04c3ca76d6d3258c08029680e45d8170N

Sharing

Copy URL Twitter E-mail

General

Target

04c3ca76d6d3258c08029680e45d8170N
Size

546KB
MD5

04c3ca76d6d3258c08029680e45d8170
SHA1

c3025a983811d7434492aba8efb9889a2ffc538b
SHA256

b718e7440bc93b94853eeaa3e6f59b009cd8ec601ebfabd5e88b68a226caa634
SHA512

615ac16624d555fb58d02c7f79a802fb44f61ff5a287564b61b020fa1243c4b98ef918b3e484702aaf7cdec3984b598c36ca6f19e0b5268b6bcc800095c9539e
SSDEEP

12288:r/bKT8OtFJpkmkKDvq3ECYuuTarQ2RTcvmgbgcdZ2L:r/bKTlTJLHDy3ECYuuTCQ2Rcvhbgl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04c3ca76d6d3258c08029680e45d8170N

Files

04c3ca76d6d3258c08029680e45d8170N
.exe windows:6 windows x86 arch:x86

7658f72dcb573b355a710f3c6ded5ff2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

spoolsv.pdb

Imports

user32

RegisterPowerSettingNotification
DispatchMessageW
PeekMessageW
UnregisterPowerSettingNotification
TranslateMessage
MsgWaitForMultipleObjects
UnregisterDeviceNotification
RegisterDeviceNotificationW
SendNotifyMessageW

msvcrt

towupper
__CxxFrameHandler3
_strnicmp
wcsncmp
memcmp
_wcsnicmp
memcpy
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_initterm
__setusermatherr
__p__fmode
wcsstr
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
__p__commode
_XcptFilter
_vsnwprintf
??3@YAXPAX@Z
_purecall
_stricmp
_wcsicmp
??2@YAPAXI@Z
strchr
wcschr
towlower
memset

ntdll

RtlIpv4AddressToStringW
NtOpenProcessToken
NtClose
NtSetInformationThread
NtOpenThreadToken
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExW
EtwEventEnabled
RtlReportException
TpAllocPool
TpReleaseAlpcCompletion
TpWaitForAlpcCompletion
TpReleaseIoCompletion
TpWaitForIoCompletion
TpReleaseTimer
TpWaitForTimer
TpReleaseWait
TpWaitForWait
TpReleaseWork
TpWaitForWork
TpAllocAlpcCompletion
TpStartAsyncIoOperation
TpAllocIoCompletion
TpSetTimer
TpAllocTimer
TpAllocWait
TpPostWork
TpAllocWork
RtlNtStatusToDosError
TpSimpleTryPost
TpSetWait
TpCallbackMayRunLong
TpReleasePool
RtlValidRelativeSecurityDescriptor
EtwEventWrite
NtQuerySystemInformation
EtwGetTraceLoggerHandle
EtwUnregisterTraceGuids
WinSqmIsOptedIn
WinSqmSetDWORD
WinSqmAddToStreamEx
WinSqmIncrementDWORD
EtwEventUnregister
EtwRegisterTraceGuidsW
EtwTraceMessage
EtwEventRegister
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
RtlIpv6AddressToStringW

api-ms-win-core-synch-l1-2-0

InitializeCriticalSection
WaitForSingleObject
CreateEventW
InitializeCriticalSectionAndSpinCount
Sleep
OpenEventW
SetEvent
EnterCriticalSection
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseMutex
LeaveCriticalSection
CreateMutexW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleHandleA
DisableThreadLibraryCalls

api-ms-win-core-processthreads-l1-1-2

ExitProcess
TerminateProcess
GetCurrentProcess
ExitThread
OpenProcessToken
GetCurrentThreadId
GetCurrentProcessId
SetThreadToken
OpenProcess
OpenThreadToken
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThread
CreateProcessAsUserW
SetPriorityClass
CreateThread
TlsGetValue

api-ms-win-core-errorhandling-l1-1-1

SetErrorMode
SetUnhandledExceptionFilter
SetLastError
GetErrorMode
UnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-service-core-l1-1-1

SetServiceStatus
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW

api-ms-win-core-sysinfo-l1-2-1

GetSystemWindowsDirectoryW
GetTickCount
GetSystemTimeAsFileTime
GetSystemTime
GetVersionExW

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapDestroy
HeapCreate
HeapSetInformation

api-ms-win-core-registry-l1-1-0

RegDeleteKeyExW
RegSetValueExW
RegDeleteValueW
RegQueryInfoKeyW
RegOpenCurrentUser
RegEnumKeyExW
RegCreateKeyExW
RegQueryValueExW
RegGetKeySecurity
RegDeleteTreeW
RegGetValueW
RegOpenKeyExW
RegEnumValueW
RegDisablePredefinedCacheEx
RegCloseKey
RegSetKeySecurity

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
DebugBreak
IsDebuggerPresent

rpcrt4

RpcBindingServerFromClient
RpcServerRegisterIf
RpcAsyncCompleteCall
RpcRevertToSelfEx
RpcStringBindingComposeW
NdrClientCall2
RpcBindingFree
RpcServerRegisterIf2
RpcSmDestroyClientContext
RpcServerUnsubscribeForNotification
RpcServerInqBindings
RpcServerSubscribeForNotification
RpcEpRegisterW
RpcBindingVectorFree
I_RpcExceptionFilter
RpcServerTestCancel
RpcObjectSetType
RpcStringBindingParseW
RpcAsyncAbortCall
RpcSsContextLockExclusive
RpcBindingToStringBindingW
RpcServerInterfaceGroupDeactivate
RpcServerInterfaceGroupActivate
RpcServerInterfaceGroupCreateW
RpcServerRegisterAuthInfoW
RpcServerInqDefaultPrincNameW
RpcStringFreeW
RpcMgmtSetServerStackSize
RpcRevertToSelf
RpcImpersonateClient
RpcServerInqBindingHandle
I_RpcBindingInqTransportType
RpcBindingFromStringBindingW
I_RpcSessionStrictContextHandle
I_RpcBindingIsClientLocal
NdrAsyncClientCall
NdrAsyncServerCall
NdrServerCall2
RpcRaiseException

api-ms-win-security-base-l1-2-0

SetTokenInformation
DuplicateToken
ImpersonateLoggedOnUser
IsWellKnownSid
GetSecurityDescriptorDacl
AddAccessDeniedAceEx
GetLengthSid
RevertToSelf
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
InitializeAcl
CopySid
GetAce
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
GetSidSubAuthority
GetSidSubAuthorityCount
DuplicateTokenEx
CreateWellKnownSid
AddAccessAllowedAceEx
GetAclInformation
AddAce
EqualSid

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

kernel32

LoadLibraryExW
FreeLibrary
AddVectoredExceptionHandler
GetProcAddress
GetModuleHandleExW
LocalAlloc
ResetEvent
GetComputerNameW
ResolveDelayLoadedAPI
HeapAlloc
DeleteCriticalSection
SetThreadpoolTimer
LocalFree
LoadLibraryW
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
lstrcmpiW
HeapFree
CloseThreadpoolTimer
GetTickCount64
QueueUserWorkItem

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringW

api-ms-win-core-file-l1-2-1

DeleteFileW
ReadFile
CreateFileW
GetTempFileNameW

api-ms-win-core-file-l2-1-1

MoveFileExW

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler

dnsapi

DnsQuery_W
DnsFree

api-ms-win-power-base-l1-1-0

GetPwrCapabilities

powrprof

PowerDeterminePlatformRole

Exports

Exports

GetSpoolerTlsIndexes
PrvAbortPrinter
PrvAddFormW
PrvAddJobW
PrvAddMonitorW
PrvAddPerMachineConnectionW
PrvAddPortExW
PrvAddPortW
PrvAddPrintProcessorW
PrvAddPrintProvidorW
PrvAddPrinterConnectionW
PrvAddPrinterDriverExW
PrvAddPrinterDriverW
PrvAddPrinterExW
PrvAddPrinterW
PrvAdjustPointers
PrvAdjustPointersInStructuresArray
PrvAlignKMPtr
PrvAlignRpcPtr
PrvAllocSplStr
PrvAllowRemoteCalls
PrvAppendPrinterNotifyInfoData
PrvBuildOtherNamesFromMachineName
PrvCacheAddName
PrvCacheCreateAndAddNode
PrvCacheCreateAndAddNodeWithIPAddresses
PrvCacheDeleteNode
PrvCacheIsNameCluster
PrvCacheIsNameInNodeList
PrvCallDrvDevModeConversion
PrvCallRouterFindFirstPrinterChangeNotification
PrvCheckLocalCall
PrvClosePrinter
PrvConfigurePortW
PrvCreatePrinterIC
PrvDeleteFormW
PrvDeleteMonitorW
PrvDeletePerMachineConnectionW
PrvDeletePortW
PrvDeletePrintProcessorW
PrvDeletePrintProvidorW
PrvDeletePrinter
PrvDeletePrinterConnectionW
PrvDeletePrinterDataExW
PrvDeletePrinterDataW
PrvDeletePrinterDriverExW
PrvDeletePrinterDriverW
PrvDeletePrinterIC
PrvDeletePrinterKeyW
PrvDllAllocSplMem
PrvDllAllocSplStr
PrvDllFreeSplMem
PrvDllFreeSplStr
PrvDllReallocSplMem
PrvDllReallocSplStr
PrvEndDocPrinter
PrvEndPagePrinter
PrvEnumFormsW
PrvEnumJobsW
PrvEnumMonitorsW
PrvEnumPerMachineConnectionsW
PrvEnumPortsW
PrvEnumPrintProcessorDatatypesW
PrvEnumPrintProcessorsW
PrvEnumPrinterDataExW
PrvEnumPrinterDataW
PrvEnumPrinterDriversW
PrvEnumPrinterKeyW
PrvEnumPrintersW
PrvFindClosePrinterChangeNotification
PrvFlushPrinter
PrvFormatPrinterForRegistryKey
PrvFormatRegistryKeyForPrinter
PrvFreeOtherNames
PrvGetFormW
PrvGetJobAttributes
PrvGetJobAttributesEx
PrvGetJobW
PrvGetNetworkId
PrvGetPrintProcessorDirectoryW
PrvGetPrinterDataExW
PrvGetPrinterDataW
PrvGetPrinterDriverDirectoryW
PrvGetPrinterDriverExW
PrvGetPrinterDriverW
PrvGetPrinterW
PrvGetServerPolicy
PrvGetShrinkedSize
PrvGetSpoolerTlsIndexes
PrvImpersonatePrinterClient
PrvInitializeRouter
PrvIsNameTheLocalMachineOrAClusterSpooler
PrvIsNamedPipeRpcCall
PrvMIDL_user_allocate
PrvMIDL_user_allocate1
PrvMIDL_user_free
PrvMIDL_user_free1
PrvMarshallDownStructure
PrvMarshallDownStructuresArray
PrvMarshallUpStructure
PrvMarshallUpStructuresArray
PrvOldGetPrinterDriverW
PrvOpenPrinter2W
PrvOpenPrinterExW
PrvOpenPrinterPort2W
PrvOpenPrinterW
PrvPackStrings
PrvPartialReplyPrinterChangeNotification
PrvPlayGdiScriptOnPrinterIC
PrvPrinterHandleRundown
PrvPrinterMessageBoxW
PrvProvidorFindClosePrinterChangeNotification
PrvProvidorFindFirstPrinterChangeNotification
PrvReadPrinter
PrvReallocSplMem
PrvReallocSplStr
PrvRemoteFindFirstPrinterChangeNotification
PrvReplyClosePrinter
PrvReplyOpenPrinter
PrvReplyPrinterChangeNotification
PrvReplyPrinterChangeNotificationEx
PrvReportJobProcessingProgress
PrvResetPrinterW
PrvRevertToPrinterSelf
PrvRouterAddPrinterConnection2
PrvRouterAllocBidiMem
PrvRouterAllocBidiResponseContainer
PrvRouterAllocPrinterNotifyInfo
PrvRouterBroadcastMessage
PrvRouterCorePrinterDriverInstalled
PrvRouterCreatePrintAsyncNotificationChannel
PrvRouterDeletePrinterDriverPackage
PrvRouterFindCompatibleDriver
PrvRouterFindFirstPrinterChangeNotification
PrvRouterFindNextPrinterChangeNotification
PrvRouterFreeBidiMem
PrvRouterFreeBidiResponseContainer
PrvRouterFreePrinterNotifyInfo
PrvRouterGetCorePrinterDrivers
PrvRouterGetPrintClassObject
PrvRouterGetPrinterDriverPackagePath
PrvRouterInstallPrinterDriverFromPackage
PrvRouterInternalGetPrinterDriver
PrvRouterRefreshPrinterChangeNotification
PrvRouterRegisterForPrintAsyncNotifications
PrvRouterReplyPrinter
PrvRouterSpoolerSetPolicy
PrvRouterUnregisterForPrintAsyncNotifications
PrvRouterUploadPrinterDriverPackage
PrvScheduleJob
PrvSeekPrinter
PrvSendRecvBidiData
PrvSetFormW
PrvSetJobW
PrvSetPortW
PrvSetPrinterDataExW
PrvSetPrinterDataW
PrvSetPrinterW
PrvSplCloseSpoolFileHandle
PrvSplCommitSpoolData
PrvSplDriverUnloadComplete
PrvSplGetClientUserHandle
PrvSplGetSpoolFileInfo
PrvSplGetUserSidStringFromToken
PrvSplInitializeWinSpoolDrv
PrvSplIsSessionZero
PrvSplIsUpgrade
PrvSplProcessPnPEvent
PrvSplProcessSessionEvent
PrvSplPromptUIInUsersSession
PrvSplQueryUserInfo
PrvSplReadPrinter
PrvSplRegisterForDeviceEvents
PrvSplRegisterForSessionEvents
PrvSplShutDownRouter
PrvSplUnregisterForDeviceEvents
PrvSplUnregisterForSessionEvents
PrvSpoolerFindClosePrinterChangeNotification
PrvSpoolerFindFirstPrinterChangeNotification
PrvSpoolerFindNextPrinterChangeNotification
PrvSpoolerFreePrinterNotifyInfo
PrvSpoolerHasInitialized
PrvSpoolerInit
PrvSpoolerRefreshPrinterChangeNotification
PrvStartDocPrinterW
PrvStartPagePrinter
PrvUndoAlignKMPtr
PrvUndoAlignRpcPtr
PrvUpdateBufferSize
PrvUpdatePrinterRegAll
PrvUpdatePrinterRegUser
PrvWaitForPrinterChange
PrvWaitForSpoolerInitialization
PrvWritePrinter
PrvXcvDataW
PrvbGetDevModePerUser
PrvbSetDevModePerUser
RouterLogJobInfoForBranchOffice
ServerGetPrintClassObject
SplUalCollectData
YAbortPrinter
YAddJob
YDriverUnloadComplete
YEndDocPrinter
YEndPagePrinter
YFlushPrinter
YGetPrinter
YGetPrinterDriver2
YGetPrinterDriverDirectory
YReadPrinter
YSeekPrinter
YSetJob
YSetPort
YSetPrinter
YSplReadPrinter
YStartDocPrinter
YStartPagePrinter
YWritePrinter

Sections

.text
Size: 449KB - Virtual size: 449KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7658f72dcb573b355a710f3c6ded5ff2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

msvcrt

ntdll

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-service-core-l1-1-1

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-debug-l1-1-1

rpcrt4

api-ms-win-security-base-l1-2-0

api-ms-win-core-profile-l1-1-0

kernel32

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-file-l2-1-1

api-ms-win-core-console-l1-1-0

dnsapi

api-ms-win-power-base-l1-1-0

powrprof

Exports

Exports

Sections

.text Size: 449KB - Virtual size: 449KB

.data Size: 5KB - Virtual size: 5KB

.idata Size: 9KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 188B

.rsrc Size: 57KB - Virtual size: 56KB

.reloc Size: 24KB - Virtual size: 23KB

.text
Size: 449KB - Virtual size: 449KB

.data
Size: 5KB - Virtual size: 5KB

.idata
Size: 9KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 188B

.rsrc
Size: 57KB - Virtual size: 56KB

.reloc
Size: 24KB - Virtual size: 23KB