findnetprinters.pdb
Static task
static1
Behavioral task
behavioral1
Sample
findnetprinters.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
findnetprinters.dll
Resource
win10v2004-20240426-en
General
-
Target
findnetprinters.dll
-
Size
64KB
-
MD5
ddd91cd1cb23f84793442de37673cc46
-
SHA1
710780e3ab9413cac3d4f19a06116bc71fafe161
-
SHA256
473390fad449d7061bbc0312e03baf450dbf63c699d780d8bc5f30f1213a554d
-
SHA512
19f08338dec3f6abfd31d4a25058c210c1f8323e5447c38fc46bb635dba81613f10494d9714fb151d301959a80b1051970b64596837e1abb9f47911434e9321e
-
SSDEEP
1536:zYhalUjVDoOblZ2juESTg8s9iemFX5K6cnM:zYha0oO54juF3em555
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource findnetprinters.dll
Files
-
findnetprinters.dll.dll regsvr32 windows:6 windows x64 arch:x64
760b6100341f39e4edd49119d2afd384
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
??2@YAPEAX_K@Z
_vsnwprintf
memset
_onexit
__dllonexit
time
_unlock
_lock
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
??3@YAXPEAX@Z
_purecall
_wcslwr
_wcsicmp
iswprint
memcpy
__CxxFrameHandler3
sqrt
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
TpReleasePool
TpCallbackMayRunLong
TpSetWait
RtlNtStatusToDosError
TpAllocWait
TpWaitForWork
TpReleaseWork
TpWaitForWait
TpReleaseWait
TpWaitForTimer
TpReleaseTimer
TpWaitForIoCompletion
TpReleaseIoCompletion
TpWaitForAlpcCompletion
TpReleaseAlpcCompletion
kernel32
ReleaseMutex
CreateMutexW
GetLastError
CreateThread
CloseHandle
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
DisableThreadLibraryCalls
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
SetThreadpoolTimer
SetEvent
GetModuleHandleExW
CreateEventW
GetPrivateProfileIntW
GetSystemDirectoryW
GetPrivateProfileStringW
WaitForMultipleObjects
ReleaseSemaphore
CreateSemaphoreW
GetProcessHeap
HeapFree
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
user32
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
advapi32
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
shlwapi
ord219
ord209
ord210
ord211
ord208
oleaut32
SysFreeString
SysAllocString
ws2_32
WSAGetLastError
WSACleanup
inet_addr
WSAStartup
closesocket
socket
iphlpapi
GetNumberOfInterfaces
GetIpAddrTable
wsnmp32
ord504
ord204
ord107
ord105
ord602
ord500
ord600
ord300
ord201
ord205
ord900
ord302
ord903
ord501
ord203
ord402
ord400
ord220
ord103
ord101
ord999
ord200
ord301
ord603
ord604
ord906
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ