PrintFilterPipelineSvc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bc5754b0dd16c3cea58e7861d6f514901f77108720e99777d053b7d3566b8af2N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bc5754b0dd16c3cea58e7861d6f514901f77108720e99777d053b7d3566b8af2N.exe
Resource
win10v2004-20240802-en
General
-
Target
bc5754b0dd16c3cea58e7861d6f514901f77108720e99777d053b7d3566b8af2N
-
Size
575KB
-
MD5
dc4b4fe825e4f6854326b9cf37496ec0
-
SHA1
e0c98369e73686faff1e9b5dc92fd6fe1b3de0e8
-
SHA256
bc5754b0dd16c3cea58e7861d6f514901f77108720e99777d053b7d3566b8af2
-
SHA512
bed502c2cea4e2e700811d8a829385658b19ff77062ecc69593bbab5e5d7752e0763415eb61e3e077b0a9db86b951ec9000bf7ce116939e1f871e56af3560c75
-
SSDEEP
12288:b/suEOt52ITtbVGHBT9YqqjX8Hh62W3paCSmX2Z7C2S6vG:TPFpm9YPX8B62W3paCSmX2Z7fSe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bc5754b0dd16c3cea58e7861d6f514901f77108720e99777d053b7d3566b8af2N
Files
-
bc5754b0dd16c3cea58e7861d6f514901f77108720e99777d053b7d3566b8af2N.exe windows:5 windows x86 arch:x86
b359d783aa409cabdcbb1e680d3fc8fc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
TraceMessage
RegCloseKey
RegSetValueExW
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyExW
LsaNtStatusToWinError
LsaClose
LsaStorePrivateData
LsaOpenPolicy
MapGenericMask
AccessCheck
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
OpenProcessToken
SetThreadToken
RegisterEventSourceW
ReportEventW
OpenThreadToken
kernel32
FreeLibrary
GetProcAddress
LoadLibraryExW
CloseHandle
WaitForSingleObject
lstrlenW
lstrcpyW
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
Sleep
GetModuleFileNameW
OutputDebugStringW
OutputDebugStringA
IsDebuggerPresent
CreateThread
CreateEventW
lstrcpynW
lstrcatW
GetCurrentThreadId
SetEvent
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
GetModuleHandleW
GetCommandLineW
RtlCaptureStackBackTrace
CreateFileW
CopyFileW
GetWindowsDirectoryW
GetSystemDirectoryW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
GetLastError
HeapReAlloc
ExitProcess
GetModuleHandleA
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
VirtualQuery
VirtualAlloc
IsBadWritePtr
HeapSize
LoadLibraryA
SetFilePointer
WideCharToMultiByte
IsBadReadPtr
IsBadCodePtr
LCMapStringA
LCMapStringW
SetStdHandle
VirtualProtect
GetSystemInfo
GetCPInfo
GetStringTypeA
GetStringTypeW
FlushFileBuffers
DeleteTimerQueueEx
RegisterWaitForSingleObject
InterlockedCompareExchange
UnregisterWaitEx
GetOEMCP
GetLocaleInfoW
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
CreateTimerQueueTimer
DeleteTimerQueueTimer
InitializeCriticalSectionAndSpinCount
FormatMessageW
ReadFile
WaitForMultipleObjects
DebugBreak
SetFilePointerEx
SetEndOfFile
LoadLibraryW
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
CreateSemaphoreW
QueueUserWorkItem
ResetEvent
ReleaseSemaphore
GetCurrentThread
LocalFree
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
RtlUnwind
CreateTimerQueue
user32
DispatchMessageW
CharNextW
TranslateMessage
LoadStringW
GetMessageW
PostThreadMessageW
oleaut32
SetErrorInfo
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocStringLen
GetErrorInfo
VariantCopy
VariantClear
VariantInit
SysAllocString
SysFreeString
ole32
CreateStreamOnHGlobal
IIDFromString
CoGetObjectContext
CoCreateGuid
CoImpersonateClient
CoSuspendClassObjects
CoUninitialize
CoInitializeEx
CoTaskMemRealloc
StringFromGUID2
CoResumeClassObjects
CoRevertToSelf
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
winspool.drv
SeekPrinter
WritePrinter
GetPrinterDriverDirectoryW
ClosePrinter
AddPrintProcessorW
AddPrinterW
ReadPrinter
StartPagePrinter
EndPagePrinter
StartDocPrinterW
XcvDataW
OpenPrinterW
AddPrinterDriverExW
GetPrinterDataW
SetJobW
EndDocPrinter
DocumentPropertiesW
ntdll
memset
psapi
GetModuleInformation
EnumProcessModules
GetModuleFileNameExW
setupapi
SetupCopyOEMInfW
prntvpt
ord9
ord4
ord2
Sections
.text Size: 559KB - Virtual size: 558KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ