XpsPrint[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

XpsPrint.dll
Size

1.1MB
MD5

6a7b5a3efccdb53da41cf6838056990f
SHA1

46d3f13edb68b7dd8ad5ad34c5dab56b32a108ed
SHA256

6ed86977962e07cce254ff60a060747ed8a83cbeb06c627f210c29a774b31d03
SHA512

9c59f0429b51db5c62024fd989c3631f596fc2005cf0d53b3122ccc92117719d7bffb2f86d14ec68f184ea990666f6a63fc37d4d3279eedf0f8d45abd7dc7761
SSDEEP

24576:oZjESCurzwM/9z1OA9TpfDEpgCPjCGVmPS+ve7Tq:o/wUOA9APuGVmPx27Tq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XpsPrint.dll

Files

XpsPrint.dll
.dll regsvr32 windows:6 windows x86 arch:x86

7136d696cef6e192db4b35bab563e24e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

xpsprint.pdb

Imports

msvcrt

_ftol2
memcmp
memcpy
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
__uncaught_exception
??1type_info@@UAE@XZ
_initterm
_amsg_exit
_XcptFilter
abort
__crtGetStringTypeW
__crtLCMapStringW
__crtLCMapStringA
isupper
___mb_cur_max_func
__mb_cur_max
wcsrchr
_vsnprintf
_strtoi64
_strtoui64
wcstod
_vsnwprintf_l
_finite
_isnan
wcsstr
??0exception@@QAE@ABV0@@Z
tolower
islower
isalnum
isdigit
___lc_codepage_func
___lc_handle_func
__pctype_func
_errno
setlocale
__CxxFrameHandler3
_CxxThrowException
_callnewh
rand
time
srand
isspace
strcspn
memchr
sprintf_s
localeconv
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
strncmp
malloc
wcscpy_s
free
_wcsicmp
ldiv
swprintf_s
_wtof
_purecall
_vsnwprintf
memmove_s
memcpy_s
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
memset

kernel32

GetVersionExW
InitializeCriticalSectionAndSpinCount
SetFilePointerEx
ReadFile
FlushFileBuffers
SetEndOfFile
ResetEvent
ExitProcess
GetTickCount64
FindClose
FindFirstFileW
FindNextFileW
SetFilePointer
OutputDebugStringW
GetSystemDirectoryW
InterlockedIncrement
DeleteTimerQueueTimer
GetTickCount
GetLastError
CloseHandle
WriteFile
CreateFileW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateEventW
SetEvent
WaitForSingleObject
GetModuleHandleW
FreeLibraryAndExitThread
GlobalAlloc
GlobalFree
FreeLibrary
DeleteFileW
LoadLibraryW
GetProcAddress
CompareStringW
DuplicateHandle
GetCurrentProcess
GetTempPathW
GetModuleHandleExW
GetCurrentThread
CreateThread
ResumeThread
UnregisterWaitEx
InitOnceBeginInitialize
InitOnceComplete
GetCurrentThreadId
InterlockedExchange
CloseThreadpoolWork
CreateThreadpoolWork
SubmitThreadpoolWork
MultiByteToWideChar
WideCharToMultiByte
Sleep
InterlockedCompareExchange
OutputDebugStringA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
CreateTimerQueueTimer
CreateTimerQueue
RegisterWaitForSingleObject
QueueUserWorkItem
DeleteTimerQueueEx
InterlockedDecrement
LocalFree

gdi32

StartDocW
EndDoc
DeleteDC
ExtEscape
CreateDCW

prntvpt

ord8
ord10
ord4
ord7
ord3
ord6

ntdll

WinSqmIsOptedIn
WinSqmIncrementDWORD
RtlInitializeSRWLock
NtOpenThreadToken
NtOpenProcessToken
NtQueryInformationToken
NtClose
RtlAcquireSRWLockShared
RtlReleaseSRWLockShared
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive

oleaut32

SetErrorInfo
SysAllocString
SysFreeString
VariantInit
GetErrorInfo
SysStringLen
VariantClear

winspool.drv

ReportJobProcessingProgress
SetJobW
EndDocPrinter
AbortPrinter
GetPrinterDataW
OpenPrinterW
WritePrinter
GetJobW
GetPrinterW
StartDocPrinterW
GetPrinterDriverW
ClosePrinter

shlwapi

SHCreateStreamOnFileW

rpcrt4

NdrOleAllocate
CStdStubBuffer_IsIIDSupported
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Connect
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
NdrStubCall2
IUnknown_AddRef_Proxy
NdrStubForwardingFunction
CStdStubBuffer_Invoke
IUnknown_QueryInterface_Proxy
CStdStubBuffer_AddRef
NdrDllUnregisterProxy
NdrDllGetClassObject
NdrCStdStubBuffer2_Release
NdrDllCanUnloadNow
NdrDllRegisterProxy
NdrCStdStubBuffer_Release
RpcStringFreeW
CStdStubBuffer_Disconnect
UuidToStringW
UuidCreateSequential
NdrOleFree

xpsgdiconverter

ord1

xpsservices

ord9
ord5
ord6
ord8

ole32

CoCreateFreeThreadedMarshaler
CoCreateGuid
CoTaskMemAlloc
CoCreateInstance
CreateStreamOnHGlobal
CoInitializeEx
CoUninitialize
CoTaskMemFree

advapi32

RegisterTraceGuidsW
GetTraceEnableFlags
RegCloseKey
EventUnregister
RegQueryValueExW
GetTraceLoggerHandle
UnregisterTraceGuids
EventRegister
GetTraceEnableLevel
TraceMessage
EventWrite
SetThreadToken
OpenThreadToken
EventEnabled
RegOpenKeyExW

urlmon

CreateUri

xmllite

CreateXmlReader

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
StartXpsPrintJob
StartXpsPrintJob1

Sections

.text
Size: 993KB - Virtual size: 993KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 210B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7136d696cef6e192db4b35bab563e24e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

gdi32

prntvpt

ntdll

oleaut32

winspool.drv

shlwapi

rpcrt4

xpsgdiconverter

xpsservices

ole32

advapi32

urlmon

xmllite

Exports

Exports

Sections

.text Size: 993KB - Virtual size: 993KB

.orpc Size: 512B - Virtual size: 210B

.data Size: 5KB - Virtual size: 8KB

.idata Size: 6KB - Virtual size: 6KB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 123KB - Virtual size: 122KB

.text
Size: 993KB - Virtual size: 993KB

.orpc
Size: 512B - Virtual size: 210B

.data
Size: 5KB - Virtual size: 8KB

.idata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 123KB - Virtual size: 122KB