O:\src\pywin32\build\temp.win-amd64-3.5\Release\win32print.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4d3d85e545d662ddd23585bf8b6cf1fad36e2658bfc7919c1cf0a79d47e8fcf0N.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4d3d85e545d662ddd23585bf8b6cf1fad36e2658bfc7919c1cf0a79d47e8fcf0N.dll
Resource
win10v2004-20241007-en
General
-
Target
4d3d85e545d662ddd23585bf8b6cf1fad36e2658bfc7919c1cf0a79d47e8fcf0N
-
Size
72KB
-
MD5
e73111fa4fcfefde037f74506d474aa0
-
SHA1
1b91591cd860e81a56fe1e9539a980a9b8a4bfd6
-
SHA256
4d3d85e545d662ddd23585bf8b6cf1fad36e2658bfc7919c1cf0a79d47e8fcf0
-
SHA512
eb75cea03d6438893bd42b53f9f98f39c8d346ef29cc683c95abc46d65998c87f295b0aad0ad06c9aa94807a0cc14cac02917dc09f5938fc9264cda902ca9f78
-
SSDEEP
1536:VxlN8zHw7sxDccc1aEbpBz9/qBQgpGeuWw3pX4RH:MzQYxDcBkQgHuWw3x4RH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d3d85e545d662ddd23585bf8b6cf1fad36e2658bfc7919c1cf0a79d47e8fcf0N
Files
-
4d3d85e545d662ddd23585bf8b6cf1fad36e2658bfc7919c1cf0a79d47e8fcf0N.dll windows:6 windows x64 arch:x64
f59cc5ba4f1acd230c15cd7e2ac15e1a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
winspool.drv
EnumPrintProcessorsW
DeletePrinterDriverW
EnumPrinterDriversW
DeviceCapabilitiesW
SetPrinterW
AddPrinterW
EnumPrintProcessorDatatypesW
StartDocPrinterW
StartPagePrinter
WritePrinter
EndPagePrinter
AbortPrinter
EndDocPrinter
DocumentPropertiesW
ClosePrinter
AddPrinterConnectionW
GetPrinterW
DeletePrinterConnectionW
EnumJobsW
GetJobW
SetJobW
OpenPrinterW
EnumPrintersW
DeletePrinter
user32
SendNotifyMessageW
gdi32
StartDocW
EndDoc
StartPage
EndPage
AbortDoc
GetDeviceCaps
python35
PyLong_FromLong
PyLong_FromUnsignedLong
PyLong_AsLong
PyTuple_New
PyTuple_SetItem
PyBytes_AsStringAndSize
PyModule_GetDict
PyErr_SetString
PyErr_Occurred
PyErr_Clear
PyErr_NoMemory
PyErr_Format
PyDict_SetItemString
PyArg_ParseTuple
PyArg_ParseTupleAndKeywords
Py_BuildValue
PyModule_Create2
PyExc_ValueError
PyExc_TypeError
PyExc_NotImplementedError
PyExc_RuntimeError
PyExc_MemoryError
PyDict_Type
_Py_NoneStruct
PyEval_RestoreThread
PyEval_SaveThread
pywintypes35
?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z
?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z
?PyWinObject_FreeWCHAR@@YAXPEA_W@Z
?PyWinObject_AsReadBuffer@@YAHPEAU_object@@PEAPEAXPEAKH@Z
?PyWinObject_FromMultipleString@@YAPEAU_object@@PEA_W@Z
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_WH@Z
?PyWinObject_FromSYSTEMTIME@@YAPEAU_object@@AEBU_SYSTEMTIME@@@Z
?PyWinObject_FromFILETIME@@YAPEAU_object@@AEBU_FILETIME@@@Z
?PyWinObject_AsSYSTEMTIME@@YAHPEAU_object@@PEAU_SYSTEMTIME@@@Z
?PyWinObject_AsDEVMODE@@YAHPEAU_object@@PEAPEAU_devicemodeW@@H@Z
?PyWinObject_FromDEVMODE@@YAPEAU_object@@PEAU_devicemodeW@@@Z
?PyWinObject_AsSECURITY_DESCRIPTOR@@YAHPEAU_object@@PEAPEAXH@Z
?PyWinObject_FromSECURITY_DESCRIPTOR@@YAPEAU_object@@PEAX@Z
?PyWinObject_AsHANDLE@@YAHPEAU_object@@PEAPEAX@Z
?PyWinGlobals_Ensure@@YAHXZ
??0PyHANDLE@@QEAA@PEAX@Z
??1PyHANDLE@@UEAA@XZ
?PyHANDLEType@@3U_typeobject@@A
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z
kernel32
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
IsDebuggerPresent
GetCurrentProcessId
QueryPerformanceCounter
WriteProfileStringW
GetProfileStringW
LoadLibraryW
GetLastError
GetProcAddress
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
GetCurrentThreadId
UnhandledExceptionFilter
vcruntime140
wcschr
memcpy
memset
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__C_specific_handler
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__std_type_info_destroy_list
__CxxFrameHandler3
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_seh_filter_dll
_initialize_narrow_environment
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
terminate
_initialize_onexit_table
Exports
Exports
PyInit_win32print
Sections
.text Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 860B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ