findnetprinters.pdb
Static task
static1
Behavioral task
behavioral1
Sample
findnetprinters.dll
Resource
win10v2004-20240508-en
General
-
Target
findnetprinters.dll
-
Size
52KB
-
MD5
506bb27a782e15507e9dbd50afd44b34
-
SHA1
fadf2fe6c70f99d1a0ecbe8b235eafe4fcb5db33
-
SHA256
e78e359015102d540a524d8275ac203da396c5c1b14a68e7034fed4af5a73cc2
-
SHA512
0aa4b91273afacfeee0d16e81e26fcff42b15648c19cc43855f7cfed78e723508a8348329ff62baa8cccc7e6b8d80dc8a3ad5c79a5f5628c4e3f993a81d6589a
-
SSDEEP
768:QMQgRraWMgkiNodKNpT5zt4J6/kEgvjYRb84AxC0eKalScosNjoPel/:QMhaqOKNJltfcEdOxC0eKalS8NMo/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource findnetprinters.dll
Files
-
findnetprinters.dll.dll regsvr32 windows:10 windows x86 arch:x86
364fca829eb31752101f5cb34b9ffcd5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_vsnwprintf
time
memset
_CIsqrt
_ftol2
iswprint
__CxxFrameHandler3
_wcsicmp
memcpy
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
_wcslwr
free
_callnewh
malloc
_purecall
kernel32
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
CreateThread
GetLastError
CreateMutexW
ReleaseMutex
CloseHandle
DisableThreadLibraryCalls
ReleaseSRWLockExclusive
HeapFree
GetProcessHeap
GetModuleHandleExW
WideCharToMultiByte
SetThreadpoolTimer
SetEvent
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
CreateSemaphoreW
ReleaseSemaphore
WaitForMultipleObjects
GetPrivateProfileStringW
CreateEventW
GetPrivateProfileIntW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetSystemDirectoryW
user32
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
advapi32
GetTraceEnableLevel
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
shlwapi
ord211
ord209
ord208
ord210
ord219
oleaut32
SysAllocString
SysFreeString
ws2_32
socket
WSAGetLastError
closesocket
WSACleanup
WSAStartup
inet_addr
iphlpapi
GetIpAddrTable
GetNumberOfInterfaces
wsnmp32
ord900
ord903
ord302
ord906
ord504
ord204
ord107
ord105
ord604
ord603
ord205
ord301
ord602
ord501
ord500
ord600
ord300
ord201
ord203
ord402
ord400
ord220
ord103
ord999
ord200
ord101
ntdll
TpReleaseAlpcCompletion
TpReleasePool
TpCallbackMayRunLong
TpSetWait
RtlNtStatusToDosError
TpAllocWait
TpWaitForWork
TpReleaseWork
TpWaitForWait
TpReleaseWait
TpWaitForTimer
TpReleaseTimer
TpWaitForIoCompletion
TpReleaseIoCompletion
TpWaitForAlpcCompletion
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ