3c3386d1d2062ec3518df041c7cbdb2c7fca8c0719307353b6a61bb085d4a9de

Sharing

Copy URL Twitter E-mail

General

Target

3c3386d1d2062ec3518df041c7cbdb2c7fca8c0719307353b6a61bb085d4a9de
Size

142KB
MD5

5e9c946804d471bfe618eb4b1256596e
SHA1

1fc1bdb1c26c56cd2bb809704cd2ef984d151457
SHA256

3c3386d1d2062ec3518df041c7cbdb2c7fca8c0719307353b6a61bb085d4a9de
SHA512

3130be8cd1d218e5036681fcbc136ba70a44ea4e74c9aa508c38600517f8d6bea20f620ee3ee54468282c829901e21b893931de088a401a2c17261c088ba9c92
SSDEEP

3072:elngUixd4t7cDveBU+o39gLfsfC/ejhCqgDw:euUixd4VcD8u3KLfEF3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3c3386d1d2062ec3518df041c7cbdb2c7fca8c0719307353b6a61bb085d4a9de

Files

3c3386d1d2062ec3518df041c7cbdb2c7fca8c0719307353b6a61bb085d4a9de
.dll windows:6 windows x64 arch:x64

8ab181e8608c8d859879d1d049eba78d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Project\Work\Virtual Printer\Release\x64\PrintMonitor.pdb

Imports

kernel32

DeleteCriticalSection
CreateDirectoryW
SetLastError
WriteFile
GetTempPathW
CreateFileW
OpenProcess
GetFileAttributesExW
DisableThreadLibraryCalls
GlobalFree
CloseHandle
FlushFileBuffers
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
InitializeCriticalSection
GlobalAlloc
GetModuleFileNameW
HeapReAlloc
HeapSize
SetStdHandle
GetStringTypeW
SetFilePointerEx
GetProcessHeap
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW

winspool.drv

ClosePrinter
OpenPrinterW
GetJobW
SetJobW

advapi32

CreateProcessAsUserW
OpenProcessToken

ole32

CoCreateGuid

wtsapi32

WTSFreeMemory
WTSEnumerateProcessesW
WTSQuerySessionInformationW
WTSEnumerateSessionsW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

shlwapi

PathFindFileNameW

Exports

Exports

InitializePrintMonitor2

Sections

.text
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ab181e8608c8d859879d1d049eba78d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

winspool.drv

advapi32

ole32

wtsapi32

userenv

shlwapi

Exports

Exports

Sections

.text Size: 86KB - Virtual size: 85KB

.rdata Size: 44KB - Virtual size: 43KB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 5KB - Virtual size: 4KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 86KB - Virtual size: 85KB

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 5KB - Virtual size: 4KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 2KB - Virtual size: 1KB