��6�:��^�^ʣ������"W+b�ZB����k��.~f�eB��"�*#���6wI�!ѐi)RaG�;j���mRu�����C���4��Zz��A�?���N�H{�/��C\%��$=O�����8h��Խ��]�A�����ƒ��a���Y��O����n];��L�J�%�i�?�$�F�+q"?��^����X7�[���ٍ�2�� �n�%���/,\8*����A%r���Y�m⋕����<�� �B{D��$�(���f��v���(S��6&�g�m/YA��}�/e��]wq����Խ�75Do�����KY�2����S[3q"��� ������ ;��ϭ_���;�!��-?�^%JzsS��G� Y='�Y̗+#��X�� ��Ow%��^�%۬!N·x�������%��$�ێ-PRƴ��dxYsR�r�����TLj�<KX�^�%�j<݄u0`!�}��RK�����Y�q`2���8S�z��I��!����B�g��OMZ����p��Qm^�z{�����!V�p��!M��z�)�@?嗠����s�u�%�^[�0�`��~>�H4��Y:y�lOz�*�<�b+�x�㞀��\sb/+�M!<f&ćGQ�rO��8���,59ʬ}|Hc<�^�*d��#�I�>�|yf�Zw��*/s��G�6��J��gT8;��r ��8�)��~8+I�͇ ;/{��p�vR:q$!&f�p�. ���=����'�K��6qe�Y͇�Kk��I`-��ա�� L�@{�����g�Y����~��o�m��%��d!LiG��yxf�a�҅k�t�N�~U}���Ne�(dMR��� G��AX��P&��8ÈM,7��U���5mJ{!7��%QyBak4S�stm�Ng�~��ɱfX�J�[�7�!7�ac�&}��h��A�ү�<�� P�}��.:�?ZY�"����1�g����v�m%A c��[���F�S�DO�z-�]H�윧r�4=B�q�-�����e����ٵ�w�@��ɍk^߇s���¥|��n:����q�w��Kt+>��������a;dz=iFA,�}��\����4���"��.د
Sections
.text Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 785KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.giats Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 10.0MB - Virtual size: 10.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ