XpsPrint[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

XpsPrint.dll
Size

850KB
MD5

8fe6db20be436ea8839295f60caa09f6
SHA1

39a19d151093ae72cbb212fdadf9601d85f0881d
SHA256

f15c55320e47c159dd3bb165f857ecaf61d3e54570fe8579ba15e4cb48bd7c6f
SHA512

f92ff7331310a0a6aa18e7eff1dfa6869c9f4ca7cafef123540e94fe4cb2b00b8b79b0ed54861cd75b6320a88e5a2f0b888561932cc93753c3ecb969a7404289
SSDEEP

12288:o5bpdhchXItlHU4bshsqlY1fV3STIpaD6U2PpIop13ZAoXsJJ90Q:o57i4tK4bWufdLpaD6U8pIoTZAoXsTK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XpsPrint.dll

Files

XpsPrint.dll
.dll windows:6 windows x86 arch:x86

54c36ee60ecdd3a44549f1bfbe636487

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

xpsprint.pdb

Imports

msvcrt

___lc_codepage_func
___lc_handle_func
_errno
___mb_cur_max_func
memset
setlocale
__crtGetStringTypeW
malloc
__crtLCMapStringW
__pctype_func
abort
_XcptFilter
_initterm
_amsg_exit
??1type_info@@UAE@XZ
__uncaught_exception
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
__mb_cur_max
_wcsicmp
_vsnprintf
_ftol2
_strtoi64
_strtoui64
_finite
wcstod
_isnan
tolower
isdigit
isalnum
_callnewh
isspace
sprintf_s
strcspn
memchr
localeconv
free
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
memcpy
strncmp
_wcsnicmp
ldiv
swprintf_s
_wtof
_vsnwprintf
??0exception@@QAE@ABQBD@Z
memmove_s
memcpy_s
_purecall
__CxxFrameHandler3
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@XZ

kernel32

SetFilePointerEx
FindFirstFileW
ReadFile
SetFilePointer
FindNextFileW
ResetEvent
UnregisterWaitEx
DeleteTimerQueueTimer
QueueUserWorkItem
RegisterWaitForSingleObject
CreateTimerQueueTimer
DeleteTimerQueueEx
ExitProcess
SetEndOfFile
FindClose
InitializeCriticalSectionAndSpinCount
GetCurrentThread
OutputDebugStringW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
InterlockedIncrement
InterlockedDecrement
GetLastError
GetTickCount
CloseHandle
WriteFile
CreateFileW
SetEvent
WaitForSingleObject
FreeLibraryAndExitThread
CreateEventW
FreeLibrary
GetProcAddress
LoadLibraryW
DeleteFileW
DuplicateHandle
GetCurrentProcess
GetTempPathW
CompareStringW
CreateThread
GetModuleHandleExW
InitOnceComplete
InitOnceBeginInitialize
WideCharToMultiByte
MultiByteToWideChar
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedCompareExchange
OutputDebugStringA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
CreateTimerQueue

advapi32

RegQueryValueExW
RegCloseKey
OpenThreadToken
SetThreadToken
TraceMessage
EventUnregister
EventWrite
RegOpenKeyExW
EventRegister

gdi32

EndDoc
StartDocW
CreateDCW
ExtEscape
DeleteDC

prntvpt

ord4
ord7
ord6
ord10
ord8
ord3

ntdll

RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
RtlInitializeSRWLock
RtlAcquireSRWLockExclusive

ole32

CoUninitialize
CoTaskMemAlloc
CreateStreamOnHGlobal
CoCreateGuid
CoInitialize
CoTaskMemFree
CoCreateInstance

oleaut32

SysStringLen
SysAllocStringLen
GetErrorInfo
SysFreeString
SysAllocString
SetErrorInfo
VariantInit
VariantClear

winspool.drv

ClosePrinter
SetJobW
OpenPrinterW
WritePrinter
EndDocPrinter
ReportJobProcessingProgress
StartDocPrinterW
GetPrinterDriverW
GetJobW

xpsgdiconverter

ord1

xpsservices

ord5
ord6

Exports

Exports

DllMain
StartXpsPrintJob
StartXpsPrintJob1

Sections

.text
Size: 763KB - Virtual size: 762KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

54c36ee60ecdd3a44549f1bfbe636487

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

advapi32

gdi32

prntvpt

ntdll

ole32

oleaut32

winspool.drv

xpsgdiconverter

xpsservices

Exports

Exports

Sections

.text Size: 763KB - Virtual size: 762KB

.data Size: 5KB - Virtual size: 7KB

.rsrc Size: 1024B - Virtual size: 1016B

.reloc Size: 80KB - Virtual size: 79KB

.text
Size: 763KB - Virtual size: 762KB

.data
Size: 5KB - Virtual size: 7KB

.rsrc
Size: 1024B - Virtual size: 1016B

.reloc
Size: 80KB - Virtual size: 79KB