fdprint[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

fdprint.dll
Size

167KB
MD5

f5c4fb99a04e4191974acaf5b0bef222
SHA1

57f0739ea2bcab5d6378c4c660a4071c262f2b2d
SHA256

f68515dc6d42ead4d4d5447e6021dd343100e78250eb191c31b6975c0b824c84
SHA512

94f5d5d5bb1d44b8de9eec27d419e71bd785980191ebfc0c99d6550dd1147dd53ed7cd2a85bfbcb37c3767f346cf38206a8364e71471f914e7c5d6ba3bc7ef34
SSDEEP

3072:L+2kbAhaHnH7jwu/+5HLx28QqHovWpaaSnx0lIOEWjDz35d35NTLSWxWBZgzDpkX:L7kbAhaHnHfwu/+5HLxDQqHgWpfSn6l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fdprint.dll

Files

fdprint.dll
.dll regsvr32 windows:10 windows x86 arch:x86

8a188be86b3f34d9b1406a5d9380e623

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

fdprint.pdb

Imports

msvcrt

_purecall
_vsnwprintf
memcpy_s
_vsnprintf_s
??0exception@@QAE@XZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
memmove_s
wcschr
wcstok_s
malloc
__CxxFrameHandler3
_callnewh
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
?what@exception@@UBEPBDXZ
_CxxThrowException
memcpy
memmove
_XcptFilter
_amsg_exit
free
_initterm
_lock
_unlock
__dllonexit
_onexit
?terminate@@YAXXZ
_except_handler4_common
??1type_info@@UAE@XZ
??3@YAXPAX@Z
memcmp
memset

kernel32

GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
InitializeSRWLock
CreateSemaphoreExW
DisableThreadLibraryCalls
FormatMessageW
GetCurrentThreadId
HeapAlloc
GetProcessHeap
HeapFree
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
GetModuleHandleW
GetProcAddress
GetLastError
IsDebuggerPresent
OutputDebugStringW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
SetLastError
SetEvent
CloseHandle
ReleaseSemaphore
ReleaseMutex
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
WaitForSingleObjectEx
EnterCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObject
OpenSemaphoreW
CreateThreadpoolTimer
GetModuleHandleA
LoadLibraryW
GetModuleFileNameW
OutputDebugStringA
lstrcmpiW
LoadLibraryExW
FreeLibrary
LocalFree
WritePrivateProfileStringW
DeleteFileW
GetTempPathW
CreateDirectoryW
SetFileAttributesW
RemoveDirectoryW
CheckElevationEnabled
GetCurrentProcess
GetSystemDirectoryW
GetExitCodeProcess
CreateEventW
QueueUserWorkItem
LoadLibraryA
CompareStringOrdinal
GetCurrentProcessId
CreateMutexExW
LeaveCriticalSection

advapi32

GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
EventRegister
OpenProcessToken
EventUnregister
EventWriteTransfer
TraceMessage

gdi32

CreateCompatibleDC
DeleteDC
DeleteObject
CreateDIBSection
SelectObject

user32

CreatePopupMenu
GetMenuDefaultItem
MsgWaitForMultipleObjects
DestroyIcon
DispatchMessageW
GetSystemMetrics
GetDlgItem
SendMessageW
SetFocus
ShowWindow
EndDialog
EnableWindow
SetTimer
LoadStringW
GetDC
InsertMenuItemW
DialogBoxParamW
ReleaseDC
PeekMessageW

ole32

CoUninitialize
FreePropVariantArray
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CLSIDFromString
StringFromGUID2
CoCreateGuid
CoInitialize
CoCreateInstance
CoTaskMemFree
PropVariantClear
CoTaskMemAlloc
CoInitializeEx
PropVariantCopy

oleaut32

SysFreeString
SysStringLen
SysAllocString
VariantInit
VariantClear

propsys

InitPropVariantFromCLSID
InitPropVariantFromGUIDAsString
InitPropVariantFromStringAsVector
PropVariantToBoolean
PropVariantToGUID

shlwapi

ord197
ord388
ord16
StrCmpNIW

winspool.drv

OpenPrinterW
EnumFormsW
ord203
ClosePrinter
GetPrinterDriverDirectoryW
GetPrinterDataExW
EnumPortsW
XcvDataW
EnumPrintersW
GetPrinterW
ord204

setupapi

SetupDiGetDevicePropertyW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiGetCustomDevicePropertyW

bcrypt

BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptCloseAlgorithmProvider

shell32

SHInvokePrinterCommandW
ord100
CommandLineToArgvW
SHGetFolderLocation
SHGetKnownFolderPath
SHGetItemFromObject
ShellExecuteExW

ntdll

NtQueryInformationToken

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
InvokeTaskW

Sections

.text
Size: 145KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8a188be86b3f34d9b1406a5d9380e623

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

advapi32

gdi32

user32

ole32

oleaut32

propsys

shlwapi

winspool.drv

setupapi

bcrypt

shell32

ntdll

Exports

Exports

Sections

.text Size: 145KB - Virtual size: 144KB

.data Size: 1KB - Virtual size: 3KB

.idata Size: 6KB - Virtual size: 5KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 145KB - Virtual size: 144KB

.data
Size: 1KB - Virtual size: 3KB

.idata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 11KB - Virtual size: 11KB