37bd30983c38758e8a03e0c1ca59565cb67c426300151e945c29cde4e582fc18

Sharing

Copy URL Twitter E-mail

General

Target

37bd30983c38758e8a03e0c1ca59565cb67c426300151e945c29cde4e582fc18
Size

512KB
MD5

88dcfec761bf3e60e1fd10e977d9f74b
SHA1

8adbaac2e2a4bee5631ea4a0d81729ed7d7dd6bf
SHA256

37bd30983c38758e8a03e0c1ca59565cb67c426300151e945c29cde4e582fc18
SHA512

40695c33ef9cbc0b33f7447ac322b90d2c92f31d359de9908d6eb784ad1cf507d704eaf7da099dc92b726413ad4e0f8279aa54586e2832d625b0165c1256768d
SSDEEP

6144:xGSh6GOf5PESX9B4PZOiwrZj1pnbW9JGn/V9IZOA0qsTZepSDXhqed65EMC:cSmfdEK9aP8dj1AviIp0qsVepDeaE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
37bd30983c38758e8a03e0c1ca59565cb67c426300151e945c29cde4e582fc18

Files

37bd30983c38758e8a03e0c1ca59565cb67c426300151e945c29cde4e582fc18
.dll windows:5 windows x64 arch:x64

0e78e7dca9cf71632c91804b6f3f9fb1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

h:\winddk\3790\src\print\smarter_usr_intg_30430\commonlib\smart_pp\objfre_wnet_AMD64\amd64\genprint.pdb

Imports

msvcrt

iswctype
_wcsnicmp
wcschr
memset
malloc
free
_initterm
_vsnwprintf
memcpy
_wcsicmp
__C_specific_handler
wcstoul

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

kernel32

IsDBCSLeadByteEx
GetACP
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
GlobalAlloc
WaitForSingleObject
LoadLibraryW
GetProcAddress
SetEvent
ResetEvent
CreateEventW
SetLastError
CloseHandle
GetLastError
GlobalFree
lstrlenW
FreeLibrary

spoolss

StartDocPrinterW
WritePrinter
EndDocPrinter
ReadPrinter
GetJobAttributes
GetPrinterDataW
SetPrinterDataW
OpenPrinterW
ClosePrinter
GetPrinterW

gdi32

TranslateCharsetInfo
CreateFontIndirectW
SelectObject
GetTextMetricsW
StartDocW
SetBkMode
StartPage
EndPage
TextOutA
EndDoc
AbortDoc
DeleteObject
GdiGetSpoolFileHandle
GdiGetPageCount
GdiGetDC
GetWorldTransform
GdiStartDocEMF
GdiEndDocEMF
GdiDeleteSpoolFileHandle
GdiGetPageHandle
GdiStartPageEMF
DeleteDC
CancelDC
GetDeviceCaps
ExtEscape
GdiPlayPageEMF
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
CreateDCW
ResetDCW
GdiGetDevmodeForPage
GdiResetDCEMF
GdiEndPageEMF

Exports

Exports

ClosePrintProcessor
ControlPrintProcessor
DllMain
EnumPrintProcessorDatatypesW
GetPrintProcessorCapabilities
OpenPrintProcessor
PrintDocumentOnPrintProcessor

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 126B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0e78e7dca9cf71632c91804b6f3f9fb1

Headers

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

spoolss

gdi32

Exports

Exports

Sections

.text Size: 26KB - Virtual size: 26KB

.data Size: 2KB - Virtual size: 3KB

.pdata Size: 1024B - Virtual size: 912B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 126B

.text
Size: 26KB - Virtual size: 26KB

.data
Size: 2KB - Virtual size: 3KB

.pdata
Size: 1024B - Virtual size: 912B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 126B