wuuhosdeployment[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

wuuhosdeployment.dll
Size

353KB
MD5

fdef5c119f6376b0429b41dcfc3e8030
SHA1

9187c717bf0d23fd1ad12c46a6e2f5415d1b96e7
SHA256

39ce065436c0f93e61de1c23fca2e4e2b0f4a686aa38fcd4bb1afd753a415ab9
SHA512

6171c0a835e32a465cab6f71d12832e75e7d5cee38128e29dac064a8a3b10cfd0f7a0d9f1c0a033a93f761cf6247a762eb12a2efcec3b46cfd68ff4b4ad88078
SSDEEP

6144:JtOfTQXkDWydEFMS/JJS7ytwXpVUrNoV5/cZ2hwpUwbVILSUe:JsfsXkDWyy1g7OwXQ0F8NiuV6s

Score

1^/10

Malware Config

Signatures

Files

wuuhosdeployment.dll
.dll windows x64

29531b9d1562e2d62ac1a1f753ab4d0d

Code Sign

33:00:00:05:df:c4:fb:7c:27:99:2d:e4:48:00:00:00:00:05:df
Certificate

Issuer

CN=Microsoft Development PCA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-08-2021 18:05

Not After

15-09-2022 18:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:03:c6:f9:b4:c3:ae:be:59:4b:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Development Root Certificate Authority 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28-05-2014 17:33

Not After

28-05-2029 17:43

Subject

CN=Microsoft Development PCA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3c:a9:d9:d3:24:78:3c:12:3c:b6:9f:1a:58:97:7c:f5:fb:07:7e:79:82:3a:bd:53:7c:7c:39:8a:99:ea:ef:21
Signer

Actual PE Digest

3c:a9:d9:d3:24:78:3c:12:3c:b6:9f:1a:58:97:7c:f5:fb:07:7e:79:82:3a:bd:53:7c:7c:39:8a:99:ea:ef:21

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13-04-2023 18:12
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wtoi64
_o__wtol
_o_abort
_o_calloc
_o_free
_o_iswalpha
_o_malloc
_o_mbstowcs_s
_o_strcpy_s
_o_terminate
_o_wcstoul
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy

api-ms-win-core-libraryloader-l1-2-0

LoadResource
DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
LoadLibraryExW
FreeLibrary
GetModuleFileNameW
GetModuleHandleExW
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeCriticalSectionAndSpinCount
CreateMutexExW
CreateSemaphoreExW
InitializeCriticalSectionEx
EnterCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
CreateMutexW
LeaveCriticalSection
ReleaseMutex
ReleaseSemaphore
WaitForSingleObject
DeleteCriticalSection

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
GetLastError
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-0

TlsFree
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetExitCodeThread
TlsSetValue
CreateThread
TlsGetValue
TlsAlloc
GetCurrentProcessId

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedFlushSList

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime

api-ms-win-crt-string-l1-1-0

memset
wcsncmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-com-l1-1-0

StringFromGUID2
CoTaskMemRealloc
CoTaskMemFree
CoDisconnectContext
CoCreateGuid
CoTaskMemAlloc
CoCreateInstance
CoRevokeClassObject
CoRegisterClassObject
CoDisconnectObject

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegCloseKey
RegDeleteKeyExW
RegOpenKeyExW
RegQueryValueExW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-kernel32-legacy-l1-1-0

DosDateTimeToFileTime

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

rpcrt4

UuidToStringA
RpcStringFreeA
UuidFromStringW
UuidCreate
UuidToStringW
RpcStringFreeW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-base-l1-1-0

MakeAbsoluteSD

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
MapViewOfFileEx
CreateFileMappingW

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
WUCreateExpressionEvaluator
WUCreateUpdateHandler

Sections

.text
Size: 249KB - Virtual size: 248KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

29531b9d1562e2d62ac1a1f753ab4d0d

Code Sign

33:00:00:05:df:c4:fb:7c:27:99:2d:e4:48:00:00:00:00:05:dfCertificate

Extended Key Usages

33:00:00:00:03:c6:f9:b4:c3:ae:be:59:4b:00:00:00:00:00:03Certificate

Key Usages

3c:a9:d9:d3:24:78:3c:12:3c:b6:9f:1a:58:97:7c:f5:fb:07:7e:79:82:3a:bd:53:7c:7c:39:8a:99:ea:ef:21Signer

Signature Validations

Verification

13-04-2023 18:12 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-security-sddl-l1-1-0

rpcrt4

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

Exports

Exports

Sections

.text Size: 249KB - Virtual size: 248KB

.rdata Size: 81KB - Virtual size: 80KB

.data Size: 3KB - Virtual size: 6KB

.pdata Size: 10KB - Virtual size: 9KB

.didat Size: 1024B - Virtual size: 608B

_RDATA Size: 512B - Virtual size: 256B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

33:00:00:05:df:c4:fb:7c:27:99:2d:e4:48:00:00:00:00:05:df
Certificate

33:00:00:00:03:c6:f9:b4:c3:ae:be:59:4b:00:00:00:00:00:03
Certificate

3c:a9:d9:d3:24:78:3c:12:3c:b6:9f:1a:58:97:7c:f5:fb:07:7e:79:82:3a:bd:53:7c:7c:39:8a:99:ea:ef:21
Signer

13-04-2023 18:12
Valid: false

.text
Size: 249KB - Virtual size: 248KB

.rdata
Size: 81KB - Virtual size: 80KB

.data
Size: 3KB - Virtual size: 6KB

.pdata
Size: 10KB - Virtual size: 9KB

.didat
Size: 1024B - Virtual size: 608B

_RDATA
Size: 512B - Virtual size: 256B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB