H:\rc_v12_per_plu_241025\Build\Release\WPSOffice\office6\addons\kpdf2wordv3\kspdf.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8eb3f7a87e9f33f64793dde4bbe4c63d97b600fdecc00cf77341abbe27d69553.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8eb3f7a87e9f33f64793dde4bbe4c63d97b600fdecc00cf77341abbe27d69553.dll
Resource
win10v2004-20250129-en
General
-
Target
8eb3f7a87e9f33f64793dde4bbe4c63d97b600fdecc00cf77341abbe27d69553.dll
-
Size
62.0MB
-
MD5
c878951a604018f259ac092ff2251a98
-
SHA1
b5a1a4cd2b88ed67adcb6293e54c1b13953c6f19
-
SHA256
8eb3f7a87e9f33f64793dde4bbe4c63d97b600fdecc00cf77341abbe27d69553
-
SHA512
c827468238bea1de6fabcd46f45a62accdaba62d4f3506f4baba15b846d47fcd1a21134700639f55ee532a6b38fa769df0c12e5f568b49ab8d7e8a2628068a05
-
SSDEEP
1572864:9YsjkeZwu3B4RHLqyzWZvbYF8WNLKUnBDUpG5FQ:vIfzW6xBK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8eb3f7a87e9f33f64793dde4bbe4c63d97b600fdecc00cf77341abbe27d69553.dll
Files
-
8eb3f7a87e9f33f64793dde4bbe4c63d97b600fdecc00cf77341abbe27d69553.dll.dll windows:5 windows x86 arch:x86
9e2cbd6d5f1b3c169491a4250a8cd622
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetModuleHandleW
LoadLibraryW
CloseHandle
GetLastError
CreateMutexW
GetTempFileNameW
GetModuleFileNameW
GetProcAddress
LocalFree
GetCurrentProcess
GlobalMemoryStatusEx
GetWindowsDirectoryW
IsWow64Process
FreeLibrary
CopyFileW
Sleep
GetLocaleInfoA
GetThreadLocale
GetSystemTime
CreateSemaphoreA
ResumeThread
SuspendThread
ReleaseSemaphore
GetTimeZoneInformation
QueryPerformanceFrequency
TlsFree
FindFirstFileA
GetTempFileNameA
GetTempPathA
SetFileAttributesA
RemoveDirectoryA
CreateDirectoryA
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitOnceComplete
InitOnceBeginInitialize
GetCurrentThread
RemoveDirectoryW
ExitProcess
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
IsDBCSLeadByte
InitializeCriticalSection
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventA
WaitForSingleObject
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
GetSystemDirectoryA
VerifyVersionInfoA
LoadLibraryA
VerifyVersionInfoW
VerSetConditionMask
GetACP
SetLastError
FileTimeToSystemTime
WriteFile
SetFilePointerEx
SetEndOfFile
ReadFile
GetFileTime
GetFileSizeEx
GetFileAttributesW
GetFileAttributesA
FlushFileBuffers
DeleteFileW
DeleteFileA
CreateFileW
CreateFileA
FindNextFileW
FindNextFileA
FindFirstFileExW
FindClose
lstrlenA
MultiByteToWideChar
WideCharToMultiByte
GetWindowsDirectoryA
GetLocalTime
GetTempPathW
GetCurrentThreadId
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
RaiseException
LoadLibraryExW
Exports
Exports
AlphaBlend
??4XmlFxSetGlobalMapperRecoverHelper@@QAEAAV0@ABV0@@Z
EntryPoint
GenerateTextWatermarkThumbnail
KSPdfFunction
PDFModuleDestroy
PDFModuleInit
Sections
.text Size: 15.9MB - Virtual size: 15.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16.9MB - Virtual size: 16.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 398KB - Virtual size: 820KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 136KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 28.6MB - Virtual size: 28.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ