XpsGdiConverter.pdb
Static task
static1
Behavioral task
behavioral1
Sample
XpsGdiConverter.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
XpsGdiConverter.dll
Resource
win10v2004-20240508-en
General
-
Target
XpsGdiConverter.dll
-
Size
356KB
-
MD5
c7a730afb80b11f93efc81b1d6f920d7
-
SHA1
a3da7bd1ee11de77e1f3fda743fa875d6a9dcabb
-
SHA256
17c4f176a259bf97593284665e7fbc452fa80da70dae74fe4cf1c0bda0e55d32
-
SHA512
81e1754e458469f16064fbc25a5505272fcd7b9c496689e961ea6705c0fa342767ad9584549de684c79138adb669e8c3ff972ce91c1311265e9fad7d8a1a7fbc
-
SSDEEP
6144:DZ+vvdcM8CqSeWEVc5LfWv11NEQfuyW2JxMlokb:DZocG515LUXNEUW2g
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource XpsGdiConverter.dll
Files
-
XpsGdiConverter.dll.dll windows:6 windows x86 arch:x86
8201b56652705e04a578470cf90583a3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_initterm
_lock
_ftol2
_CIsqrt
_CIsin
_CIpow
_CIfmod
_CIcos
rand
wcsnlen
time
srand
ceil
memcpy_s
??0exception@@QAE@ABQBD@Z
_amsg_exit
??8type_info@@QBEHABV0@@Z
memmove_s
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
_unlock
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler4_common
_callnewh
_CIatan
memcpy
__CxxFrameHandler3
_XcptFilter
_ftol2_sse
floor
_purecall
malloc
free
memcmp
_CIacos
_CIasin
memset
kernel32
VerSetConditionMask
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
OutputDebugStringA
InterlockedCompareExchange
InterlockedExchange
Sleep
GetLastError
GetProcAddress
LoadLibraryW
FreeLibrary
InterlockedDecrement
InterlockedIncrement
DisableThreadLibraryCalls
LoadLibraryExA
LocalAlloc
RaiseException
QueryPerformanceFrequency
VerifyVersionInfoW
user32
FillRect
gdi32
CreateSolidBrush
GetMiterLimit
ExtCreatePen
SetMiterLimit
BeginPath
MoveToEx
SelectClipPath
LineTo
SelectClipRgn
PolyDraw
GetPolyFillMode
EndPath
SetPolyFillMode
CreateRectRgn
FillPath
SetTextColor
CreateFontIndirectW
RemoveFontMemResourceEx
AddFontMemResourceEx
GetTextFaceW
SetTextAlign
GetTextColor
EndPage
SetGraphicsMode
ExtEscape
StartPage
DeleteDC
CreateDIBSection
GetDeviceCaps
GdiFlush
CreateDCW
SetBkMode
DeleteObject
ExtTextOutW
GetTextMetricsW
SaveDC
AbortDoc
RestoreDC
ModifyWorldTransform
GetStockObject
EndDoc
ResetDCW
SetWorldTransform
StartDocW
SetStretchBltMode
StretchDIBits
CreateCompatibleDC
SelectObject
GetTextAlign
ole32
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
oleaut32
VariantInit
SysFreeString
shlwapi
PathIsRelativeW
shell32
SHGetKnownFolderPath
prntvpt
ord10
ord2
ord4
ord1
ord8
advapi32
RegQueryValueExW
GetTraceEnableFlags
EventUnregister
RegCloseKey
RegOpenKeyExW
RegEnumValueW
RegQueryInfoKeyW
EventEnabled
EventWrite
RegisterTraceGuidsW
GetTraceEnableLevel
EventRegister
UnregisterTraceGuids
GetTraceLoggerHandle
TraceMessage
d3d11
D3D11CreateDevice
d2d1
ord1
ord5
dwrite
DWriteCreateFactory
Sections
.text Size: 308KB - Virtual size: 308KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ