DafPrintProvider[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

DafPrintProvider.dll
Size

90KB
MD5

f0596b21c6319dc14ed8240780f6a3f3
SHA1

8f9a5211339d2a91abebc93b62998da19c8bab3c
SHA256

ed69c696f6c9b62b3902e01fb45cbf873ba37b4bc46e7bd6c4fabc630495e6ea
SHA512

799766718c8835f799ea0ff4ebc81a3f559019fefb3462aa2af689d8885bc2ae18c5f324dbd5c820516a86031766206808c9edd0a5d5cc670d7087978cfbee3f
SSDEEP

1536:ij6+h5nLP55kQdWYQJ5+nYoehSptigTLk3aVS4mpl3WCNLnhmSIQLTG5IrK4RCK5:L+zndCQdhQJj0XigTONxjVnhbIQLTG5s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DafPrintProvider.dll

Files

DafPrintProvider.dll
.dll windows:10 windows x86 arch:x86

eb18f487ee8384467047c6ac6be7be89

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

DafPrintProvider.pdb

Imports

msvcrt

_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_initterm
free
memcpy
__CxxFrameHandler3
_CxxThrowException
wcschr
??_V@YAXPAX@Z
_wcsicmp
_vsnwprintf
isspace
memcpy_s
_amsg_exit
_XcptFilter
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_callnewh
malloc
_purecall
??3@YAXPAX@Z
memmove
memset

api-ms-win-core-synch-l1-2-0

InitializeCriticalSection
DeleteCriticalSection
Sleep

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
RegisterTraceGuidsW
GetTraceEnableFlags
UnregisterTraceGuids
GetTraceEnableLevel
GetTraceLoggerHandle

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
DisableThreadLibraryCalls

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
OpenProcessToken
TerminateProcess
GetCurrentProcess
OpenThreadToken
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetUnhandledExceptionFilter

kernel32

LocalAlloc
lstrcmpiW
LoadLibraryW
GetLastError
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
LocalFree
FormatMessageW
GetModuleHandleExW
GetModuleFileNameA
LoadLibraryExW
GetProcAddress
OutputDebugStringW
CloseHandle
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
EnterCriticalSection
HeapFree
GetProcessHeap
HeapAlloc
WaitForSingleObject
OpenSemaphoreW
LeaveCriticalSection
MultiByteToWideChar
FreeLibraryAndExitThread
FreeLibrary
CreateThread
InitOnceBeginInitialize
InitOnceComplete
CreateSemaphoreExW
SetLastError
CreateMutexExW
QueueUserWorkItem
GetCurrentThread

oleaut32

SysFreeString
SysStringLen
VariantClear
VariantInit
SysAllocString

api-ms-win-core-com-l1-1-1

CoUninitialize
CoCreateInstance
CoInitializeEx

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister
EventActivityIdControl
EventWrite

api-ms-win-security-lsalookup-l2-1-1

LookupAccountNameW

api-ms-win-security-base-l1-2-0

GetTokenInformation
CreateWellKnownSid
EqualSid

winspool.drv

EnumPrintersW
DeletePrinterConnectionW
AddPrinterConnection2W

ntdll

EtwTraceMessage

bcrypt

BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptCloseAlgorithmProvider

dsrole

DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation

ws2_32

WSAGetLastError
WSACleanup
WSAStartup
WSAAddressToStringW

logoncli

DsAddressToSiteNamesExW

netutils

NetApiBufferFree

sspicli

GetUserNameExW

iphlpapi

GetAdaptersAddresses

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

activeds

ord9
ord3

secur32

GetComputerObjectNameW

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb18f487ee8384467047c6ac6be7be89

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-synch-l1-2-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

kernel32

oleaut32

api-ms-win-core-com-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-security-lsalookup-l2-1-1

api-ms-win-security-base-l1-2-0

winspool.drv

ntdll

bcrypt

dsrole

ws2_32

logoncli

netutils

sspicli

iphlpapi

api-ms-win-core-delayload-l1-1-1

activeds

secur32

Exports

Exports

Sections

.text Size: 76KB - Virtual size: 75KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 5KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 76KB - Virtual size: 75KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 5KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB