XpsToPwgrConverter[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
XpsToPwgrConverter.dll
Size 116KB
Sample260812-jqv2csbc86
SHA256 cf1a22f1ad77d83589c31636ae31b6bb078f3e6bcdfed847c055b001db3bbd7e
MD5 2e747ba206f7f6b0aac8ab687caebaf8
SHA1 a8114f7f078ec15a93baebc1f3fad2371c57e06e
SHA512 d54a15b5ef531d8c20ccb174f623ac2be4350e2c849d42d4b0f37bbfc53b2b9ce2f1d30caed680a41c5d923630855054bc23960caa9788c62cc2965473c66af4
SSDEEP 3072:fJW4Q5HoBUmtb+8AFtZy/NZjAv4ZV9qO:f84oHoimt4vYV9q
TLSH
T13BC3396E76AC10E5E572D03CC9934E1AD3B2B065232257DF03A081BE5F27BE46C39B65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XpsToPwgrConverter.dll

File Explorer

XpsToPwgrConverter.dll

.dll 116KB

XpsToPwgrConverter.dll

IMPHASH 1c14d6dd849167ba57a7f2bde7735f3a
SHA256 cf1a22f1ad77d83589c31636ae31b6bb078f3e6bcdfed847c055b001db3bbd7e
MD5 2e747ba206f7f6b0aac8ab687caebaf8
SHA1 a8114f7f078ec15a93baebc1f3fad2371c57e06e
SHA512 d54a15b5ef531d8c20ccb174f623ac2be4350e2c849d42d4b0f37bbfc53b2b9ce2f1d30caed680a41c5d923630855054bc23960caa9788c62cc2965473c66af4
SSDEEP 3072:fJW4Q5HoBUmtb+8AFtZy/NZjAv4ZV9qO:f84oHoimt4vYV9q
TLSH
T13BC3396E76AC10E5E572D03CC9934E1AD3B2B065232257DF03A081BE5F27BE46C39B65
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

XpsToPwgrConverter.pdb

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initterm

api-ms-win-crt-private-l1-1-0

_o__callnewh _o__cexit _o__configure_narrow_argv _o__crt_atexit _o__errno _o__execute_onexit_table _o__initialize_narrow_environment _o__initialize_onexit_table _o__invalid_parameter_noinfo _o__invalid_parameter_noinfo_noreturn _o__purecall _o__register_onexit_function _o__seh_filter_dll memmove _o_abort _o_free _o_iswspace _o_malloc __C_specific_handler __CxxFrameHandler3 _o___std_type_info_destroy_list _CxxThrowException _o___std_exception_destroy _o___std_exception_copy _o___stdio_common_vswprintf __std_terminate __CxxFrameHandler4 memcmp memcpy

api-ms-win-crt-string-l1-1-0

memset

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls GetModuleHandleW GetModuleFileNameA GetProcAddress GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection InitializeCriticalSectionEx ReleaseSemaphore EnterCriticalSection DeleteCriticalSection AcquireSRWLockShared CreateMutexExW ReleaseSRWLockShared OpenSemaphoreW WaitForSingleObjectEx AcquireSRWLockExclusive ReleaseSRWLockExclusive ReleaseMutex WaitForSingleObject CreateSemaphoreExW

api-ms-win-core-heap-l1-1-0

HeapFree GetProcessHeap HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter GetLastError

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer SetThreadpoolTimer CreateThreadpoolTimer WaitForThreadpoolTimerCallbacks

api-ms-win-core-processthreads-l1-1-0

TerminateProcess GetCurrentProcessId GetCurrentProcess GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW IsDebuggerPresent DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

windowscodecs

WICConvertBitmapSource

oleaut32

SysFreeString SetErrorInfo SysStringLen

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler

Name

.text

Size

68KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

fothk

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

24KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

468B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

XpsToPwgrConverter.dll

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-processthreads-l1-1-1

msvcp_win

api-ms-win-eventing-provider-l1-1-0

windowscodecs

oleaut32

api-ms-win-core-com-l1-1-0

generic