PrintSpoofer64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
PrintSpoofer64.exe
Size 26KB
Sample260930-ptefnsvy5j
SHA256 8524fbc0d73e711e69d60c64f1f1b7bef35c986705880643dd4d5e17779e586d
MD5 108da75de148145b8f056ec0827f1665
SHA1 188098b9caf3bc4d1b68dcad50d2e1cbd2e9d519
SHA512 703da4d914f05258c45acbc5dcbbf9fc295702896471047d74574b001fb85bb68312798420903234ef6523b0a84cddc0a31177ceb6b775cb03e85b65a1d0cd8b
SSDEEP 384:RYCVNMxCkddWDBJJdVOpAdoKRCqjOOhbsezKMlhtY:RHNMBdyBJJdRlq
TLSH
T1B7C26347B3F504E8F5B79230C97B0531AB7BF8126632A79F12A040190E76695EF34F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PrintSpoofer64.exe

File Explorer

PrintSpoofer64.exe

.exe 26KB

PrintSpoofer64.exe

IMPHASH 545a81240793f9ca97306fa5b3ad76df
SHA256 8524fbc0d73e711e69d60c64f1f1b7bef35c986705880643dd4d5e17779e586d
MD5 108da75de148145b8f056ec0827f1665
SHA1 188098b9caf3bc4d1b68dcad50d2e1cbd2e9d519
SHA512 703da4d914f05258c45acbc5dcbbf9fc295702896471047d74574b001fb85bb68312798420903234ef6523b0a84cddc0a31177ceb6b775cb03e85b65a1d0cd8b
SSDEEP 384:RYCVNMxCkddWDBJJdVOpAdoKRCqjOOhbsezKMlhtY:RHNMBdyBJJdRlq
TLSH
T1B7C26347B3F504E8F5B79230C97B0531AB7BF8126632A79F12A040190E76695EF34F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8820

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ConnectNamedPipe GetComputerNameW CreateThread CloseHandle GetCurrentThread GetLastError CreateEventW GetSystemDirectoryW WaitForSingleObject CreateNamedPipeW GetCurrentProcess IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleHandleW

advapi32

OpenThreadToken AdjustTokenPrivileges RevertToSelf SetTokenInformation LookupPrivilegeNameW CreateProcessWithTokenW OpenProcessToken ImpersonateNamedPipeClient InitializeSecurityDescriptor CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW DuplicateTokenEx GetTokenInformation

rpcrt4

UuidCreate RpcBindingFree RpcStringBindingComposeW NdrClientCall3 UuidToStringW RpcBindingFromStringBindingW RpcStringFreeW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

vcruntime140

__C_specific_handler memset __current_exception_context __current_exception

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf _set_fmode __p__commode __acrt_iob_func __stdio_common_vswprintf fflush

api-ms-win-crt-string-l1-1-0

_wcsicmp

api-ms-win-crt-convert-l1-1-0

wcstoul

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

__p___argc _seh_filter_exe _set_app_type _c_exit _cexit _crt_atexit terminate _initialize_onexit_table _configure_wide_argv _exit __p___wargv _initialize_wide_environment _register_thread_local_exe_atexit_callback _register_onexit_function exit _initterm_e _initterm _get_initial_wide_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale