Static task
static1
Behavioral task
behavioral1
Sample
printui.dll
Resource
win10-20240611-en
General
-
Target
printui.dll
-
Size
66.0MB
-
MD5
a9b4742ab300d91fcb97751d071932ab
-
SHA1
13b16e0a6d2a0e139d62ea64f5c52feabc01e0e9
-
SHA256
9a55de90b6dad957506e91a1f84ded56512bceeb85655d4f9bd11e508d6c6424
-
SHA512
3b5b69044e9d98ef1a5a89353301b3f8e1c859a76b3a500daa871f04afb6c869afccb167bc524e791a0e92b18663bd1d9fbc135425ffa396ebfa8c0340bbd171
-
SSDEEP
12288:e3NUkh7wdyoBwiXhd64fQlCISP5SvvB76:e3ikOk09rfIfNvA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource printui.dll
Files
-
printui.dll.dll windows:6 windows x64 arch:x64
2efde182d71827b8302aea6963844c11
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
SetEnvironmentVariableW
SetEndOfFile
AllocConsole
GetFileAttributesW
SetStdHandle
CreateFileW
CreateDirectoryW
QueryPerformanceCounter
QueryPerformanceFrequency
CloseHandle
Sleep
GetCurrentThreadId
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleExW
HeapAlloc
HeapSize
HeapValidate
GetSystemInfo
ExitProcess
GetStdHandle
GetFileType
WriteFile
OutputDebugStringW
WriteConsoleW
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapFree
HeapReAlloc
HeapQueryInformation
GetProcessHeap
ReadFile
ReadConsoleW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlUnwind
user32
FindWindowA
ShowWindow
advapi32
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
Sections
.text Size: 407KB - Virtual size: 407KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 65.5MB - Virtual size: 65.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ