FXSXP32[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

FXSXP32.dll
Size

446KB
MD5

26d2532b8e63b0b3526af869815a7d90
SHA1

f19ef4636710b65855614071349c3be84aaf05d1
SHA256

7f0237aefcc50089a099f1573e827b2f84a29120799fe1fc0598927366273a0a
SHA512

15dbf4d2fd34f08a3796631466644cf4895d732f5fe5200485765314fe6a405b25ccbd1f58d5aee73b5d8192004039f2e9e5cdb16a39a9d21b859bd7c97c8e76
SSDEEP

12288:iOJ77QDjuFk4LJnqe4qRQhQePCdMgl6kf1TcEa034x2A:iOJ77QDjuFkuJnqe4qRQhQePCd9l6kfg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FXSXP32.dll

Files

FXSXP32.dll
.dll windows:6 windows x86 arch:x86

e0895a0d7b74d346a64e786231f91470

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

FXSXP32.pdb

Imports

msvcrt

_initterm
_amsg_exit
??1type_info@@UAE@XZ
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
_ftol2_sse
_wcsnicmp
_callnewh
free
_mbscpy
memcpy
wcsstr
wcscat_s
_wcsdup
??0exception@@QAE@XZ
__CxxFrameHandler3
wcsncpy_s
strrchr
wcscpy_s
iswspace
iswcntrl
wcsncmp
_CxxThrowException
_wcsicmp
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
memmove_s
memcpy_s
_wsplitpath_s
iswalpha
swscanf
malloc
_XcptFilter
_wcsnset
memset
wcsrchr
wcschr
_vsnwprintf

fxsapi

FaxAccessCheckEx
FaxSendDocumentExW
FaxGetRecipientsLimit
FaxFreeSenderInformation
FaxConnectFaxServerW
FaxGetPersonalCoverPagesOption
FaxGetReceiptsOptions
FaxClose
FaxGetSenderInformation

kernel32

GetVersionExW
GetComputerNameW
lstrlenW
ExpandEnvironmentStringsW
FreeLibrary
GetProcAddress
CreateDirectoryW
GetFileAttributesW
ReadFile
HeapCreate
GetProcessHeap
HeapAlloc
HeapFree
WaitForSingleObject
GetModuleFileNameW
SetFilePointer
GetFileSize
OutputDebugStringW
SetEndOfFile
UnmapViewOfFile
GetFullPathNameW
MapViewOfFileEx
CreateFileMappingW
CopyFileW
GetCurrentThread
LocalFree
SetLastError
MulDiv
FindFirstFileW
GetLastError
FindNextFileW
FindClose
WideCharToMultiByte
MultiByteToWideChar
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
OutputDebugStringA
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
OpenMutexW
CreateMutexW
CreateEventW
SetEnvironmentVariableW
WaitForMultipleObjects
ReleaseMutex
CreateProcessW
MapViewOfFile
VirtualAlloc
VirtualFree
InterlockedCompareExchange
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
GetSystemTime
SystemTimeToFileTime
lstrlenA
GetTempFileNameW
GetTickCount
LoadLibraryW
DisableThreadLibraryCalls
CreateFileW
WriteFile
CloseHandle
MoveFileW
DeleteFileW
GetProfileIntW
GetTempPathW
GetFileType

advapi32

RegQueryValueW
GetTraceEnableFlags
GetSecurityDescriptorOwner
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
AllocateAndInitializeSid
SetEntriesInAclW
FreeSid
SetSecurityDescriptorDacl
GetTokenInformation
ReportEventW
GetTraceEnableLevel
GetTraceLoggerHandle
IsValidSid
GetLengthSid
CopySid
RegisterTraceGuidsW
OpenThreadToken
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
UnregisterTraceGuids
TraceMessage

winspool.drv

FindFirstPrinterChangeNotification
FindNextPrinterChangeNotification
FindClosePrinterChangeNotification
GetJobW
SetJobW
DocumentPropertiesW
EnumPrintersW
OpenPrinterW
GetPrinterW
ClosePrinter

gdi32

CreateDCW
GetObjectW
StartDocW
EndDoc
GetDeviceCaps
EndPage
StartPage
SetMapMode
DeleteObject
TextOutW
GetTextExtentExPointW
GetTextMetricsW
SetBkMode
SelectObject
GetStockObject
DeleteDC
StretchDIBits
CreateFontIndirectW

user32

MessageBoxW
WinHelpW
MessageBeep
DialogBoxParamW
CreateWindowExW
GetWindowTextW
InvalidateRect
UpdateWindow
EndDialog
CheckDlgButton
GetWindowContextHelpId
BeginPaint
EndPaint
SetWindowTextW
LoadStringW
SendMessageW
IsDlgButtonChecked
GetDlgItem
EnableWindow

shell32

SHGetFolderPathAndSubDirW
SHSetLocalizedName
SHGetFolderPathW
ShellExecuteExW

mapi32

ord62
ord17
ord140
ord75
ord82
ord185

comdlg32

ChooseFontW

tapi32

lineInitializeExW
lineSetCurrentLocation
lineGetTranslateCapsW
lineTranslateAddressW
lineShutdown
lineTranslateDialogW

Exports

Exports

ServiceEntry
XPProviderInit

Sections

.text
Size: 431KB - Virtual size: 431KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e0895a0d7b74d346a64e786231f91470

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

fxsapi

kernel32

advapi32

winspool.drv

gdi32

user32

shell32

mapi32

comdlg32

tapi32

Exports

Exports

Sections

.text Size: 431KB - Virtual size: 431KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 431KB - Virtual size: 431KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 11KB - Virtual size: 11KB