DPFPApi[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

DPFPApi.dll
Size

544KB
MD5

5710ad44cca6f44883c43f6e518c05a5
SHA1

ed6cab26a10308900ae07dccb7725909f076743a
SHA256

13feb80be6516beba811723c986039cfe3cd0c0026978d4fd0bda766154035d8
SHA512

f2082bf36da1237bce2383e8d3da22d6c3bf0ee3fad65a4f6a2ecfad3d7501b68e91ee9672387c1d83c2c522ba6714b3fcf8a0bcd50e1afe87ea5c1bd21827eb
SSDEEP

12288:Gb45ZVyN9VWwqZnqgULF8BcWlkL9j22HQDI/XjGK:Gb45iNg1EEb2XjH

Score

1^/10

Malware Config

Signatures

Files

DPFPApi.dll
.dll regsvr32 windows:6 windows x86 arch:x86

45c7869045c05a492036ce749293ea6e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

30:27:ce:f4:4c:6e:32:0e:db:a2:30:b9:ba:b6:66:34
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

24/04/2018, 00:00

Not After

15/06/2021, 23:59

Subject

CN=DigitalPersona\, Inc.,O=DigitalPersona\, Inc.,L=Fremont,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8a:cd:46:a0:8e:32:3d:a3:fe:a6:98:2d:55:94:21:b5:2f:4c:18:6c:4d:87:42:2b:d3:81:94:f7:46:bd:28:a6
Signer

Actual PE Digest

8a:cd:46:a0:8e:32:3d:a3:fe:a6:98:2d:55:94:21:b5:2f:4c:18:6c:4d:87:42:2b:d3:81:94:f7:46:bd:28:a6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\BuildAgent\work\dc33de3cf0e9e7a7\bin\Win32\Release\client\DPFPApi.pdb

Imports

rpcrt4

RpcMgmtWaitServerListen
RpcEpResolveBinding
RpcEpRegisterW
RpcEpUnregister
RpcBindingSetOption
RpcBindingFree
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcStringFreeW
RpcBindingSetAuthInfoW
RpcAsyncInitializeHandle
RpcAsyncCompleteCall
RpcAsyncCancelCall
NdrClientCall2
NdrAsyncClientCall
RpcImpersonateClient
RpcRevertToSelf
NdrAsyncServerCall
NdrServerCall2
RpcBindingVectorFree
RpcServerInqBindings
RpcServerListen
RpcServerRegisterIf
RpcServerUnregisterIf
RpcServerUseProtseqW
RpcServerUseProtseqEpW
RpcMgmtIsServerListening
RpcMgmtStopServerListening

kernel32

CloseHandle
DeleteCriticalSection
WaitForSingleObject
CreateEventW
UnregisterWaitEx
LocalFree
lstrlenW
VerifyVersionInfoW
GetCurrentProcessId
FindClose
FindFirstFileW
DuplicateHandle
RaiseException
SetLastError
GetCurrentProcess
GetCurrentThread
OpenProcess
FreeLibrary
GetModuleHandleW
LoadLibraryExW
GlobalAlloc
EncodePointer
DecodePointer
DisableThreadLibraryCalls
GetModuleFileNameW
LoadResource
SizeofResource
FindResourceW
lstrcmpiW
MultiByteToWideChar
CreateDirectoryW
CreateFileW
GetFileSize
SetFilePointer
WriteFile
WaitForSingleObjectEx
ProcessIdToSessionId
GetLocalTime
GetModuleFileNameA
GetComputerNameA
WideCharToMultiByte
WriteConsoleW
LCMapStringW
UnregisterWait
GetFileType
GetStdHandle
GetACP
GetConsoleMode
GetConsoleCP
GetModuleHandleExW
ExitProcess
VirtualQuery
VirtualProtect
VirtualAlloc
GetSystemInfo
TlsFree
TlsSetValue
RegisterWaitForSingleObject
GlobalLock
GlobalUnlock
GlobalSize
LoadLibraryW
GetProcAddress
GetSystemDirectoryW
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
ResetEvent
SetEvent
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
SetFilePointerEx
GetStringTypeW
TlsGetValue
TlsAlloc
InterlockedFlushSList
RtlUnwind
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
IsDebuggerPresent
VerSetConditionMask

user32

GetWindowThreadProcessId
EnumChildWindows
GetForegroundWindow
IsWindow
SendMessageW
GetGUIThreadInfo
GetUserObjectInformationW
GetThreadDesktop
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetWindowInfo
GetAncestor
FindWindowExW
CharNextW
PeekMessageW

advapi32

SetSecurityDescriptorDacl
OpenProcessToken
OpenThreadToken
AddAccessAllowedAce
AddAce
CopySid
EqualSid
RegQueryValueExA
RegOpenKeyExA
RegEnumValueW
RegEnumKeyA
RegSetValueExW
RegQueryInfoKeyW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
ConvertStringSidToSidW
ConvertSidToStringSidW
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
LookupAccountSidW
SetTokenInformation
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RevertToSelf
MapGenericMask
IsValidSid
InitializeSid
InitializeSecurityDescriptor
InitializeAcl
ImpersonateLoggedOnUser
ImpersonateAnonymousToken
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidLengthRequired
GetLengthSid
GetAclInformation
GetAce

ole32

CoImpersonateClient
CoRevertToSelf
CoTaskMemAlloc
ReadClassStm
CoTaskMemFree
OleSaveToStream
StringFromCLSID
StringFromGUID2
CoTaskMemRealloc
OleRun
CoCreateInstance
GetHGlobalFromStream
CoGetStandardMarshal
CreateStreamOnHGlobal
WriteClassStm

oleaut32

SafeArrayCreate
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
VariantClear
VariantCopy
SysAllocStringByteLen
SysStringLen
VarUI4FromStr
LoadTypeLi
RegisterTypeLi
UnRegisterTypeLi
SysAllocStringLen
SysFreeString
SysAllocString
VariantChangeType
SysStringByteLen

shlwapi

PathFileExistsA
PathFileExistsW

userenv

UnloadUserProfile

crypt32

CertCloseStore
CertOpenStore
CertRDNValueToStrW
CryptDecodeObject
CertFindCertificateInStore
CertFreeCertificateContext
CryptEncodeObject

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Exports

Exports

DPFPAppPolicyChanged
DPFPAsyncDestroyCall
DPFPAuthDomainAddUser
DPFPAuthDomainDeleteUser
DPFPAuthDomainEnum
DPFPAuthDomainEnumUsers
DPFPAuthDomainGetInfo
DPFPAuthDomainSetInfo
DPFPAuthenticateOSL
DPFPBufferAlloc
DPFPBufferFree
DPFPCommitRegistrationChanges
DPFPConvertSampleToANSI
DPFPConvertSampleToBitmap
DPFPCreateAcquisition
DPFPCreateAcquisitionWithCallback
DPFPCreateAuthentication
DPFPCreateRegistration
DPFPCreateRegistrationWithCallback
DPFPCreateUser
DPFPDeleteFinger
DPFPDeleteOTP
DPFPDeleteSecret
DPFPDestroyAcquisition
DPFPDestroyAuthentication
DPFPDestroyRegistration
DPFPDoesSecretExist
DPFPEnrollOTP
DPFPEnumerateDevices
DPFPExportAllUsers
DPFPExportUser
DPFPFVEGet
DPFPFVEGetMasterKey
DPFPFVESet
DPFPGetAuthenticationInfo
DPFPGetDeviceImageInfo
DPFPGetDeviceInfo
DPFPGetDeviceInfoEx
DPFPGetDeviceParameter
DPFPGetKioskGenericAccount
DPFPGetOSLInfo
DPFPGetOTP
DPFPGetOTPApplicationName
DPFPGetPolicySettingsEx
DPFPGetServerSettings
DPFPGetUserAttribute
DPFPGetUserAttributeEx
DPFPGetUserInfo
DPFPGetVersion
DPFPIdentify
DPFPIdentifyUser
DPFPInit
DPFPInstallFirefoxCert
DPFPIsOTPRegistered
DPFPPokeServer
DPFPReadPersistentData
DPFPReadProtectedData
DPFPReadSecretContent
DPFPReadSecretContentEx
DPFPRegisterDeviceNotification
DPFPRegisterEndpoint
DPFPSetDeviceLED
DPFPSetDeviceParameter
DPFPSetPolicySettingsEx
DPFPStartAcquisition
DPFPStartRegistration
DPFPStopAcquisition
DPFPStopRegistration
DPFPSubscribeAppDataChanged
DPFPTerm
DPFPTokenAuthenticate
DPFPTokenAuthenticateAsync
DPFPTokenClear
DPFPTokenDelete
DPFPTokenEnroll
DPFPTokenEnrollAsync
DPFPTokenEnum
DPFPTokenExport
DPFPTokenGetInfo
DPFPTokenGetSetting
DPFPTokenImport
DPFPTokenIsEnrolled
DPFPTokenIsEnrolledAsync
DPFPTokenPassthrough
DPFPTokenPassthroughAsync
DPFPTokenSetSetting
DPFPTranslateName
DPFPUnRegisterEndpoint
DPFPUnregisterDeviceNotification
DPFPUnsubscribeAppDataChanged
DPFPVerifyKioskMembership
DPFPWritePersistentData
DPFPWriteProtectedData
DPFPWriteSecretContent
DPFPWriteUserAttribute
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 386KB - Virtual size: 386KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

45c7869045c05a492036ce749293ea6e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4aCertificate

Key Usages

30:27:ce:f4:4c:6e:32:0e:db:a2:30:b9:ba:b6:66:34Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

8a:cd:46:a0:8e:32:3d:a3:fe:a6:98:2d:55:94:21:b5:2f:4c:18:6c:4d:87:42:2b:d3:81:94:f7:46:bd:28:a6Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

rpcrt4

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

userenv

crypt32

version

Exports

Exports

Sections

.text Size: 386KB - Virtual size: 386KB

.rdata Size: 117KB - Virtual size: 116KB

.data Size: 5KB - Virtual size: 9KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 26KB - Virtual size: 25KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

30:27:ce:f4:4c:6e:32:0e:db:a2:30:b9:ba:b6:66:34
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

8a:cd:46:a0:8e:32:3d:a3:fe:a6:98:2d:55:94:21:b5:2f:4c:18:6c:4d:87:42:2b:d3:81:94:f7:46:bd:28:a6
Signer

.text
Size: 386KB - Virtual size: 386KB

.rdata
Size: 117KB - Virtual size: 116KB

.data
Size: 5KB - Virtual size: 9KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 26KB - Virtual size: 25KB