fpdfsdk[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

fpdfsdk.dll
Size

2.8MB
MD5

53fdd251a06c831c3024fd4fa19b50e6
SHA1

4c7f08aba66cadac29931cb3a9674e8b9479c11d
SHA256

72f102fc3d5af3ab0f247faa414fdda6d64280924ecc5717e07d74fa379235a0
SHA512

c5093c90db5dd6c452851ed0f610eadcba5077e3d9bee09a3fbc872031efe59cac657d0035c337f6b5570cc35fb8508863d25ac1abe024a6c085733186996192
SSDEEP

49152:LIulRcUJtRNLNx4LaiPG+JEETg3QEfeoG:LIHMNLlAV

Score

1^/10

Malware Config

Signatures

Files

fpdfsdk.dll
.dll windows:4 windows x86 arch:x86

c9a768cdeb1e552c0530ffb1c408f9d8

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

03:01
Certificate

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Not Before

16-11-2006 01:54

Not After

16-11-2026 01:54

Subject

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

64:a7:a0:38:a7:b2
Certificate

Issuer

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03-05-2010 20:33

Not After

03-05-2013 20:33

Subject

CN=Foxit Corporation,O=Foxit Corporation,L=Fremont,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

cb:e5:95:cd:c4:81:5d:4e:a6:5f:77:89:64:2f:44:11:c1:04:52:a3
Signer

Actual PE Digest

cb:e5:95:cd:c4:81:5d:4e:a6:5f:77:89:64:2f:44:11:c1:04:52:a3

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
ReadFile
SetFilePointer
FreeEnvironmentStringsW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetStringTypeA
GetStringTypeW
SetStdHandle
CreateFileA
GetOEMCP
CreateFileW
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
WriteFile
CloseHandle
HeapSize
GetCurrentProcess
TerminateProcess
ExitProcess
GetModuleHandleA
TlsGetValue
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
RaiseException
DeleteFileA
HeapFree
HeapReAlloc
HeapAlloc
GetVersion
GetCommandLineA
GetTimeZoneInformation
RtlUnwind
GetACP
InterlockedDecrement
InterlockedIncrement
LoadLibraryA
GetProcAddress
GetVersionExA
GetSystemTime
MultiByteToWideChar
WideCharToMultiByte
DeleteCriticalSection
InitializeCriticalSection
GetLocalTime
GetLastError
SetLastError
GetModuleFileNameA
EnterCriticalSection
FlushFileBuffers
LeaveCriticalSection

gdi32

CreateDCA
DeleteDC
CreatePen
CreateCompatibleBitmap
ExtEscape
SaveDC
WidenPath
IntersectClipRect
SelectClipPath
BeginPath
PolyBezierTo
CloseFigure
EndPath
CreateSolidBrush
ExtCreatePen
SetMiterLimit
SetPolyFillMode
StrokeAndFillPath
StrokePath
FillPath
RestoreDC
LineTo
SelectClipRgn
GetClipBox
StretchDIBits
SetDIBitsToDevice
CreateRectRgn
GetClipRgn
SetStretchBltMode
GetObjectType
CreateBitmap
GetDeviceCaps
GetTextMetricsA
GetFontData
CreateFontA
GetTextFaceA
EnumFontFamiliesExA
CreateFontIndirectA
BitBlt
DeleteObject
SelectObject
CreateCompatibleDC
GetDIBits
GetObjectA
CreateDIBitmap
GetCharWidthA
GetOutlineTextMetricsA
MoveToEx
GetRegionData

advapi32

RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey

user32

ReleaseDC
FillRect
IntersectRect
LoadImageW
GetDC

Exports

Exports

?FPDFLinkObj_GetBorderStyle@@YGHPAX@Z
?FPDFLinkObj_GetHighLight@@YGHPAX@Z
?FPDFLinkObj_SetBorderStyle@@YGHPAXH@Z
?FPDFLinkObj_SetHighLight@@YGHPAXH@Z
?FPDFLink_GetSubActionsByIndex@@YGPAXPAXH@Z
?FPDF_AddItemToMRUList@@YGXPAD@Z
FPDFAction_GetDest
FPDFAction_GetFilePath
FPDFAction_GetType
FPDFAction_GetURI
FPDFAction_GetURIPath
FPDFAction_SetDest
FPDFAction_SetFilePathA
FPDFAction_SetFilePathW
FPDFAction_SetURI
FPDFAvail_Create
FPDFAvail_Destroy
FPDFAvail_GetDocument
FPDFAvail_GetFirstPageNum
FPDFAvail_IsDocAvail
FPDFAvail_IsFormAvail
FPDFAvail_IsLinearized
FPDFAvail_IsPageAvail
FPDFBitmap_Create
FPDFBitmap_CreateEx
FPDFBitmap_Destroy
FPDFBitmap_FillRect
FPDFBitmap_GetBuffer
FPDFBitmap_GetHeight
FPDFBitmap_GetStride
FPDFBitmap_GetWidth
FPDFBookmark_AddBookmarkA
FPDFBookmark_AddBookmarkW
FPDFBookmark_DeleteBookmark
FPDFBookmark_Find
FPDFBookmark_GetAction
FPDFBookmark_GetColorRef
FPDFBookmark_GetDest
FPDFBookmark_GetFirstChild
FPDFBookmark_GetFontStyle
FPDFBookmark_GetNextSibling
FPDFBookmark_GetPageFirstLine
FPDFBookmark_GetTitle
FPDFBookmark_SetAction
FPDFBookmark_SetColorRef
FPDFBookmark_SetFontStyle
FPDFBookmark_SetTitleA
FPDFBookmark_SetTitleW
FPDFDest_GetPageIndex
FPDFDest_GetZoomMode
FPDFDest_GetZoomParam
FPDFDest_SetFITHORZParam
FPDFDest_SetFITVERTParam
FPDFDest_SetFitBHorzParam
FPDFDest_SetFitBVertParam
FPDFDest_SetFitRectParam
FPDFDest_SetPageIndex
FPDFDest_SetXYZParam
FPDFDest_SetZoomMode
FPDFFont_AddStandardFont
FPDFFont_AddTrueType
FPDFFont_GetAscent
FPDFFont_GetBBox
FPDFFont_GetCharBBox
FPDFFont_GetCharCode
FPDFFont_GetCharSize
FPDFFont_GetCharWidth
FPDFFont_GetDescent
FPDFFont_GetFlags
FPDFFont_GetFontAscent
FPDFFont_GetFontDescent
FPDFFont_GetFontName
FPDFFont_GetName
FPDFFont_GetUnicode
FPDFFormObj_CountSubObjects
FPDFFormObj_DeleteSubObject
FPDFFormObj_Display
FPDFFormObj_GenerateContent
FPDFFormObj_GetMatrix
FPDFFormObj_GetSubObject
FPDFFormObj_GetSubObjectIndex
FPDFFormObj_InsertSubObject
FPDFImageObj_GetBitmap
FPDFImageObj_GetMatrix
FPDFImageObj_LoadFromFile
FPDFImageObj_SetBitmap
FPDFImageObj_SetMatrix
FPDFLinkObj_CountLink
FPDFLinkObj_DelLinkObj
FPDFLinkObj_GenerateAP
FPDFLinkObj_GetColor
FPDFLinkObj_GetLineWidth
FPDFLinkObj_GetLink
FPDFLinkObj_GetRect
FPDFLinkObj_NewLinkObj
FPDFLinkObj_SetAction
FPDFLinkObj_SetColor
FPDFLinkObj_SetLineWidth
FPDFLink_CloseWebLinks
FPDFLink_CountRects
FPDFLink_CountWebLinks
FPDFLink_GetAction
FPDFLink_GetDest
FPDFLink_GetLinkAtPoint
FPDFLink_GetRect
FPDFLink_GetSubActionsCount
FPDFLink_GetURL
FPDFLink_LoadWebLinks
FPDFPageObj_AddClip
FPDFPageObj_AppendPathToClip
FPDFPageObj_Clone
FPDFPageObj_Free
FPDFPageObj_GetBBox
FPDFPageObj_GetClip
FPDFPageObj_GetClipCount
FPDFPageObj_GetDashArray
FPDFPageObj_GetDashCount
FPDFPageObj_GetDashPhase
FPDFPageObj_GetFillColor
FPDFPageObj_GetLineCapStyle
FPDFPageObj_GetLineJoinStyle
FPDFPageObj_GetLineWidth
FPDFPageObj_GetMiterLimit
FPDFPageObj_GetStrokeColor
FPDFPageObj_GetType
FPDFPageObj_NewImgeObj
FPDFPageObj_NewPathObj
FPDFPageObj_NewTextObj
FPDFPageObj_NewTextObjEx
FPDFPageObj_RemoveClip
FPDFPageObj_SetDashArray
FPDFPageObj_SetDashCount
FPDFPageObj_SetDashPhase
FPDFPageObj_SetFillColor
FPDFPageObj_SetLineCapStyle
FPDFPageObj_SetLineJoinStyle
FPDFPageObj_SetLineWidth
FPDFPageObj_SetMiterLimit
FPDFPageObj_SetStrokeColor
FPDFPageObj_Transform
FPDFPage_CountObject
FPDFPage_Delete
FPDFPage_DeleteObject
FPDFPage_Flatten
FPDFPage_GenerateContent
FPDFPage_GetObject
FPDFPage_GetPageObjectIndex
FPDFPage_GetRectangle
FPDFPage_GetRotation
FPDFPage_InsertObject
FPDFPage_New
FPDFPage_SetRectangle
FPDFPage_SetRotation
FPDFPathObj_ClearPoints
FPDFPathObj_CountPoints
FPDFPathObj_GetFillMode
FPDFPathObj_GetMatrix
FPDFPathObj_GetPath
FPDFPathObj_GetPointType
FPDFPathObj_GetPointX
FPDFPathObj_GetPointY
FPDFPathObj_GetStroke
FPDFPathObj_InsertPoint
FPDFPathObj_RemovePoint
FPDFPathObj_SetFillStroke
FPDFPathObj_SetMatrix
FPDFPathObj_SetPoints
FPDFTextObj_Compare
FPDFTextObj_CountChars
FPDFTextObj_Delete
FPDFTextObj_Find
FPDFTextObj_GetCharSpace
FPDFTextObj_GetFont
FPDFTextObj_GetFontSize
FPDFTextObj_GetMatrix
FPDFTextObj_GetOffset
FPDFTextObj_GetTextMode
FPDFTextObj_GetUincode
FPDFTextObj_GetWordSpace
FPDFTextObj_Insert
FPDFTextObj_Replace
FPDFTextObj_SetCharSpace
FPDFTextObj_SetFont
FPDFTextObj_SetMatrix
FPDFTextObj_SetTextMode
FPDFTextObj_SetUnicode
FPDFTextObj_SetWordSpace
FPDFText_ClosePage
FPDFText_CountBoundedSegments
FPDFText_CountChars
FPDFText_CountRects
FPDFText_FindClose
FPDFText_FindNext
FPDFText_FindPrev
FPDFText_FindStart
FPDFText_GetBoundedSegment
FPDFText_GetBoundedText
FPDFText_GetCharBox
FPDFText_GetCharIndexAtPos
FPDFText_GetCharIndexByDirection
FPDFText_GetFont
FPDFText_GetFontSize
FPDFText_GetMatrix
FPDFText_GetOrigin
FPDFText_GetRect
FPDFText_GetSchCount
FPDFText_GetSchResultIndex
FPDFText_GetText
FPDFText_GetUnicode
FPDFText_IsGenerated
FPDFText_LoadPage
FPDFText_PDFToText
FPDFText_PageToText
FPDF_AllocMemory
FPDF_CloseDocument
FPDF_ClosePage
FPDF_CreateAction
FPDF_CreateDest
FPDF_CreateNewDocument
FPDF_CustomEncrypt
FPDF_DeleteAction
FPDF_DeleteDest
FPDF_DestroyLibrary
FPDF_DestroySecurityHandler
FPDF_DeviceToPage
FPDF_EnumPageSize
FPDF_FreeMemory
FPDF_GetDocPermissions
FPDF_GetLastError
FPDF_GetMetaText
FPDF_GetModuleMgr
FPDF_GetPageCount
FPDF_GetPageHeight
FPDF_GetPageSizeByIndex
FPDF_GetPageThumbnail
FPDF_GetPageWidth
FPDF_GetPasswordLevel
FPDF_ImportPages
FPDF_InitLibrary
FPDF_LoadCustomDocument
FPDF_LoadDocument
FPDF_LoadMemDocument
FPDF_LoadPage
FPDF_OutputDecrypted
FPDF_PageToDevice
FPDF_QuickDrawPage
FPDF_RegisterSecurityHandler
FPDF_RemoveSecurity
FPDF_RenderPage
FPDF_RenderPageBitmap
FPDF_SaveAsCopy
FPDF_SaveAsFile
FPDF_SaveDocument
FPDF_SetDocInfo
FPDF_SetErrorHandler
FPDF_SetMetaTextA
FPDF_SetMetaTextW
FPDF_SetModulePath
FPDF_UnlockDLL
FPDF_VIEWERREF_GetNumCoipes
FPDF_VIEWERREF_GetPrintArea
FPDF_VIEWERREF_GetPrintClip
FPDF_VIEWERREF_GetPrintPageRange
FPDF_VIEWERREF_GetUIA
FPDF_VIEWERREF_GetUIW
FPDF_VIEWERREF_PrintScalingA
FPDF_VIEWERREF_PrintScalingW
FPDF_VIEWERREF_SetNumCoipes
FPDF_VIEWERREF_SetPrintArea
FPDF_VIEWERREF_SetPrintClip
FPDF_VIEWERREF_SetPrintPageRange
FPDF_VIEWERREF_SetUIA
FPDF_VIEWERREF_SetUIW
FPDF_VIEWERREF_ViewArea
FSDK_SetOOMHandler
_FPDF_RenderPageBitmap_Start@36
_FPDF_RenderPage_Close@4
_FPDF_RenderPage_Continue@8
_FPDF_RenderPage_EstimateProgress@4
_FPDF_RenderPage_Start@36

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 816KB - Virtual size: 813KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 160KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 84KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c9a768cdeb1e552c0530ffb1c408f9d8

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

03:01Certificate

Key Usages

64:a7:a0:38:a7:b2Certificate

Extended Key Usages

Key Usages

cb:e5:95:cd:c4:81:5d:4e:a6:5f:77:89:64:2f:44:11:c1:04:52:a3Signer

Headers

File Characteristics

Imports

kernel32

gdi32

advapi32

user32

Exports

Exports

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 816KB - Virtual size: 813KB

.data Size: 160KB - Virtual size: 232KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 84KB - Virtual size: 82KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

03:01
Certificate

64:a7:a0:38:a7:b2
Certificate

cb:e5:95:cd:c4:81:5d:4e:a6:5f:77:89:64:2f:44:11:c1:04:52:a3
Signer

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 816KB - Virtual size: 813KB

.data
Size: 160KB - Virtual size: 232KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 84KB - Virtual size: 82KB