Nppdf32.pdb
Static task
static1
Behavioral task
behavioral1
Sample
393980f46c567eec02291434eb61e259b765e8c1fe49178a2b8b091f7ddb4115.dll
Resource
win7-20240508-en
General
-
Target
393980f46c567eec02291434eb61e259b765e8c1fe49178a2b8b091f7ddb4115
-
Size
460KB
-
MD5
15917301a68e2c94aa9c9b3b107a9bcc
-
SHA1
96dd138a7706d1c6eaffecb50fbd0e40f89652b9
-
SHA256
393980f46c567eec02291434eb61e259b765e8c1fe49178a2b8b091f7ddb4115
-
SHA512
b178e6ac25973159cab7bf75d0087226e78386b93e35c126355ddd5d6bb3cc569b46151b0bff3d2f138330a33a6217f4951489c213cbd1f9ea3fe4c6460a0bdc
-
SSDEEP
12288:6yijPvZN9WrENX0323nIRRZnJqCihqA6VCZ2AU:6zjPBv9pm23mRZn7iNuCc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 393980f46c567eec02291434eb61e259b765e8c1fe49178a2b8b091f7ddb4115
Files
-
393980f46c567eec02291434eb61e259b765e8c1fe49178a2b8b091f7ddb4115.dll windows:5 windows x86 arch:x86
e9cfdfb7fa7a7d02a88505274a09846e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
uxtheme
SetWindowTheme
kernel32
ReadFile
GetFileSize
CreateFileA
CreateFileW
GetTempFileNameA
GetTempPathA
OpenFile
GetModuleFileNameA
DeleteFileA
CopyFileA
MultiByteToWideChar
OpenMutexW
WriteFile
SetNamedPipeHandleState
lstrlenW
GetVolumeInformationW
GetTickCount
GetCurrentProcessId
GetTempPathW
GetLongPathNameW
GetVersionExW
FreeLibrary
OpenFileMappingA
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
MapViewOfFile
TerminateProcess
InterlockedCompareExchange
DecodePointer
EncodePointer
lstrcpynA
GetVersionExA
CreateMutexW
CallNamedPipeW
SetThreadPriority
HeapCreate
lstrcpyW
HeapDestroy
WideCharToMultiByte
CreateSemaphoreA
GetCurrentThreadId
CreateProcessW
OpenProcess
GetExitCodeProcess
FindFirstFileW
FindClose
QueryPerformanceCounter
CreateDirectoryA
SetFilePointer
GetLocalTime
RaiseException
InterlockedExchange
LocalAlloc
UnmapViewOfFile
CreateFileMappingA
InitializeCriticalSection
CreateEventA
CreateThread
ExitThread
OutputDebugStringA
GetModuleFileNameW
SetLastError
GetLastError
DeleteCriticalSection
TerminateThread
CloseHandle
SetEvent
ResumeThread
Sleep
WaitForSingleObject
LeaveCriticalSection
TryEnterCriticalSection
EnterCriticalSection
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
LoadLibraryW
GetModuleHandleA
LoadLibraryA
GetCurrentProcess
user32
PostMessageW
PostQuitMessage
LoadMenuA
GetWindowLongA
ShowScrollBar
EnumWindows
IsChild
GetFocus
SetCursor
GetForegroundWindow
GetSubMenu
ClientToScreen
GetWindow
CallWindowProcA
SetWindowLongA
SetWindowRgn
IsWindowUnicode
GetMessageW
GetMessageA
GetWindowThreadProcessId
GetParent
GetPropA
RemovePropA
SetPropA
LoadStringW
LoadStringA
DestroyCursor
LoadCursorA
SetTimer
KillTimer
MessageBoxA
SetFocus
GetWindowRect
SetWindowPos
TranslateMessage
DispatchMessageA
CreateDialogParamA
CreateWindowExW
PostMessageA
GetClassNameA
PeekMessageA
RemovePropW
DestroyWindow
IsWindowVisible
GetWindowRgn
SetPropW
EndDialog
DefWindowProcA
GetPropW
InvalidateRect
UpdateWindow
IsWindow
SendDlgItemMessageW
SystemParametersInfoA
GetDlgItem
SendDlgItemMessageA
ShowWindow
GetClientRect
SendMessageA
FindWindowA
RegisterWindowMessageA
GetAncestor
wsprintfW
WaitForInputIdle
GetActiveWindow
FindWindowW
MsgWaitForMultipleObjects
DispatchMessageW
gdi32
DeleteObject
CreateRoundRectRgn
CreateSolidBrush
SetBkColor
SetTextColor
GetStockObject
FillRgn
CreateRectRgn
Escape
GetDeviceCaps
DeleteEnhMetaFile
PlayEnhMetaFile
GetEnhMetaFileA
LPtoDP
advapi32
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
ConvertStringSecurityDescriptorToSecurityDescriptorW
ole32
CoCreateInstance
msvcr100
strcpy
_unlink
fopen
tmpfile
fclose
fseek
fread
_stricmp
_mbscmp
??0exception@std@@QAE@ABQBDH@Z
wcslen
calloc
memchr
towlower
memcpy_s
memmove_s
_wcslwr_s
wcsncmp
_wcsnicmp
wcstol
iswdigit
_wassert
_wcsicmp
_waccess_s
fwscanf_s
_wfopen_s
_wsplitpath_s
_itow_s
_vsnprintf_s
_wcsdup
wcsrchr
wcsstr
_wputenv_s
wcsncat_s
wcscat_s
_wgetenv
wcscpy_s
wcstok_s
_wtof
_wtol
_time64
_wmakepath_s
_snwprintf_s
wcscat
_snwprintf
_vsnprintf
_snprintf
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__clean_type_info_names_internal
sscanf
tolower
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_strnicmp
free
malloc
??_U@YAPAXI@Z
_itoa
??_V@YAXPAX@Z
strcat_s
sprintf_s
strcpy_s
strncpy_s
strcmp
_set_invalid_parameter_handler
vsprintf_s
memmove
memcmp
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
strstr
strrchr
strchr
memcpy
strlen
srand
rand
??2@YAPAXI@Z
wcsncpy_s
??3@YAXPAX@Z
__CxxFrameHandler3
memset
localeconv
swprintf_s
_purecall
setlocale
strncmp
fwrite
msvcp100
?_Orphan_all@_Container_base12@std@@QAEXXZ
??0_Container_base12@std@@QAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7ios_base@std@@6B@
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_BADOFF@std@@3_JB
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1_Container_base12@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
shell32
SHGetFolderPathA
Exports
Exports
NP_AcrobatProtectedInitialize
NP_ApolloEntry
NP_GetEntryPoints
NP_Initialize
NP_Shutdown
Sections
.text Size: 136KB - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 276KB - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ