F:\workspace\WinProject-V5.0.0.3\SourceCode\Release\PrintClientHost.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2d6661e08d1b48924b9b938507dbbe8193ffad13cb844ec44598fb55a5debaee.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2d6661e08d1b48924b9b938507dbbe8193ffad13cb844ec44598fb55a5debaee.exe
Resource
win10v2004-20240426-en
General
-
Target
2d6661e08d1b48924b9b938507dbbe8193ffad13cb844ec44598fb55a5debaee
-
Size
47KB
-
MD5
756174e63bccefbd8d1dc2148efdef4b
-
SHA1
1b012a7caed705cc7de952f5432eac5792f06461
-
SHA256
2d6661e08d1b48924b9b938507dbbe8193ffad13cb844ec44598fb55a5debaee
-
SHA512
7f06ec0fc631838041bf505653bb287d22c2b3f340a68d15b3c7f499a81871896fe3fb51615071636e55e011806cc5eb9b4f67d175fd6fd0510f498e08d6999f
-
SSDEEP
768:SYwT/lXMc5sLlbMg5jZwB9T2mK4/u8SfWkcAX0jGhs8nBsQIbbZm9tqmnj:SYKRbyLRSAmKchSukejUs8nBs5b1Egmj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d6661e08d1b48924b9b938507dbbe8193ffad13cb844ec44598fb55a5debaee
Files
-
2d6661e08d1b48924b9b938507dbbe8193ffad13cb844ec44598fb55a5debaee.exe windows:5 windows x86 arch:x86
b2e72a440e5fd0e0426c1cc1b24211f9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mfc140u
ord2886
ord5586
ord4815
ord5583
ord8177
ord4735
ord4715
ord1144
ord503
ord2408
ord14320
ord1472
ord296
ord1045
ord1523
ord5884
ord8182
ord1511
ord280
ord286
ord1663
ord995
ord3009
ord285
ord5921
ord2996
ord14416
ord1513
kernel32
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
GetCommandLineW
Sleep
CopyFileW
GetWindowsDirectoryW
LoadLibraryA
GetLastError
GetModuleFileNameW
UnmapViewOfFile
CloseHandle
MapViewOfFile
OpenFileMappingW
FreeLibrary
OutputDebugStringW
GetProcAddress
LoadLibraryW
user32
SetTimer
KillTimer
advapi32
RegOpenKeyExW
RegCloseKey
DuplicateTokenEx
CreateProcessAsUserW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
CreateServiceW
QueryServiceStatus
ControlService
StartServiceW
RegQueryValueExW
wtsapi32
WTSFreeMemory
WTSEnumerateSessionsW
cmmlib
?EnableLog@CFileLog@@SAXH@Z
?Enable@CMiniDumper@@SAXPB_W_N@Z
?SetLogName@CFileLog@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?GetVal@CIniFile@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@00@Z
??1CIniFile@@QAE@XZ
??0CIniFile@@QAE@XZ
?ValidatePath@CCommonFun@@SAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?OnShutdown@CService@@UAEXXZ
?OnStop@CService@@UAEXXZ
?TerminalProcess@CCommonFun@@SAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?bXpOrLater@CService@@2HA
?WriteLog@CService@@QAAXPB_WZZ
?IsInstalled@CService@@QAEHXZ
?main@CService@@QAEHHQAPA_W0@Z
??1CService@@QAE@XZ
??0CService@@QAE@PA_WH@Z
?GetProcessIdByName@CProcessExp@@SAKV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@K@Z
?GetDefaultPath@CCommonFun@@SA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?ProcessExist@CProcessExp@@SAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@KH@Z
??1CCriticalSection2@@QAE@XZ
??0CCriticalSection2@@QAE@XZ
?Write@CFileLog@@QAAXPB_WZZ
?Enter@CCriticalSection2@@QAEXXZ
?Leave@CCriticalSection2@@QAEXXZ
??0_ENVSTRING_t@@QAE@XZ
??1_ENVSTRING_t@@QAE@XZ
?GetProcessToken@CProcessExp@@SAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@KAAPAXH@Z
?ProcessMsg@CService@@UAEXAAUtagMSG@@@Z
?OnPause@CService@@UAEXXZ
?OnContinue@CService@@UAEXXZ
?OnInterrogate@CService@@UAEXXZ
?OnUnknownRequest@CService@@UAEXK@Z
?OnRunCurrentSessionUiProcess@ISvcCallback@@UAEHPA_W@Z
?SetShowUIFlag@ISvcCallback@@UAEXH@Z
?OnDeviceAttached@ISvcCallback@@UAEXPAX@Z
?OnDeviceDettached@ISvcCallback@@UAEXPAX@Z
??0ISvcCallback@@QAE@XZ
?SetFailedAction@CService@@IAEHPAUSC_HANDLE__@@W4_SC_ACTION_TYPE@@@Z
?TerminaPID@CCommonFun@@SAHK@Z
?ReadEnvironmentBlock@CProcessExp@@SAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@KAAU_ENVSTRING_t@@H@Z
?IsWow64@CCommonFun@@SAHXZ
??0CFileLog@@QAE@XZ
??1CFileLog@@UAE@XZ
printclient
_StopA@0
_BeginA@4
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
vcruntime140
__vcrt_InitializeCriticalSectionEx
__CxxFrameHandler3
memset
wcsrchr
_except_handler4_common
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vswprintf
__p__commode
_set_fmode
__stdio_common_vfwprintf
api-ms-win-crt-conio-l1-1-0
_getch
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__p___argc
exit
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_exit
_set_app_type
_seh_filter_exe
terminate
_cexit
_crt_atexit
_register_onexit_function
_controlfp_s
_initterm_e
_initialize_onexit_table
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 872B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ