C:\Users\mpast\Source\Repos\PrinterShare.Win\output\x86\Release\paConsole.pdb
Static task
static1
Behavioral task
behavioral1
Sample
06e25e5883b80a074bad13209427edd288bbd75d62bada8cd0aa04b6058f8f84.exe
Resource
win7-20240903-en
General
-
Target
06e25e5883b80a074bad13209427edd288bbd75d62bada8cd0aa04b6058f8f84
-
Size
734KB
-
MD5
1cffb73e3fac33734f97fad4f126997f
-
SHA1
a576d4369761687e3866597a0f86d8050534ae3f
-
SHA256
06e25e5883b80a074bad13209427edd288bbd75d62bada8cd0aa04b6058f8f84
-
SHA512
1f8c0bba0745f5af16a201209507e6af487c93b0e0f00b4edb856d91e7bd0af5c077aedbf173eea49f9337021bfd5caba548af0a03088296cc3504c421777cb7
-
SSDEEP
12288:C5kYx9y3AawviQfoL/nXAQTpOcnHJ4iqnuBMyGTBcs1jxbBjvrEH75t:gJiQfQX5TpOcnHJ4i+uBMSs1xhrEH75t
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 06e25e5883b80a074bad13209427edd288bbd75d62bada8cd0aa04b6058f8f84
Files
-
06e25e5883b80a074bad13209427edd288bbd75d62bada8cd0aa04b6058f8f84.exe windows:5 windows x86 arch:x86
755680a1926b5553526cd211411f2d8d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
gdiplus
GdipDrawImageI
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipGetImageGraphicsContext
GdipSaveImageToFile
GdiplusShutdown
GdiplusStartup
GdipDrawImageRectI
GdipSetPageUnit
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromFile
GdipFree
GdipGetImageWidth
GdipAlloc
comctl32
_TrackMouseEvent
ImageList_ReplaceIcon
ord17
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
rpcrt4
UuidCreate
UuidToStringW
RpcStringFreeW
mfc140u
ord11235
ord11021
ord9042
ord11333
ord10570
ord11169
ord11932
ord11935
ord11933
ord11934
ord6309
ord1408
ord11000
ord12216
ord7626
ord11905
ord3804
ord4487
ord6851
ord5816
ord13648
ord5174
ord13345
ord8072
ord1464
ord6122
ord2396
ord321
ord554
ord1658
ord12598
ord6178
ord1185
ord1703
ord7378
ord8171
ord2766
ord3691
ord3805
ord6102
ord9225
ord3054
ord9253
ord2594
ord12217
ord10498
ord1928
ord4108
ord3238
ord3031
ord926
ord6803
ord6380
ord2205
ord2307
ord2303
ord8470
ord7653
ord1472
ord8386
ord12247
ord10433
ord12928
ord12865
ord4589
ord7997
ord8324
ord5357
ord10147
ord10144
ord2486
ord12542
ord12541
ord14589
ord7922
ord14595
ord9398
ord4152
ord4090
ord12947
ord7941
ord2034
ord11983
ord11982
ord14466
ord12531
ord8000
ord14667
ord6348
ord14669
ord6350
ord14668
ord6349
ord995
ord6860
ord3852
ord5918
ord12239
ord8217
ord12251
ord12219
ord12932
ord5763
ord10250
ord14599
ord1447
ord968
ord1411
ord9377
ord4885
ord1391
ord890
ord4171
ord13087
ord6559
ord1693
ord4485
ord13654
ord8345
ord1689
ord8482
ord2389
ord291
ord4799
ord13048
ord8361
ord8713
ord4666
ord14365
ord2991
ord1530
ord300
ord316
ord2461
ord7027
ord5960
ord1713
ord4931
ord5007
ord4992
ord9127
ord8742
ord4220
ord10293
ord5172
ord13335
ord3146
ord6493
ord9131
ord1179
ord2753
ord14573
ord3874
ord2994
ord8745
ord4224
ord3189
ord6588
ord2304
ord11633
ord11392
ord5419
ord8746
ord4227
ord14377
ord3961
ord2526
ord3932
ord6607
ord8365
ord8811
ord13293
ord13086
ord6486
ord358
ord6489
ord898
ord6795
ord3882
ord2522
ord4882
ord6566
ord7509
ord6977
ord5669
ord5850
ord1108
ord4649
ord14047
ord450
ord3954
ord2520
ord5110
ord4323
ord293
ord2473
ord1186
ord12599
ord1659
ord8509
ord555
ord12763
ord3846
ord6531
ord4856
ord3236
ord7646
ord1133
ord6549
ord3833
ord14451
ord954
ord822
ord2477
ord1462
ord3369
ord3263
ord985
ord6850
ord9128
ord1070
ord3872
ord2993
ord8744
ord4222
ord5882
ord3147
ord6497
ord13473
ord5427
ord13544
ord14234
ord14137
ord12921
ord14405
ord14364
ord1526
ord290
ord11991
ord12317
ord12314
ord13110
ord1175
ord2889
ord5699
ord545
ord498
ord2457
ord3849
ord9135
ord1446
ord4236
ord3257
ord6834
ord7654
ord1353
ord5984
ord9132
ord1180
ord8067
ord4225
ord8062
ord5813
ord13656
ord13646
ord6589
ord9137
ord1448
ord4238
ord3259
ord6836
ord2215
ord2172
ord9126
ord1066
ord4219
ord3145
ord6490
ord7493
ord12131
ord6218
ord13752
ord2760
ord9210
ord12172
ord1111
ord9040
ord11015
ord11396
ord10472
ord4092
ord458
ord3403
ord3404
ord3164
ord7107
ord6129
ord6220
ord13756
ord3305
ord3302
ord10255
ord8210
ord2761
ord14785
ord10285
ord10287
ord10286
ord10284
ord10288
ord5652
ord11725
ord11726
ord9139
ord12089
ord3838
ord11936
ord14588
ord8965
ord12220
ord6978
ord11002
ord9256
ord3266
ord13878
ord12262
ord12258
ord1722
ord1744
ord1770
ord1756
ord1777
ord4936
ord5003
ord4948
ord4966
ord4960
ord4954
ord5013
ord4997
ord4942
ord5019
ord4974
ord4912
ord4927
ord4988
ord4502
ord5790
ord9693
ord4494
ord3055
ord14590
ord7923
ord14596
ord14507
ord8754
ord6877
ord4477
ord11717
ord13703
ord5935
ord2682
ord12124
ord3941
ord3371
ord3372
ord3265
ord12168
ord1002
ord8773
ord5249
ord5549
ord5760
ord9350
ord5525
ord5252
ord5411
ord5228
ord7722
ord7723
ord7712
ord5409
ord8219
ord9209
ord3697
ord3696
ord3816
ord1171
ord4884
ord3182
ord540
ord261
ord2246
ord14657
ord12405
ord14604
ord12348
ord6751
ord2378
ord2383
ord2385
ord8719
ord280
ord2458
ord1511
ord13028
ord14131
ord8817
ord7820
ord5422
ord4886
ord4881
ord1142
ord2885
ord14606
ord12351
ord5886
ord11962
ord500
ord4834
ord4815
ord8360
ord8757
ord8756
ord8712
ord12884
ord4664
ord2996
ord2990
ord5921
ord1687
ord1525
ord1523
ord1045
ord286
ord285
ord296
ord3009
ord12559
ord5109
ord1653
ord266
ord265
ord1513
ord1046
ord306
ord914
ord8977
ord2409
kernel32
WaitForSingleObject
CreateEventW
GetCurrentThreadId
TerminateThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
Sleep
OutputDebugStringA
ResetEvent
GetTempPathW
GetTempFileNameW
LockResource
LoadResource
SizeofResource
FindResourceW
RemoveDirectoryW
CreateMutexW
InterlockedIncrement
InterlockedDecrement
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
WriteFile
SetEvent
MoveFileW
GetFileAttributesW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetLocalTime
GetFileTime
GetVersionExW
LoadLibraryW
FreeLibrary
GetLocaleInfoW
GetModuleFileNameW
WideCharToMultiByte
MultiByteToWideChar
FindNextFileW
FindFirstFileW
DeleteFileW
CreateDirectoryW
GetModuleHandleW
FindClose
CreateThread
GetCurrentProcess
GetProcAddress
CreateFileW
ReadFile
CloseHandle
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
OutputDebugStringW
user32
GetMessagePos
GetDesktopWindow
MapWindowPoints
IsWindow
DrawIcon
SetMenuDefaultItem
DeleteMenu
RemoveMenu
CheckMenuItem
GetDC
ReleaseDC
DestroyIcon
GetParent
EnableWindow
LoadIconW
DrawTextExW
SetCursor
CopyRect
LoadBitmapW
LoadCursorW
GetSystemMetrics
KillTimer
LoadMenuW
DestroyMenu
RegisterWindowMessageW
GetCursorPos
GetWindowRect
SetForegroundWindow
SetTimer
GetFocus
IsIconic
SendMessageW
PostMessageW
InvalidateRect
LoadImageW
wsprintfW
PtInRect
OffsetRect
InflateRect
FrameRect
FillRect
DrawFocusRect
WindowFromPoint
ClientToScreen
AppendMenuW
EnableMenuItem
GetClientRect
SetRect
IsMenu
GetMenuStringW
GetMenuState
GetSubMenu
CreatePopupMenu
DrawFrameControl
DrawEdge
GetSysColor
ModifyMenuW
GetMenuItemCount
GetMenuItemID
gdi32
GetTextExtentExPointW
CreateSolidBrush
SetBkMode
BitBlt
CreateCompatibleBitmap
PatBlt
CreateFontIndirectW
GetCurrentObject
GetTextExtentPoint32W
SelectObject
CreateCompatibleDC
CreatePen
DeleteDC
DeleteObject
GetTextExtentPointW
LineTo
EndPage
StartPage
EndDoc
StartDocW
SetEnhMetaFileBits
PlayEnhMetaFileRecord
PlayEnhMetaFile
GetEnhMetaFileW
EnumEnhMetaFile
DeleteEnhMetaFile
GetObjectW
GetStockObject
GetDeviceCaps
CreateDCW
MoveToEx
SetTextColor
SetBkColor
msimg32
TransparentBlt
winspool.drv
ClosePrinter
DeviceCapabilitiesW
EnumPrintersW
DocumentPropertiesW
GetPrinterW
OpenPrinterW
advapi32
CloseServiceHandle
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
OpenSCManagerA
OpenServiceA
QueryServiceStatus
shell32
ShellExecuteExW
SHGetFolderPathW
ShellExecuteW
Shell_NotifyIconW
shlwapi
StrToIntW
PathFileExistsW
ole32
CoInitializeEx
ws2_32
WSASocketW
gethostbyname
gethostname
WSASend
WSARecv
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
WSAAccept
WSAGetLastError
WSACleanup
WSAStartup
listen
inet_addr
closesocket
bind
htons
WSAWaitForMultipleEvents
msvcp140
?_Xlength_error@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
_Thrd_id
_Mtx_init_in_situ
?_Random_device@std@@YAIXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?swap@?$basic_iostream@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?swap@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
??Bid@locale@std@@QAEIXZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
_Mtx_lock
_Mtx_destroy_in_situ
vcruntime140
memcpy
memmove
__std_exception_destroy
_except_handler4_common
__current_exception_context
_CxxThrowException
__current_exception
wcsstr
__std_terminate
__CxxFrameHandler3
_purecall
__std_exception_copy
memset
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
malloc
api-ms-win-crt-stdio-l1-1-0
fopen
__stdio_common_vfprintf
fflush
fgetc
ftell
fclose
ungetc
ferror
fgetpos
fputc
__stdio_common_vswprintf
_set_fmode
_filelength
_close
_get_stream_buffer_pointers
_wsopen_s
__p__commode
fread
__stdio_common_vswscanf
fsetpos
_fseeki64
fwrite
__stdio_common_vsprintf
setvbuf
api-ms-win-crt-convert-l1-1-0
atol
_wtoi
api-ms-win-crt-runtime-l1-1-0
_get_wide_winmain_command_line
_register_onexit_function
_initialize_onexit_table
terminate
_errno
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_exit
_invalid_parameter_noinfo_noreturn
_beginthreadex
exit
_invalid_parameter_noinfo
_controlfp_s
_initterm_e
_initterm
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_crt_atexit
api-ms-win-crt-filesystem-l1-1-0
_waccess
_lock_file
_unlock_file
api-ms-win-crt-math-l1-1-0
_fdopen
__setusermatherr
round
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64_s
_localtime64_s
_gmtime64
wcsftime
_mktime64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
_wsetlocale
Sections
.text Size: 310KB - Virtual size: 309KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 125KB - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 204KB - Virtual size: 203KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ