XpsRasterService.pdb
Static task
static1
Behavioral task
behavioral1
Sample
XpsRasterService.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
XpsRasterService.dll
Resource
win10v2004-20240426-en
General
-
Target
XpsRasterService.dll
-
Size
145KB
-
MD5
d1d02220c2b0105c9653f3670e29a356
-
SHA1
94b2fadcdab717ce64109e74936c390344e17dbb
-
SHA256
635ba8ac137c3acdfda283fe85db010d62bd0f5623894c1fad73a3a6ee768d2f
-
SHA512
e812491bc846acee38778d7b291047b035641ff833854b7ae7a7c998f2c608a2ce5f0c0aef810bccfe73ed24c8cd829ba28cbedd394bc176b74c367ec2865b84
-
SSDEEP
3072:LsLM/q88xiLjbVOrjlWSaxdehpLACQo9t98N0M6vvFPF2z:LsMq88xiyjlvAmt98mM6vvFPFg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource XpsRasterService.dll
Files
-
XpsRasterService.dll.dll windows:6 windows x86 arch:x86
e9757bdff1b4032c09fd848f5d3bd17c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_callnewh
_purecall
??8type_info@@QBEHABV0@@Z
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
memcpy_s
ceil
??1type_info@@UAE@XZ
__dllonexit
_unlock
_lock
_initterm
memcpy
memcmp
_ftol2
_CIsqrt
__CxxFrameHandler3
_onexit
??0exception@@QAE@ABQBD@Z
_except_handler4_common
??0exception@@QAE@XZ
_amsg_exit
memmove_s
malloc
free
_XcptFilter
_CIsin
_CIpow
_CIcos
_CIatan
memset
kernel32
OutputDebugStringA
QueryPerformanceFrequency
GetLastError
VerifyVersionInfoW
VerSetConditionMask
TerminateProcess
GetCurrentProcess
DisableThreadLibraryCalls
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
oleaut32
VariantInit
SysFreeString
VariantClear
advapi32
GetTraceLoggerHandle
RegQueryValueExW
RegOpenKeyExW
EventEnabled
EventWrite
RegisterTraceGuidsW
GetTraceEnableLevel
EventRegister
UnregisterTraceGuids
EventUnregister
GetTraceEnableFlags
TraceMessage
RegCloseKey
ole32
CoCreateInstance
CoTaskMemFree
d3d11
D3D11CreateDevice
d2d1
ord1
ord5
dwrite
DWriteCreateFactory
ntdll
WinSqmAddToStream
WinSqmIsOptedIn
WinSqmIncrementDWORD
Exports
Exports
DllCanUnloadNow
DrvPopulateFilterServices
Sections
.text Size: 124KB - Virtual size: 123KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ