d41ef00cb66fc52a0eea3cbe08bb717bda87f005195e1012b4561a7b0cb1afeb

Sharing

Copy URL Twitter E-mail

General

Target
d41ef00cb66fc52a0eea3cbe08bb717bda87f005195e1012b4561a7b0cb1afeb
Size 1.4MB
Sample260828-seqryayzax
SHA256 d41ef00cb66fc52a0eea3cbe08bb717bda87f005195e1012b4561a7b0cb1afeb
MD5 fc982c12c4475c0f24ec13b5ec924ded
SHA1 5a6a28772ee2070ca0916440fc045ae35ecb8e8e
SHA512 547e2aa0c74c73d5f999d66092446378ee1325bd8655981f9068a7d1eb2c092afb7bd8e0c72ffb99bb20b755aed01e7a0805629b17343e5e2be86b4ae6430b38
SSDEEP 12288:XbRuVz/nTJsc9CRKm5vgNO0swIN+jUGTVG/PyYU01GjKADNcpF3yHEMFxg:rRuNnTJsjD5qswIJHnUUHAym
TLSH
T17F65E0213BD98172F5E342B06DF9A779A179FC384F2582DB63884B5E58306D62D31F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d41ef00cb66fc52a0eea3cbe08bb717bda87f005195e1012b4561a7b0cb1afeb

File Explorer

d41ef00cb66fc52a0eea3cbe08bb717bda87f005195e1012b4561a7b0cb1afeb

.exe 1.4MB

d41ef00cb66fc52a0eea3cbe08bb717bda87f005195e1012b4561a7b0cb1afeb

IMPHASH 39c0092011997f5b04b4c7c31fba949e
SHA256 d41ef00cb66fc52a0eea3cbe08bb717bda87f005195e1012b4561a7b0cb1afeb
MD5 fc982c12c4475c0f24ec13b5ec924ded
SHA1 5a6a28772ee2070ca0916440fc045ae35ecb8e8e
SHA512 547e2aa0c74c73d5f999d66092446378ee1325bd8655981f9068a7d1eb2c092afb7bd8e0c72ffb99bb20b755aed01e7a0805629b17343e5e2be86b4ae6430b38
SSDEEP 12288:XbRuVz/nTJsc9CRKm5vgNO0swIN+jUGTVG/PyYU01GjKADNcpF3yHEMFxg:rRuNnTJsjD5qswIJHnUUHAym
TLSH
T17F65E0213BD98172F5E342B06DF9A779A179FC384F2582DB63884B5E58306D62D31F22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

115824

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\agent\_work\1\s\PrintAlwaysWorks\src\DesktopExtension\UAP\HPPrintScanDoctorService.pdb

kernel32

GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW SetUnhandledExceptionFilter FindFirstFileW GetFileInformationByHandleEx UnhandledExceptionFilter CopyFileW FindClose OpenProcess GetLastError QueryPerformanceCounter AreFileApisANSI WTSGetActiveConsoleSessionId WideCharToMultiByte ClosePackageInfo InitOnceComplete FindPackagesByPackageFamily EnterCriticalSection GetPackageInfo InitOnceBeginInitialize TerminateProcess OpenPackageInfoByFullName GetPackageId FormatMessageW LocalFree LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection ResetEvent WaitForSingleObjectEx GetTempPathW CreateMutexW LocalAlloc RegisterWaitUntilOOBECompleted ReleaseMutex UnregisterWaitUntilOOBECompleted CreateEventW Sleep FormatMessageA SetEvent SubmitThreadpoolWork OOBEComplete CreateProcessW CreateThreadpoolWork IsProcessorFeaturePresent GetTempFileNameW CreateFileW GetProcessHeap HeapFree HeapAlloc InterlockedPushEntrySList GetModuleFileNameW LoadLibraryW GetProcAddress GetPackagePathByFullName FreeLibrary FindNextFileW K32GetModuleFileNameExW CloseHandle GetFileAttributesW SetFileAttributesW GetCurrentProcess DeleteFileW K32EnumProcesses WaitForSingleObject

api-ms-win-crt-runtime-l1-1-0

terminate _controlfp_s _crt_atexit _register_onexit_function _initialize_onexit_table _invalid_parameter_noinfo_noreturn _get_narrow_winmain_command_line _errno _invalid_parameter_noinfo _register_thread_local_exe_atexit_callback _c_exit _cexit abort _seh_filter_exe _set_app_type _beginthreadex _exit _initterm_e _initterm exit _configure_narrow_argv _initialize_narrow_environment

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _callnewh malloc realloc

api-ms-win-crt-string-l1-1-0

iswspace wcscpy_s strnlen towlower wcsnlen wcstok

vcruntime140

memcpy __std_exception_destroy __std_terminate memmove __std_exception_copy _CxxThrowException wcsstr __current_exception __current_exception_context memset _except_handler4_common __std_type_info_compare __std_type_info_name _purecall __CxxFrameHandler3

msvcp140

_Cnd_destroy_in_situ _Cnd_broadcast _Cnd_wait _Cnd_register_at_thread_exit ?__ExceptionPtrRethrow@@YAXPBX@Z ?__ExceptionPtrCurrentException@@YAXPAX@Z ?__ExceptionPtrDestroy@@YAXPAX@Z ?__ExceptionPtrToBool@@YA_NPBX@Z ?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z ?_Throw_future_error@std@@YAXABVerror_code@1@@Z ?__ExceptionPtrCopy@@YAXPAXPBX@Z _Cnd_init_in_situ ?__ExceptionPtrCreate@@YAXPAX@Z _Cnd_unregister_at_thread_exit ??0task_continuation_context@Concurrency@@AAE@XZ ?_CallInContext@_ContextCallback@details@Concurrency@@QBEXV?$function@$$A6AXXZ@std@@_N@Z _Cnd_signal ?_Xinvalid_argument@std@@YAXPBD@Z ?_Reset@_ContextCallback@details@Concurrency@@AAEXXZ ?_Capture@_ContextCallback@details@Concurrency@@AAEXXZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AAEXXZ ?_Release_chore@details@Concurrency@@YAXPAU_Threadpool_chore@12@@Z ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QAEX_N@Z ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_Schedule_chore@details@Concurrency@@YAHPAU_Threadpool_chore@12@@Z ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?__ExceptionPtrAssign@@YAXPAXPBX@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?_Xlength_error@std@@YAXPBD@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?_Xout_of_range@std@@YAXPBD@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exception@std@@YA_NXZ ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?_Throw_C_error@std@@YAXH@Z ?_Syserror_map@std@@YAPBDH@Z _Mtx_destroy_in_situ _Mtx_lock _Mtx_init_in_situ _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Mtx_unlock ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z

advapi32

QueryServiceStatus QueryServiceStatusEx RegisterServiceCtrlHandlerExW CloseServiceHandle SetServiceStatus ChangeServiceConfig2W StartServiceCtrlDispatcherW SetSecurityDescriptorDacl OpenSCManagerW SetEntriesInAclW CreateWellKnownSid DeleteService InitializeSecurityDescriptor OpenServiceW EventRegister EventUnregister EventWrite CreateProcessAsUserW RevertToSelf AllocateAndInitializeSid ImpersonateLoggedOnUser OpenProcessToken FreeSid SetThreadToken DuplicateTokenEx ControlService

userenv

DestroyEnvironmentBlock ExpandEnvironmentStringsForUserW CreateEnvironmentBlock

wtsapi32

WTSQueryUserToken

shell32

SHGetKnownFolderPath

rpcrt4

NdrClientCall2 NdrServerCall2 RpcServerInqBindings RpcEpRegisterW RpcMgmtStopServerListening RpcBindingVectorFree RpcEpUnregister RpcServerListen RpcMgmtWaitServerListen RpcServerInqCallAttributesW RpcServerRegisterIf3 RpcServerUnregisterIf RpcServerUseProtseqEpW RpcImpersonateClient RpcRevertToSelf

api-ms-win-appmodel-runtime-l1-1-1

GetStagedPackageOrigin

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec

ole32

CoInitializeSecurity CoInitializeEx CoIncrementMTAUsage

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vswprintf __stdio_common_vsprintf __stdio_common_vswprintf_s

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-convert-l1-1-0

mbstowcs_s wcstol

wintrust

WTHelperGetProvSignerFromChain WinVerifyTrust WTHelperGetProvCertFromChain WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

oleaut32

GetErrorInfo SysStringLen SysFreeString SysAllocString SetErrorInfo

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference WindowsGetStringRawBuffer

??0Launcher@Services@Server@Bridge@Hp@@QAE@ABV01234@@Z ??0Launcher@Services@Server@Bridge@Hp@@QAE@XZ ??1Launcher@Services@Server@Bridge@Hp@@QAE@XZ ??4Launcher@Services@Server@Bridge@Hp@@QAEAAV01234@ABV01234@@Z ?GetAbsolutePathForUWPAlias@Launcher@Services@Server@Bridge@Hp@@AAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V67@@Z ?GetOriginAndBuildNumberByFamilyName@Launcher@Services@Server@Bridge@Hp@@AAE?AV?$tuple@HH@std@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@7@@Z ?GetOriginAndBuildNumberByFullName@Launcher@Services@Server@Bridge@Hp@@AAE?AV?$tuple@HH@std@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@7@@Z ?GetPackageFullNameByFamilyName@Launcher@Services@Server@Bridge@Hp@@AAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V67@V?$shared_ptr@X@7@@Z ?GetPackageFullNameByFamilyName@Launcher@Services@Server@Bridge@Hp@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V67@@Z ?GetPackageInstalledPathByFullName@Launcher@Services@Server@Bridge@Hp@@AAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V67@@Z ?GetPackageInstalledPathByFullName@Launcher@Services@Server@Bridge@Hp@@AAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V67@V?$shared_ptr@X@7@@Z ?GetPathExpandedImpersonatedAsCurrentUser@Launcher@Services@Server@Bridge@Hp@@AAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V67@V?$shared_ptr@X@7@@Z ?GetUserTokenForCurrentUser@Launcher@Services@Server@Bridge@Hp@@QAE?AV?$shared_ptr@X@std@@W4_TOKEN_TYPE@@@Z ?Run@Launcher@Services@Server@Bridge@Hp@@QAE_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z ?RunExeAsUser@Launcher@Services@Server@Bridge@Hp@@QAE_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0V?$shared_ptr@X@7@0@Z ?RunExeAsUser@Launcher@Services@Server@Bridge@Hp@@QAE_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0V?$shared_ptr@X@7@0AAK@Z

Sharing

General

Malware Config

Signatures

File Explorer

d41ef00cb66fc52a0eea3cbe08bb717bda87f005195e1012b4561a7b0cb1afeb

kernel32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

vcruntime140

msvcp140

advapi32

userenv

wtsapi32

shell32

rpcrt4

api-ms-win-appmodel-runtime-l1-1-1

api-ms-win-core-path-l1-1-0

ole32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

wintrust

crypt32

version

oleaut32

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

generic