fdWSD[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fdWSD.dll
Size

105KB
MD5

47d9bccbf34da5590ef159999184b3ff
SHA1

357cbae83f58a3c8c63eb9d8cabf35173df2ba20
SHA256

17602c4f541ccb3bbb9ae35f16a75663f5e53c88491aa26764775a1fe9bb3555
SHA512

d8d4e500de136d89ca6eb637907b8b2ce1cd5b81137987ec9e0394993cbf4d016d81d5ed02f34d984c423731a401b9069cde6e87c425ee7746a23050e3042e50
SSDEEP

1536:iVQzVsjENvQk+GJehPDUSzGrkJVR5HWIZTEU:4QJs4z+G2zGSVR9hE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fdWSD.dll

Files

fdWSD.dll
.dll regsvr32 windows:10 windows x86 arch:x86

11477910e3339a4b565c90a985f971df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

fdWSD.pdb

Imports

msvcrt

_except_handler4_common
_initterm
free
_amsg_exit
memcpy
_XcptFilter
_callnewh
wcschr
time
srand
rand
_wcsdup
_wcsnicmp
wcsrchr
memcmp
_vsnwprintf
_wcsicmp
realloc
wcscat_s
malloc
memset

oleaut32

VarUI4FromStr

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
GetTraceEnableFlags
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
RegisterTraceGuidsW

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
SizeofResource
LoadResource
FindResourceExW

api-ms-win-core-com-l1-1-0

CoSetProxyBlanket
CoCreateInstance
CoRevertToSelf
PropVariantClear
CoTaskMemAlloc
CoImpersonateClient
CoTaskMemFree
CoInitializeEx
CoUninitialize
CoTaskMemRealloc
PropVariantCopy

api-ms-win-core-string-l2-1-0

CharPrevW
CharNextW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExA
RegDeleteValueW
RegCreateKeyExW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegGetValueW
RegOpenKeyExW
RegSetValueExW
RegEnumValueW

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualQuery
VirtualAlloc

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-synch-l1-1-0

CreateEventW
InitializeCriticalSectionAndSpinCount
AcquireSRWLockShared
ReleaseSRWLockExclusive
SetEvent
EnterCriticalSection
LeaveCriticalSection
InitializeSRWLock
InitializeCriticalSection
ReleaseSRWLockShared
WaitForSingleObject
DeleteCriticalSection
ResetEvent
AcquireSRWLockExclusive

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-heap-l1-1-0

HeapDestroy

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-security-base-l1-1-0

GetTokenInformation
CheckTokenMembership

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
SetThreadToken
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
OpenThreadToken
GetCurrentProcessId

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork
CreateThreadpool
SetThreadpoolThreadMaximum
CreateThreadpoolWork
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CloseThreadpool

ws2_32

GetAddrInfoW
FreeAddrInfoW
WSAStartup
WSACleanup

rpcrt4

UuidCreate

iphlpapi

ConvertInterfaceGuidToLuid

api-ms-win-core-localization-l1-2-0

GetSystemDefaultLCID

api-ms-win-core-synch-l1-2-0

Sleep
SleepConditionVariableSRW
WakeAllConditionVariable

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

kernel32

UnregisterWaitEx
DeleteTimerQueueEx
lstrcpynW
lstrcmpiW
CreateTimerQueue
DeleteTimerQueueTimer
CreateTimerQueueTimer

wsdapi

WSDDetachLinkedMemory
WSDCreateDiscoveryProvider2
WSDCopyEndpoint
WSDCompareEndpoints
WSDNotifyNetworkChange
WSDAddFirewallCheck
WSDCreateMetadataAgent
WSDRemoveFirewallCheck
WSDCancelNetworkChangeNotify
WSDXMLGetValueFromAny
WSDFreeLinkedMemory
WSDXMLCreateContext
WSDXMLGetNameFromBuiltinNamespace
WSDCopyNameList

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
FdphostSessionChange
FdphostSetComContext
FdphostSetSharedService

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

11477910e3339a4b565c90a985f971df

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-threadpool-l1-2-0

ws2_32

rpcrt4

iphlpapi

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

kernel32

wsdapi

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 87KB - Virtual size: 87KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 5KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 120B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 87KB - Virtual size: 87KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 5KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 120B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 6KB - Virtual size: 6KB