Print.PrintSupport.Source.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Print.PrintSupport.Source.dll
Resource
win10v2004-20240426-en
General
-
Target
Print.PrintSupport.Source.dll
-
Size
161KB
-
MD5
8af7536a04f76c2384e8a9e3c63064be
-
SHA1
20140373c9db6f9ee3e343d1c8a0102142849c3f
-
SHA256
79050320c7524d0447a46517c20a0c63ac4523288f57528d27266107563d4722
-
SHA512
41517356fe569bd480b2f7c7b4a7cb7d92ae05f20c53e6129c3b79d627c43a4158ee582ea9264bb4e83f48c6bdfcf97c9e27405d77c488c64d03064fd8958bcd
-
SSDEEP
3072:jDbv5KpvI30QS3LEy1ViEeUNpojnjEAlCx0Twf3e5h7nqkr5IQWIqh+dt2C7:HMAy3LEYVJeUNpojnjlCx0qeH7dNI2qm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Print.PrintSupport.Source.dll
Files
-
Print.PrintSupport.Source.dll.dll windows:10 windows x86 arch:x86
7e5bf279bdfb3f8ab6e2c220f7fdf37e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcp_win
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??1facet@locale@std@@MAE@XZ
?is@?$ctype@G@std@@QBE_NFG@Z
?tolower@?$ctype@G@std@@QBEGG@Z
?tolower@?$ctype@G@std@@QBEPBGPAGPBG@Z
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
??1_Locinfo@std@@QAE@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
??0_Locinfo@std@@QAE@PBD@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
_Wcsxfrm
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
_Wcscoll
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
??0facet@locale@std@@IAE@I@Z
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@G@std@@2V0locale@2@A
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?id@?$ctype@G@std@@2V0locale@2@A
?__ExceptionPtrRethrow@@YAXPBX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
api-ms-win-crt-string-l1-1-0
wcsncmp
memset
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o___stdio_common_vsnprintf_s
_o___stdio_common_vswprintf
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
memmove
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
_o_free
_o_iswspace
_o_malloc
_o_realloc
_o_terminate
_o_towlower
__current_exception
__current_exception_context
_except_handler4_common
_CxxThrowException
strchr
__std_terminate
__CxxFrameHandler3
memcmp
memcpy
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
DisableThreadLibraryCalls
GetModuleFileNameA
FreeLibrary
GetModuleHandleExW
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObjectEx
ReleaseSRWLockShared
AcquireSRWLockShared
SetEvent
CreateSemaphoreExW
InitializeCriticalSectionEx
CreateEventW
DeleteCriticalSection
ReleaseMutex
CreateMutexExW
WaitForSingleObject
AcquireSRWLockExclusive
ReleaseSemaphore
ReleaseSRWLockExclusive
OpenSemaphoreW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
RaiseException
UnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-util-l1-1-0
DecodePointer
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressSingle
InitOnceExecuteOnce
api-ms-win-shcore-stream-l1-1-0
SHCreateMemStream
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-com-l1-1-0
CoUninitialize
CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
api-ms-win-devices-query-l1-1-0
DevFindProperty
api-ms-win-devices-swdevice-l1-1-1
SwDeviceSetLifetime
api-ms-win-devices-swdevice-l1-1-0
SwDeviceCreate
ntdll
NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlGetDeviceFamilyInfoEnum
RtlSubscribeWnfStateChangeNotification
api-ms-win-rtcore-ntuser-window-l1-1-0
AllowSetForegroundWindow
SetForegroundWindow
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
TrySubmitThreadpoolCallback
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegGetValueW
RegOpenKeyExW
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InterlockedFlushSList
InitializeSListHead
combase
ord147
ord148
api-ms-win-core-file-l1-1-0
WriteFile
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
oleaut32
SetErrorInfo
SysStringLen
GetErrorInfo
SysFreeString
SysAllocString
Exports
Exports
CreateAndStartPsaSession
CreatePsaManagerForUserContextAbi
CreatePsaSessionForUserContext
CreatePsaSourceStream
CreateSoftwareDevnode
DllCanUnloadNow
GetAppUserModelId
GetEntryPoint
HasAppWithContract
IsActivationContractSupported
IsPsaEnabledForContract
IsPsaEnabledForContractAsCurrentUser
LaunchPsaAppForError
LaunchSystemSettingsBroker
QueryAndSubscribePdmPrinterChangeNotification
RemovePsaSession
RemovePsaSessionForUserContext
SetJobIdForPsaSession
SetPrintTicketPsa
UpdatePDC
ValidatePrintTicket
Sections
.text Size: 140KB - Virtual size: 139KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ