b0b80102eb872cc56e1f13e6d6fe0dc74e7b770b055f5b4a2c0af5d8dd658d9e

Sharing

Copy URL Twitter E-mail

General

Target

b0b80102eb872cc56e1f13e6d6fe0dc74e7b770b055f5b4a2c0af5d8dd658d9e
Size

39KB
MD5

1b8eeb916650730a9c01805fd00b708a
SHA1

14498211ea41b8d42f63a1aa7bdf0367f7f950c8
SHA256

b0b80102eb872cc56e1f13e6d6fe0dc74e7b770b055f5b4a2c0af5d8dd658d9e
SHA512

1c11bdfc757e68ec38950f722c1cfcb5de1c2773a3af18b8b75989123ba467d85e10167299192864dbc9f2ebb1e5880afbd684d8e7eeedc2d72995559ec62b55
SSDEEP

384:bVg18qPeuxTgXm3LFxWYSWMiwm6WjyJYxlh3cBbyFRsql6UTrirnsFRUH24rlGsd:RG8qmKgSB4Yw5W/l1cKs+nen2o6a

Score

1^/10

Malware Config

Signatures

Files

b0b80102eb872cc56e1f13e6d6fe0dc74e7b770b055f5b4a2c0af5d8dd658d9e
.dll windows:5 windows x64 arch:x64

e43f6000f6542c0617588d86a8b8d2f6

Code Sign

33:00:00:00:1d:c3:1a:76:16:24:75:4f:80:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2014, 19:27

Not After

19/03/2016, 19:27

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:c4:50:21:ba:6e:d8:5a:72:ad:00:00:00:00:00:c4
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

17/06/2021, 17:55

Not After

16/06/2022, 17:55

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

de:8f:76:83:05:2a:39:ad:5b:bd:a9:7f:02:d1:33:21:50:ba:81:4e:81:38:c7:0f:d8:c7:fa:cb:23:d1:24:4e
Signer

Actual PE Digest

de:8f:76:83:05:2a:39:ad:5b:bd:a9:7f:02:d1:33:21:50:ba:81:4e:81:38:c7:0f:d8:c7:fa:cb:23:d1:24:4e

Digest Algorithm

sha256

PE Digest Matches

true

de:8f:76:83:05:2a:39:ad:5b:bd:a9:7f:02:d1:33:21:50:ba:81:4e:81:38:c7:0f:d8:c7:fa:cb:23:d1:24:4e
Signer

Actual PE Digest

de:8f:76:83:05:2a:39:ad:5b:bd:a9:7f:02:d1:33:21:50:ba:81:4e:81:38:c7:0f:d8:c7:fa:cb:23:d1:24:4e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

e:\code\p3000upgrade\lm_11.4_airprint\dll_p3500_64\objfre_wnet_AMD64\amd64\pt3500lm.pdb

Imports

msvcrt

memcpy
wcsncmp
malloc
memset
_initterm
free
sprintf
memcmp

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

kernel32

OutputDebugStringW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetLastError
GetTickCount
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
lstrcmpiW
GlobalFree
GlobalAlloc
CloseHandle
CreateEventW
DeleteCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
SetLastError
Sleep
WideCharToMultiByte
lstrcatW
lstrcpyW
lstrcpynW
WaitForSingleObject
CreateThread
lstrlenW
OutputDebugStringA
SetEvent

advapi32

RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW

winspool.drv

SetJobW
XcvDataW
OpenPrinterW
EnumPortsW
EnumJobsA
ClosePrinter

ws2_32

closesocket
WSACleanup
sendto
inet_addr
bind
htons
setsockopt
socket
WSAStartup
recvfrom

Exports

Exports

InitializePrintMonitor

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e43f6000f6542c0617588d86a8b8d2f6

Code Sign

33:00:00:00:1d:c3:1a:76:16:24:75:4f:80:00:00:00:00:00:1dCertificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

33:00:00:00:c4:50:21:ba:6e:d8:5a:72:ad:00:00:00:00:00:c4Certificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

de:8f:76:83:05:2a:39:ad:5b:bd:a9:7f:02:d1:33:21:50:ba:81:4e:81:38:c7:0f:d8:c7:fa:cb:23:d1:24:4eSigner

de:8f:76:83:05:2a:39:ad:5b:bd:a9:7f:02:d1:33:21:50:ba:81:4e:81:38:c7:0f:d8:c7:fa:cb:23:d1:24:4eSigner

Headers

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

advapi32

winspool.drv

ws2_32

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 16KB

.data Size: 2KB - Virtual size: 3KB

.pdata Size: 1024B - Virtual size: 588B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 248B

33:00:00:00:1d:c3:1a:76:16:24:75:4f:80:00:00:00:00:00:1d
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

33:00:00:00:c4:50:21:ba:6e:d8:5a:72:ad:00:00:00:00:00:c4
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

de:8f:76:83:05:2a:39:ad:5b:bd:a9:7f:02:d1:33:21:50:ba:81:4e:81:38:c7:0f:d8:c7:fa:cb:23:d1:24:4e
Signer

de:8f:76:83:05:2a:39:ad:5b:bd:a9:7f:02:d1:33:21:50:ba:81:4e:81:38:c7:0f:d8:c7:fa:cb:23:d1:24:4e
Signer

.text
Size: 16KB - Virtual size: 16KB

.data
Size: 2KB - Virtual size: 3KB

.pdata
Size: 1024B - Virtual size: 588B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 248B