Fuayfw64[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

Fuayfw64.dll
Size

612KB
MD5

cd491420a692d23de0b7a04690107973
SHA1

0303cb8ec65853adc9a393a6b37226f3a1ca856b
SHA256

ac42df2e07c9c5a08665d349c90bd7123f80195c96137b5e49d5f868a80ac8fe
SHA512

a29cde5c61dd2e1587bc7de5af4d26283985ad1f839912ea68aa0441613fd4f4fbb0e8fa5a0b45f1ec5869247a56001547ca9335436de29105b9cb7f4d29d844
SSDEEP

6144:2enaecNI04KlVepqrpnGE5Xs41Kzh7OKpr/LteXCVWkdo3WiJTr4BKnhWoPwI4jQ:24KVepqt9S41AOCTjrdo3Wihr4B+WU48

Score

1^/10

Malware Config

Signatures

Files

Fuayfw64.dll
.dll windows x64

0ee3738765b4f96689d632d5442823c1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

isspace
memmove
_putws
swscanf_s
_wcsnicmp
_wcsicmp
wcsstr
iswxdigit
toupper
towupper
iswdigit
swprintf
_wcsdup
towlower
iswalpha
_wtol
memset
_wtoi64
__CxxFrameHandler3
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
malloc
free
wcsncpy
wcstok_s
_strnicmp
_wtoi
wcschr
wcstoul
_purecall
wcsrchr
_vsnwprintf
clock
memcpy_s
memcpy

kernel32

SetWaitableTimer
RegisterWaitForSingleObject
QueueUserWorkItem
ExpandEnvironmentStringsW
InitializeCriticalSection
DeleteCriticalSection
GetCurrentProcess
LoadLibraryW
GetProcAddress
Sleep
GetVolumeNameForVolumeMountPointW
GetFileAttributesW
DeviceIoControl
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetTickCount
GetWindowsDirectoryW
MultiByteToWideChar
HeapAlloc
GetProcessHeap
HeapFree
SetEvent
GetEnvironmentVariableW
CopyFileW
CreateProcessW
CreateEventW
SetErrorMode
WaitForSingleObject
CreateThread
WideCharToMultiByte
GetPrivateProfileStringW
GetPrivateProfileIntW
FreeLibrary
InitializeSRWLock
CloseHandle
ReleaseSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockShared
AcquireSRWLockExclusive
GetCurrentThreadId
GetLastError
GetSystemTime
AssignProcessToJobObject
CreateJobObjectW
SetInformationJobObject
FindClose
MoveFileW
GetFileSizeEx
TlsSetValue
OutputDebugStringW
CompareFileTime
TlsGetValue
QueryInformationJobObject
GetStartupInfoW
GetExitCodeProcess
WaitForMultipleObjectsEx
ResumeThread
UnregisterWaitEx
ResetEvent
SetFilePointer
FindFirstFileW
CreateWaitableTimerW
TerminateJobObject
TerminateProcess
SetEnvironmentVariableW
CreateDirectoryW
DeleteFileW
QueueUserAPC
FlushFileBuffers
DisconnectNamedPipe
ReadFile
WriteFile
FindNextFileW
TerminateThread
OpenProcess
GetFileTime
GetNamedPipeClientProcessId
CreateNamedPipeW
ConnectNamedPipe
SetNamedPipeHandleState
GetOverlappedResult
TransactNamedPipe
WaitNamedPipeW
CompareStringW
CreateFileW
IsProcessInJob
OpenJobObjectW
LeaveCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime
LocalFree
GetModuleFileNameW
TlsAlloc
TlsFree
GetVolumePathNameW
LoadLibraryExA
RaiseException
SetFileTime
ReleaseMutex
CreateMutexW
GetFileAttributesExW
GetComputerNameW
LocalAlloc
SetFileAttributesW
RemoveDirectoryW
lstrlenW
FileTimeToSystemTime
GetCurrentThread
SystemTimeToFileTime

advapi32

GetLengthSid
EventUnregister
OpenThreadToken
MapGenericMask
AccessCheck
LookupPrivilegeValueW
GetNamedSecurityInfoW
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
AdjustTokenPrivileges
InitiateSystemShutdownW
AddAccessAllowedAceEx
InitializeSecurityDescriptor
LookupAccountNameW
SetSecurityDescriptorDacl
DuplicateTokenEx
RegDeleteTreeW
LsaClose
LsaAddAccountRights
LsaOpenPolicy
BuildExplicitAccessWithNameW
BuildSecurityDescriptorW
CreateWellKnownSid
ConvertSidToStringSidW
AddAccessDeniedAceEx
SetEntriesInAclW
InitializeAcl
CryptReleaseContext
CryptSetProvParam
GetSecurityDescriptorLength
RevertToSelf
ImpersonateLoggedOnUser
LookupAccountSidW
OpenProcessToken
SetTokenInformation
LogonUserExW
CreateProcessAsUserW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
EventAccessControl
EventAccessRemove
CopySid
IsValidSid
RegCloseKey
RegOpenKeyExW
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
SetNamedSecurityInfoW
RegGetValueW
EventWrite
EventRegister

iphlpapi

FreeMibTable
NotifyUnicastIpAddressChange
InitializeUnicastIpAddressEntry
DeleteUnicastIpAddressEntry
CreateUnicastIpAddressEntry
SetIpInterfaceEntry
InitializeIpInterfaceEntry
GetIfTable2Ex
GetAdaptersAddresses
CancelMibChangeNotify2

ws2_32

socket
WSAGetLastError
gethostname
WSAStartup
closesocket
WSAStringToAddressW
ntohl

ole32

CreateStreamOnHGlobal
CoCreateInstance
CoTaskMemFree
CoCreateGuid
CoInitializeSecurity
CoUninitialize
CoInitializeEx
CoSetProxyBlanket

setupapi

SetupCopyOEMInfW
CMP_WaitNoPendingInstallEvents

ntdll

RtlLengthSid
RtlLengthRequiredSid
RtlCreateUnicodeString
RtlFreeUnicodeString
RtlIpv6StringToAddressW
RtlIpv4StringToAddressExW
RtlGUIDFromString
RtlIpv4StringToAddressW
RtlInitUnicodeString
RtlFreeHeap
RtlAllocateHeap
RtlIpv6StringToAddressA
RtlValidSid

rpcrt4

UuidFromStringW
UuidCreate
UuidToStringW
RpcStringFreeW
UuidCompare

ncrypt

NCryptCreatePersistedKey
NCryptOpenStorageProvider
NCryptFreeObject
NCryptSetProperty
NCryptFinalizeKey

secur32

LsaFreeReturnBuffer

userenv

LoadUserProfileW
CreateEnvironmentBlock
DestroyEnvironmentBlock
UnloadUserProfile

Exports

Exports

cARCreateContainer
cARCreateRoleEx
cARCreateUserAccount
cARDeleteUserAccount
cARDestroyContainer
cARDestroyRoleEx
cARGetRoleProcessId
cARGetRoleState
cARGetTransportCertificate
cARGetTransportCertificateForIaaS
cARImportCertificateForIaaS
cARInitialize
cARInitializeForIaaS
cARInitiateSystemShutdown
cARSendConfig
cARSetupEnvironment
cARStartContainer
cARStartRole
cARStartRoleEx
cARStopContainer
cARStopRole
cARStopRoleEx
cARUninitialize
cARUninitializeForIaaS
init

Sections

.text
Size: 530KB - Virtual size: 529KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0ee3738765b4f96689d632d5442823c1

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

advapi32

iphlpapi

ws2_32

ole32

setupapi

ntdll

rpcrt4

ncrypt

secur32

userenv

Exports

Exports

Sections

.text Size: 530KB - Virtual size: 529KB

.data Size: 1KB - Virtual size: 6KB

.pdata Size: 9KB - Virtual size: 8KB

.idata Size: 11KB - Virtual size: 10KB

.rsrc Size: 52KB - Virtual size: 50KB

.reloc Size: 1024B - Virtual size: 628B

.text
Size: 530KB - Virtual size: 529KB

.data
Size: 1KB - Virtual size: 6KB

.pdata
Size: 9KB - Virtual size: 8KB

.idata
Size: 11KB - Virtual size: 10KB

.rsrc
Size: 52KB - Virtual size: 50KB

.reloc
Size: 1024B - Virtual size: 628B