PrintSpoofer64.exe
First submission 2024-10-11 21:42:03
File details
| File type: | PE32+ executable (console) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 26.5 KB (27136 bytes) |
| Compile time: | 2020-09-10 19:43:27 |
| MD5: | 108da75de148145b8f056ec0827f1665 |
| SHA1: | 188098b9caf3bc4d1b68dcad50d2e1cbd2e9d519 |
| SHA256: | 8524fbc0d73e711e69d60c64f1f1b7bef35c986705880643dd4d5e17779e586d |
| Import Hash : | 545a81240793f9ca97306fa5b3ad76df |
| Sections 6 | .text .rdata .data .pdata .rsrc .reloc |
| Directories 4 | import resource debug relocation |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
| Virus Total: | 58/77 VT report date: 2024-09-23 11:58:01 |
| Malware Type 2 | hacktool trojan |
| Threat Type 3 | printspoofer printer expl |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://34.142.201.103:8443/PrintSpoofer64.exe  |
34.142.201.103 |
2024-10-11 21:42:03 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x1da8 | 7680 | ba65a9639ef6e2d14fe81750b8415ac67568f2d3 | b9328487d16792e446669718942b1f30 | |
| .rdata | 0x3000 | 0x3d16 | 15872 | ea68d8197f6b41f2596fe645446f4ed5ca5f5872 | 473ad5e2580a6798c7b3984145d0db3d | |
| .data | 0x7000 | 0x650 | 512 | 599b17bf94a08deb831c54748da8a829caf16fd9 | df472dc55d3b30057eb5fc703f6e33fa | |
| .pdata | 0x8000 | 0x2ac | 1024 | bf544d1d6360501c34fc747f4a269839ef22b291 | 74f16c2146368d9c8d960f0ce5da4cff | |
| .rsrc | 0x9000 | 0x1e0 | 512 | 53b0a43a879cf778730d8bd7309f76d73d40a678 | fb20ae2a7910d36ef7e1ed0b22953dbf | |
| .reloc | 0xa000 | 0x128 | 512 | c134954e542841b3b04cb0bb4b42cbe25597d047 | 153660ca73c2cf8a68d0777ebbba0adc |
PE Resources 1
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x9060 | 381 |
Packers detected 1
| Microsoft Visual C++ 8.0 (DLL) |
Anti debug functions 5
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Library |
| api-ms-win-crt-math-l1-1-0.dll |
| api-ms-win-crt-runtime-l1-1-0.dll |
| api-ms-win-crt-string-l1-1-0.dll |
| USERENV.dll |
| KERNEL32.dll |
| api-ms-win-crt-locale-l1-1-0.dll |
| vcruntime140.dll |
| api-ms-win-crt-convert-l1-1-0.dll |
| api-ms-win-crt-stdio-l1-1-0.dll |
| api-ms-win-crt-heap-l1-1-0.dll |
| ADVAPI32.dll |
| rpcrt4.dll |
Strings analysis - Possible IPs found 1
| 10.10.13.37 |
Import functions
api-ms-win-crt-heap-l1-1-0.dll 3
api-ms-win-crt-convert-l1-1-0.dll 1
api-ms-win-crt-string-l1-1-0.dll 1
api-ms-win-crt-runtime-l1-1-0.dll 18
KERNEL32.dll 25
VCRUNTIME140.dll 4
ADVAPI32.dll 13
RPCRT4.dll 7
api-ms-win-crt-stdio-l1-1-0.dll 6
api-ms-win-crt-locale-l1-1-0.dll 1
api-ms-win-crt-math-l1-1-0.dll 1
USERENV.dll 2