0243290e442dc1b66e1761bbfdef6941c4b38e44741fabf88f03967f535b63fcN

Sharing

Copy URL Twitter E-mail

General

Target

0243290e442dc1b66e1761bbfdef6941c4b38e44741fabf88f03967f535b63fcN
Size

4.4MB
MD5

157a7b1a15fc533fc36d84bc06fe53e0
SHA1

72df60c9203a3e99876df80f78028e5dacc2ddcf
SHA256

0243290e442dc1b66e1761bbfdef6941c4b38e44741fabf88f03967f535b63fc
SHA512

2fd14e1203018b2b591e0a0ad769e4ed0a42f644ac7d4132732e927fc961d3bcd560b6a963c647a4231a51bd6de45c1e8a65771d353f3370f954271ea4fe2a66
SSDEEP

98304:OCzoKHg0U+OEOTpETAgtirpjT1qAUU1rS91q:rPI+OEIdgIUU1rSP

Score

1^/10

Malware Config

Signatures

Files

0243290e442dc1b66e1761bbfdef6941c4b38e44741fabf88f03967f535b63fcN
.dll windows:5 windows x86 arch:x86

c077a1c6744b4cfc0709f8faeb875d13

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6c:81:87:13:52:e7:de:81:c7:84:22:c8:34:b5:ca:3a
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/04/2019, 00:00

Not After

25/04/2021, 23:59

Subject

CN=Black Ice Software LLC,OU=Secure Application Development,O=Black Ice Software LLC,L=Boca Raton,ST=Florida,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5e:ad:6f:27:be:97:cb:40:b3:91:85:b0:be:64:70:99:cf:85:35:cb:68:a5:e4:b2:36:1b:4a:b1:3e:b8:6e:97
Signer

Actual PE Digest

5e:ad:6f:27:be:97:cb:40:b3:91:85:b0:be:64:70:99:cf:85:35:cb:68:a5:e4:b2:36:1b:4a:b1:3e:b8:6e:97

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\User_mode_printer_drivers\Printer Driver RTK\Sources\InstallDLLforRTK\NT_Release\Mydll_NT.pdb

Imports

kernel32

GetFullPathNameA
ExitThread
InterlockedPushEntrySList
RtlUnwind
FreeLibraryAndExitThread
GetModuleHandleExW
GetCommandLineW
CreateThread
GetCommandLineA
HeapQueryInformation
GetSystemInfo
VirtualAlloc
VirtualQuery
SetStdHandle
GetFileType
ExitProcess
GetModuleFileNameA
GetACP
GetStringTypeW
GetDriveTypeW
GetStdHandle
GetDateFormatW
GetTimeFormatW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetConsoleCtrlHandler
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
ResetEvent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LocalUnlock
LocalLock
GetUserDefaultLCID
ReplaceFileW
GetDiskFreeSpaceW
SearchPathW
GetProfileIntW
GetTempPathW
GetTempFileNameW
VerifyVersionInfoW
VerSetConditionMask
SystemTimeToTzSpecificLocalTime
SetFileTime
SetFileAttributesW
LocalFileTimeToFileTime
GetFileTime
GetFileSizeEx
GetFileAttributesExW
FileTimeToLocalFileTime
FindResourceExW
GetStringTypeExW
MoveFileW
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetShortPathNameW
GetFullPathNameW
GetFileSize
FlushFileBuffers
FindFirstFileW
FindClose
CreateFileW
VirtualProtect
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
GlobalFlags
GetThreadLocale
SystemTimeToFileTime
FileTimeToSystemTime
GetAtomNameW
GlobalGetAtomNameW
SetErrorMode
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CompareStringA
lstrcmpA
ResumeThread
SuspendThread
SetThreadPriority
SetEvent
GlobalFindAtomW
GlobalAddAtomW
LoadLibraryA
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
FreeResource
EncodePointer
OutputDebugStringA
FormatMessageW
MulDiv
GlobalUnlock
GlobalLock
GlobalSize
GetFileAttributesW
ExpandEnvironmentStringsW
lstrcatW
WideCharToMultiByte
QueryPerformanceFrequency
QueryPerformanceCounter
CopyFileW
CopyFileA
DeleteFileW
GetWindowsDirectoryW
GetSystemDirectoryW
GetSystemDirectoryA
GetPrivateProfileStringA
OutputDebugStringW
CreateProcessW
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
OpenMutexW
CreateMutexW
lstrcmpiW
Sleep
WaitForSingleObject
ReleaseMutex
SetLastError
GetCurrentThreadId
GetCurrentProcessId
GetVersion
CreateEventW
MultiByteToWideChar
lstrcpyW
FreeLibrary
GetVersionExW
FindResourceW
GetTickCount
GetLocalTime
SizeofResource
LoadResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
RaiseException
GetCurrentProcess
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
LocalFree
LocalHandle
LocalAlloc
LockResource
DecodePointer
GetCurrentDirectoryW
SetCurrentDirectoryW
WritePrivateProfileStructW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetEnvironmentVariableW
LoadLibraryW
CloseHandle
GetLastError
GetCurrentThread
GlobalFree
GlobalAlloc
GetProcAddress
InterlockedFlushSList
WriteConsoleW

user32

IsRectEmpty
DrawFocusRect
WindowFromPoint
ReleaseCapture
SetCapture
GetNextDlgGroupItem
GetMenuDefaultItem
CreatePopupMenu
LoadImageW
TrackMouseEvent
CharUpperW
DestroyIcon
InvalidateRect
KillTimer
SetTimer
DeleteMenu
IntersectRect
GetDialogBaseUnits
MapDialogRect
GetAsyncKeyState
OffsetRect
SetRectEmpty
SendDlgItemMessageA
CopyImage
SystemParametersInfoW
InflateRect
GetMenuItemInfoW
DestroyMenu
RealChildWindowFromPoint
LoadCursorW
GetSysColorBrush
SetCursor
ShowOwnedPopups
PostQuitMessage
GetCursorPos
TranslateMessage
GetMessageW
FillRect
ClientToScreen
ReleaseDC
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
GetActiveWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
IsDialogMessageW
SetWindowTextW
ScrollWindowEx
SendDlgItemMessageW
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
GetDlgItemTextW
SetDlgItemTextW
GetDlgItemInt
SetDlgItemInt
MoveWindow
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
CallNextHookEx
LoadMenuW
SetLayeredWindowAttributes
EnumDisplayMonitors
SendMessageTimeoutW
UnregisterClassW
EnableWindow
SendMessageW
GetDC
GetWindowRect
LoadBitmapW
wsprintfW
GetSystemMetrics
MessageBoxW
ScreenToClient
GetSysColor
LoadIconW
RegisterWindowMessageW
PostMessageW
DrawIconEx
FindWindowW
GetMenuStringW
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuW
AppendMenuW
RemoveMenu
IsWindowEnabled
GetWindowLongW
GetParent
GetWindowThreadProcessId
GetLastActivePopup
GetFocus
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
UnhookWindowsHookEx
SetWindowsHookExW
GetWindow
GetTopWindow
GetClassNameW
GetClassLongW
SetWindowLongW
PtInRect
EqualRect
CopyRect
MapWindowPoints
AdjustWindowRectEx
GetClientRect
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
ValidateRect
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
TrackPopupMenuEx
TrackPopupMenu
SetMenu
GetMenu
GetCapture
GetKeyState
SetFocus
GetDlgCtrlID
GetDlgItem
IsIconic
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
DestroyWindow
IsChild
SetClassLongW
SetWindowRgn
SetParent
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateW
DrawEdge
DrawFrameControl
IsZoomed
GetSystemMenu
BringWindowToTop
SetCursorPos
CopyIcon
GetIconInfo
MessageBeep
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
MapVirtualKeyW
GetDesktopWindow
GetKeyNameTextW
DispatchMessageW
PeekMessageW
GetMessagePos
GetMessageTime
DefWindowProcW
CallWindowProcW
RegisterClassW
GetClassInfoW
GetClassInfoExW
CreateWindowExW
IsWindow
IsMenu
GetTabbedTextExtentW
GetDCEx
DestroyCursor
GetWindowRgn
WindowFromDC
CreateMenu
InSendMessage
MonitorFromRect
SendNotifyMessageW
SubtractRect
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
EnumChildWindows
GetUpdateRect
IsClipboardFormatAvailable
CharUpperBuffW
RegisterClipboardFormatW
ModifyMenuW
GetDoubleClickTime
SetMenuDefaultItem
LockWindowUpdate
SetRect
CopyAcceleratorTableW
DestroyAcceleratorTable
CreateAcceleratorTableW
GetKeyboardState
ToUnicodeEx
MapVirtualKeyExW
IsCharLowerW
GetKeyboardLayout
WaitMessage
PostThreadMessageW
GetComboBoxInfo
ReuseDDElParam
UnpackDDElParam
GetMenuBarInfo
InsertMenuItemW
TranslateAcceleratorW
LoadAcceleratorsW
MonitorFromPoint
UpdateLayeredWindow
UnionRect
DrawIcon
FrameRect

gdi32

SetTextJustification
PlayMetaFileRecord
EnumMetaFile
SetWorldTransform
ModifyWorldTransform
SetColorAdjustment
StartDocW
ArcTo
PolyDraw
SelectClipPath
SetArcDirection
ExtCreatePen
MoveToEx
TextOutW
ExtTextOutW
PolyBezierTo
PolylineTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateFontIndirectW
GetTextExtentPoint32W
GetTextMetricsW
CombineRgn
CreateRectRgnIndirect
GetMapMode
PatBlt
SetRectRgn
DPtoLP
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
GetBkColor
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
GetDIBits
SetTextAlign
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
Rectangle
GetRgnBox
OffsetRgn
GetCurrentObject
CreateFontW
GetCharWidthW
StretchDIBits
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
CloseMetaFile
CreateMetaFileW
DeleteMetaFile
EndDoc
StartPage
EndPage
AbortDoc
SetAbortProc
GetROP2
GetBkMode
GetNearestColor
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetTextFaceW
SetTextCharacterExtra
SetStretchBltMode
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetGraphicsMode
SetMapperFlags
SetBkMode
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
PtVisible
PlayMetaFile
OffsetClipRgn
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
GetCurrentPositionEx
GetClipRgn
GetClipBox
ExcludeClipRect
Escape
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CreateHatchBrush
CreateDIBPatternBrushPt
SetTextColor
SetBkColor
CreateDCW
CopyMetaFileW
CreatePen
GetObjectW
SelectPalette
SelectObject
RealizePalette
GetDeviceCaps
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmap
SetPixel
RectVisible
BitBlt

msimg32

TransparentBlt
AlphaBlend

winspool.drv

DeletePrinterDriverW
DeletePrinterDriverExA
AddPrintProcessorW
EnumPrintProcessorsW
GetPrintProcessorDirectoryA
GetPrintProcessorDirectoryW
DeletePrintProcessorA
DeletePrintProcessorW
PrinterProperties
GetPrinterDriverDirectoryA
EnumMonitorsW
AddMonitorW
DeleteMonitorA
DeletePrinterDriverA
EnumPortsA
EnumPortsW
XcvDataW
GetJobW
EnumPrinterDriversW
AddPrinterDriverW
GetPrinterA
SetPrinterA
OpenPrinterA
EnumPrintersA
GetPrinterW
SetPrinterW
DeleteMonitorW
GetPrinterDriverDirectoryW
DeletePrinter
AddPrinterW
EnumPrintersW
DocumentPropertiesW
ClosePrinter
GetPrinterDriverW
OpenPrinterW

advapi32

GetFileSecurityW
RegQueryValueW
RegEnumKeyW
RegSetValueW
RegUnLoadKeyW
RegLoadKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
StartServiceW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
ControlService
CloseServiceHandle
RegSetValueExA
RegQueryValueExA
RegOpenKeyW
RegDeleteValueA
SetEntriesInAclW
RegSetKeySecurity
RegGetKeySecurity
RegEnumValueW
LookupAccountSidW
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
SetSecurityDescriptorControl
InitializeSecurityDescriptor
GetAce
DeleteAce
AddAce
GetAclInformation
InitializeAcl
CopySid
GetLengthSid
FreeSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyW
RegCloseKey
OpenThreadToken
SetFileSecurityW

shell32

DragFinish
DragQueryFileW
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFileInfoW
ExtractIconW
SHAddToRecentDocs
SHBrowseForFolderW
SHCreateDirectoryExW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteW
ShellExecuteExW
SHAppBarMessage

shlwapi

PathStripToRootW
PathIsUNCW
PathRemoveFileSpecW
PathRemoveExtensionW
PathFindFileNameW
PathFindExtensionW
SHDeleteKeyW
StrFormatKBSizeW

uxtheme

GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
IsAppThemed
GetWindowTheme
GetCurrentThemeName
GetThemeColor
DrawThemeBackground
CloseThemeData
OpenThemeData
DrawThemeParentBackground
DrawThemeText
GetThemePartSize

ole32

RevokeDragDrop
CoTreatAsClass
StringFromCLSID
RegisterDragDrop
CoLockObjectExternal
CreateBindCtx
ReadClassStg
WriteClassStg
WriteFmtUserTypeStg
ReadFmtUserTypeStg
OleDuplicateData
ReleaseStgMedium
OleRegGetUserType
SetConvertStg
CoUninitialize
CoInitializeEx
CoCreateInstance
CoCreateGuid
CoInitialize
StringFromGUID2
CoDisconnectObject
CLSIDFromString
CreateStreamOnHGlobal
OleSetClipboard
OleFlushClipboard
OleGetClipboard
OleIsCurrentClipboard
DoDragDrop
CoTaskMemAlloc
PropVariantCopy
OleSetMenuDescriptor
OleLockRunning
StgCreateDocfile
StgOpenStorage
StgOpenStorageOnILockBytes
StgIsStorageFile
CreateFileMoniker
CreateILockBytesOnHGlobal
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleRegGetMiscStatus
OleRegEnumVerbs
StgCreateDocfileOnILockBytes
CLSIDFromProgID
CoRegisterMessageFilter
CoRevokeClassObject
CoRegisterClassObject
CoGetClassObject
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
OleQueryCreateFromData
OleQueryLinkFromData
CoGetMalloc
OleIsRunning
GetRunningObjectTable
CreateOleAdviseHolder
CreateDataAdviseHolder
OleRun
GetHGlobalFromILockBytes
OleGetIconOfClass
OleSetContainedObject
OleSaveToStream
OleSave
OleLoad
OleCreateFromFile
OleCreateLinkToFile
OleCreateStaticFromData
OleCreateLinkFromData
OleCreateFromData
OleCreate
WriteClassStm
CreateItemMoniker
CoTaskMemFree
CreateGenericComposite

oleaut32

VarBstrFromDate
VarBstrFromCy
VarCyFromStr
VarDateFromStr
VariantCopy
SafeArrayPtrOfIndex
SafeArrayCopy
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayRedim
VarBstrFromDec
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SafeArrayCreate
SafeArrayAllocData
SafeArrayAllocDescriptor
VarDecFromStr
SystemTimeToVariantTime
SysStringLen
SysReAllocStringLen
RegisterTypeLi
LoadRegTypeLi
LoadTypeLi
SysAllocString
VariantChangeType
VariantClear
VariantInit
SysAllocStringByteLen
SysStringByteLen
SysFreeString
SysAllocStringLen
SafeArrayDestroy
VariantTimeToSystemTime

oledlg

OleUIBusyW

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

gdiplus

GdipCreateFromHDC
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown

imm32

ImmGetContext
ImmGetOpenStatus
ImmReleaseContext

winmm

PlaySoundW

Exports

Exports

BiAddAgentPrinter
BiAddParallelPrinter
BiDeleteAgentPrinter
BiDeleteAgentPrinters
BiDeleteParallelPrinter
BiGetPortCount
BiInstallSinglePrinter
BiInstallSinglePrinterPackage
BiInstallSinglePrinterPackageMSI
BiInstallSinglePrinterPackageMSI_ColorNT
BiInstallSinglePrinterPackageMSI_ColorPlusNT
BiInstallSinglePrinterPackageMSI_ColorPlusTS
BiInstallSinglePrinterPackageMSI_ColorTS
BiInstallSinglePrinterPackageMSI_EMFNT
BiInstallSinglePrinterPackageMSI_EMFTS
BiInstallSinglePrinterPackageMSI_PDFNT
BiInstallSinglePrinterPackageMSI_PDFTS
BiInstallSinglePrinterPackageMSI_TIFFNT
BiInstallSinglePrinterPackageMSI_TIFFTS
BiSetPortCount
CreateRegistryKeyForApplicationStarting
CreateRegistryKeyForApplicationStarting_ColorNT
CreateRegistryKeyForApplicationStarting_ColorPlusNT
CreateRegistryKeyForApplicationStarting_ColorPlusTS
CreateRegistryKeyForApplicationStarting_ColorTS
CreateRegistryKeyForApplicationStarting_EmfNT
CreateRegistryKeyForApplicationStarting_EmfTS
CreateRegistryKeyForApplicationStarting_MonoNT
CreateRegistryKeyForApplicationStarting_MonoTS
CreateRegistryKeyForApplicationStarting_PdfNT
CreateRegistryKeyForApplicationStarting_PdfTS
CreateRegistryKeyForProfiles
DrawMFCDialog
GetSystemDirectoryVB
IsRemoteSession
LoadHiveForSid
PrinterInstallMSI_ColorNT
PrinterInstallMSI_ColorPlusNT
PrinterInstallMSI_ColorPlusTS
PrinterInstallMSI_ColorTS
PrinterInstallMSI_EMFNT
PrinterInstallMSI_EMFTS
PrinterInstallMSI_PDFNT
PrinterInstallMSI_PDFTS
PrinterInstallMSI_TIFFNT
PrinterInstallMSI_TIFFTS
Test
UnLoadHiveForSid
dAddPort
dAddPortMonitor
dAddPrintProcessor
dAddPrinter
dAddPrinterDriver
dAddPrinterDriver2
dCheckRegistry
dClosePrinter
dCreateMonitorINI
dDeletePort
dDeletePortMonitor
dDeletePrintProcessor
dDeletePrinterDriver
dDocumentProperties
dExportPrnSettingsForAllUsers
dGetInstallType
dGetPrintProcessorDirectory
dGetPrintProcessorDirectoryVB
dGetPrintProcessorDirectoryVBExt
dGetPrinterCount
dGetPrinterDriverDirectory
dGetPrinterDriverDirectoryVB
dGetPrinterDriverDirectoryVBExt
dGetUsedPortCount
dInstallBlackIcePrinter
dInstallBlackIcePrinter2
dIsInstalledPrinter
dIsInstalledPrinterDriver
dIsPortInstalled
dIsPortMonitorInstalled
dIsPrintProcessorInstalled
dIsTerminalServicesEnabled
dPrinterPropeties
dPutPropertiesWindow
dSetParameter
dSetPrinterDriverTabs
dSetStartApplication
dShellExecute
dShowAndStoreDocumentSettings
dShowAndStorePrinterSettings
dStartTerminalServerInstallMode
dStopTerminalServerInstallMode
dUpdatePrinterManagerPDList

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 845KB - Virtual size: 845KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.giats
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 722KB - Virtual size: 722KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 193KB - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c077a1c6744b4cfc0709f8faeb875d13

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

6c:81:87:13:52:e7:de:81:c7:84:22:c8:34:b5:ca:3aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

5e:ad:6f:27:be:97:cb:40:b3:91:85:b0:be:64:70:99:cf:85:35:cb:68:a5:e4:b2:36:1b:4a:b1:3e:b8:6e:97Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

oledlg

oleacc

gdiplus

imm32

winmm

Exports

Exports

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 845KB - Virtual size: 845KB

.data Size: 31KB - Virtual size: 69KB

.gfids Size: 138KB - Virtual size: 137KB

.giats Size: 512B - Virtual size: 28B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 722KB - Virtual size: 722KB

.reloc Size: 193KB - Virtual size: 193KB

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

6c:81:87:13:52:e7:de:81:c7:84:22:c8:34:b5:ca:3a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

5e:ad:6f:27:be:97:cb:40:b3:91:85:b0:be:64:70:99:cf:85:35:cb:68:a5:e4:b2:36:1b:4a:b1:3e:b8:6e:97
Signer

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 845KB - Virtual size: 845KB

.data
Size: 31KB - Virtual size: 69KB

.gfids
Size: 138KB - Virtual size: 137KB

.giats
Size: 512B - Virtual size: 28B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 722KB - Virtual size: 722KB

.reloc
Size: 193KB - Virtual size: 193KB