XpsRasterService[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

XpsRasterService.dll
Size

132KB
MD5

8a244e6f8004a421359812c3fc55ae1b
SHA1

b799e76e5bbb4cfedabbae8cded74d2637fbdfa7
SHA256

8159dd401e656f6941c37af17a5d93ffb0a9c98f57a5629fb9724066ea2e7e1f
SHA512

e971a4074ed1224b1c55a420af08753efd31a6e822bf6383e6a4e978ea3438899f1b418c5a83ac5a7062519894af370002a377f0f88dc235a2706ce13c5c0898
SSDEEP

3072:YAiQd5kFUHySG7RCjPAoQZqVCrfEdcYlmxlq:YAiQdUNYPAXnAlelq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XpsRasterService.dll

Files

XpsRasterService.dll
.dll windows:6 windows x86 arch:x86

8683152aecf873b4f0f510ec1d778437

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

XpsRasterService.pdb

Imports

msvcrt

??0exception@@QAE@XZ
??1type_info@@UAE@XZ
_amsg_exit
_initterm
_unlock
__dllonexit
_lock
_XcptFilter
memcpy
_ftol2
??8type_info@@QBEHABV0@@Z
??0exception@@QAE@ABQBD@Z
memmove_s
_onexit
_purecall
__CxxFrameHandler3
malloc
_callnewh
memset
_CIsqrt
_CIsin
_CIcos
_CIatan
floor
_CIpow
_CxxThrowException
free
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_except_handler4_common
memcpy_s

kernel32

OutputDebugStringA
QueryPerformanceFrequency
GetCurrentProcess
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
Sleep
InterlockedCompareExchange

oleaut32

VariantClear
VariantInit
SysFreeString

advapi32

EventWrite
EventUnregister
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
EventEnabled
EventRegister
UnregisterTraceGuids
RegisterTraceGuidsW

ole32

CoCreateInstance
CoTaskMemFree

d2d1

ord1

dwrite

DWriteCreateFactory

ntdll

WinSqmIncrementDWORD

Exports

Exports

DllCanUnloadNow
DrvPopulateFilterServices

Sections

.text
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8683152aecf873b4f0f510ec1d778437

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

oleaut32

advapi32

ole32

d2d1

dwrite

ntdll

Exports

Exports

Sections

.text Size: 121KB - Virtual size: 120KB

.data Size: 512B - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 121KB - Virtual size: 120KB

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB