OrayPrintProcessor[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

OrayPrintProcessor.dll
Size

63KB
MD5

ac11bf770d90f5893ae352b72e10e063
SHA1

c58953874af216f422c24f7ae019eb43bfbdd33c
SHA256

5eccd2491e808c321ac04d4ab764bc4f2a9d03f6d5268bda0185ca0b978ccb0a
SHA512

9b8989a155545506ef7581734b98499d6d87f06afdbba6057adf5f988f8470c65d9a25de48f87ce4ce27250b4d5c681dba28c2ee88641ef811d4fc7422c94fc5
SSDEEP

1536:L6wJCJm+zX2mIBXM1++wAxXog06H45UY/DSnrQ:LHaMe1z66H45UYunrQ

Score

1^/10

Malware Config

Signatures

Files

OrayPrintProcessor.dll
.dll windows:6 windows x86 arch:x86

ddab4579ad62c9f36aee1c3ffd1373de

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

24:05:11:0f:88:3e:c9:5c:fd:9a:a0:79:dc:dd:48:b5
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

26/04/2016, 00:00

Not After

26/04/2017, 23:59

Subject

SERIALNUMBER=310110000391816,CN=Shanghai Best Oray Information Technology Co.\, Ltd.,OU=IT,O=Shanghai Best Oray Information Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9e:64:bb:d3:9e:48:da:0c:74:24:eb:03:cc:4b:e2:be:06:d2:82:00
Signer

Actual PE Digest

9e:64:bb:d3:9e:48:da:0c:74:24:eb:03:cc:4b:e2:be:06:d2:82:00

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\oray\c\branches\src\test\emptydriver3\emptydriver3\objfre_wxp_x86\i386\genprint.pdb

Imports

msvcrt

_onexit
_lock
__dllonexit
_unlock
memmove
??1type_info@@UAE@XZ
_amsg_exit
_initterm
_XcptFilter
_callnewh
_errno
__CxxFrameHandler
_beginthreadex
sprintf
_purecall
realloc
wcsstr
??0exception@@QAE@XZ
memcpy
_wcsicmp
_CxxThrowException
memset
malloc
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
free
wcschr
_wcsnicmp
iswdigit
wcstoul

kernel32

GetVersion
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
InterlockedExchange
DisconnectNamedPipe
CreateFileA
SetNamedPipeHandleState
PeekNamedPipe
CreateProcessW
lstrlenW
GetLastError
GlobalFree
FindFirstFileW
CloseHandle
SetLastError
CreateEventW
OutputDebugStringA
ResetEvent
SetEvent
WideCharToMultiByte
lstrcpyA
CopyFileW
Sleep
FreeLibrary
GetProcAddress
WaitForSingleObject
GlobalAlloc
LoadLibraryExW
GetSystemDirectoryW
IsDBCSLeadByteEx
GetACP
ReadFile
GetFileSize
CreateFileW
WriteFile
GetTempFileNameW
GetTempPathW
GetExitCodeProcess

spoolss

EndDocPrinter
GetPrinterDataW
EnumJobsW
ClosePrinter
StartDocPrinterW
WritePrinter
GetPrinterW
ReadPrinter
GetJobAttributes
OpenPrinterW

user32

ReleaseDC
GetDC
wsprintfW

gdi32

SetEnhMetaFileBits
CopyMetaFileW
DeleteMetaFile
CopyEnhMetaFileW
DeleteEnhMetaFile
GetWinMetaFileBits
SetMetaFileBitsEx
TranslateCharsetInfo
CreateFontIndirectW
SelectObject
GetTextMetricsW
StartDocW
SetBkMode
StartPage
EndPage
TextOutA
EndDoc
AbortDoc
DeleteObject
GdiGetSpoolFileHandle
GdiGetDC
GdiGetPageCount
GetWorldTransform
GdiDeleteSpoolFileHandle
GdiStartDocEMF
GdiEndDocEMF
GdiGetPageHandle
GdiResetDCEMF
GdiGetDevmodeForPage
GdiStartPageEMF
GdiEndPageEMF
ResetDCW
SetGraphicsMode
ModifyWorldTransform
SetWorldTransform
GdiPlayPageEMF
GetDeviceCaps
CancelDC
CreateDCW
DeleteDC

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

Exports

Exports

ClosePrintProcessor
ControlPrintProcessor
DllMain
EnumPrintProcessorDatatypesW
GetPrintProcessorCapabilities
OpenPrintProcessor
PrintDocumentOnPrintProcessor

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ddab4579ad62c9f36aee1c3ffd1373de

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

24:05:11:0f:88:3e:c9:5c:fd:9a:a0:79:dc:dd:48:b5Certificate

Extended Key Usages

Key Usages

9e:64:bb:d3:9e:48:da:0c:74:24:eb:03:cc:4b:e2:be:06:d2:82:00Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

spoolss

user32

gdi32

advapi32

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 47KB

.data Size: 3KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

24:05:11:0f:88:3e:c9:5c:fd:9a:a0:79:dc:dd:48:b5
Certificate

9e:64:bb:d3:9e:48:da:0c:74:24:eb:03:cc:4b:e2:be:06:d2:82:00
Signer

.text
Size: 48KB - Virtual size: 47KB

.data
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB