XpsGdiConverter.pdb
Static task
static1
Behavioral task
behavioral1
Sample
XpsGdiConverter.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
XpsGdiConverter.dll
Resource
win10v2004-20240508-en
General
-
Target
XpsGdiConverter.dll
-
Size
334KB
-
MD5
eaf2ee44da765d4652cbfc2fd43d273d
-
SHA1
0ebfcfb4cfc2277a6d53cc6ce5c68159c9c8b579
-
SHA256
720d7a3041f8c3a27e3b6bffffdde79d1b7b892e49d9f18d022bcd7c1ce21a82
-
SHA512
d4dc876e370d0f4c0e11af80b0baac3bb895b4a82cf5719a70f789f5a693262c8b1ab4678b1b18c6e0f8bce860646ffff7c2e53a7e36d6bbe4d177cdd3d2affb
-
SSDEEP
6144:IU+HG3dfq44kepixMIrju/c+CrQdeNOH8obS5yUf2GrhjNwv7G7ys/ftG:IUC2dfq44kepixMIrju/c+CrceNOcJY7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource XpsGdiConverter.dll
Files
-
XpsGdiConverter.dll.dll windows:6 windows x86 arch:x86
7f64e3b3a40fb29549c7a623f0f211ee
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_CIpow
_CIfmod
_CIcos
__CxxFrameHandler3
rand
wcsnlen
srand
ceil
memcpy_s
??0exception@@QAE@ABQBD@Z
_purecall
??8type_info@@QBEHABV0@@Z
memmove_s
_CxxThrowException
?what@exception@@UBEPBDXZ
_CIsin
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
memcpy
_XcptFilter
_amsg_exit
_initterm
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler4_common
_CIatan
_callnewh
memcmp
_CIsqrt
floor
??1exception@@UAE@XZ
_ftol2_sse
malloc
free
_ftol2
_CIacos
_CIasin
memset
kernel32
VerSetConditionMask
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
OutputDebugStringA
Sleep
GetSystemDefaultLCID
GetLastError
VerifyVersionInfoW
GetTickCount64
GetCurrentThreadId
GetProcAddress
LoadLibraryW
FreeLibrary
DisableThreadLibraryCalls
VirtualProtect
LoadLibraryExA
GetSystemInfo
LocalAlloc
RaiseException
GetModuleHandleW
VirtualQuery
QueryPerformanceFrequency
user32
FillRect
gdi32
CreateSolidBrush
GetMiterLimit
ExtCreatePen
SetMiterLimit
BeginPath
MoveToEx
SelectClipPath
LineTo
SelectClipRgn
PolyDraw
GetPolyFillMode
EndPath
SetPolyFillMode
CreateRectRgn
FillPath
CreateFontIndirectW
RemoveFontMemResourceEx
GetTextAlign
AddFontMemResourceEx
GetTextFaceW
SetTextAlign
GetTextColor
EndPage
SetGraphicsMode
ExtEscape
StartPage
DeleteDC
CreateDIBSection
GetDeviceCaps
GdiFlush
ExtTextOutW
GetTextMetricsW
SaveDC
AbortDoc
RestoreDC
ModifyWorldTransform
GetStockObject
EndDoc
ResetDCW
SetWorldTransform
StartDocW
SetStretchBltMode
StretchDIBits
CreateCompatibleDC
SelectObject
DeleteObject
SetBkMode
CreateDCW
SetTextColor
ole32
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
oleaut32
VariantInit
SysFreeString
shlwapi
PathIsRelativeW
shell32
SHGetKnownFolderPath
prntvpt
ord10
ord2
ord4
ord1
ord8
advapi32
RegQueryValueExW
GetTraceEnableFlags
EventUnregister
RegCloseKey
RegOpenKeyExW
RegEnumValueW
RegQueryInfoKeyW
EventEnabled
EventWrite
RegisterTraceGuidsW
GetTraceEnableLevel
EventRegister
UnregisterTraceGuids
GetTraceLoggerHandle
TraceMessage
d3d11
D3D11CreateDevice
d2d1
ord1
ord5
dwrite
DWriteCreateFactory
Sections
.text Size: 293KB - Virtual size: 293KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ