spoolsv[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

spoolsv.exe
Size

865KB
MD5

986a048eb1d47acb95947bc2591d1e9d
SHA1

ddeddc9656af89cb58120a9ac2f1d8e919437383
SHA256

b5ed2d924f6497474cedbed05cafbfe26a6ea62b0465db3cd62d450067aab388
SHA512

50b6c3ad6fe78ca2934492287be45659a6a295b86f71c58a7d3f475dd3f08df732db1c7febbb9a6846aa54a0a6bc6c02a523268aea70069b644b0381fd49c458
SSDEEP

12288:hesHteUPhuaUTO5N5r44Hfpq6zlD5yLpy2P/sVcDp50JsXspRWawCYMjhvPie/rJ:GU5DrZHTlD5y1D/BJoWawCYMFniyy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
spoolsv.exe

Files

spoolsv.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 796KB - Virtual size: 795KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ