fde[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

fde.dll
Size

157KB
MD5

d0236ca0c0cee5ba6dfca1a362543dd9
SHA1

029a77bb683836380d2fcfc2ca28e0860dafd90f
SHA256

1141448246f8d3ee59dac2e09f4669b766b0796d97a6b57dd38fa780ebb85a83
SHA512

a7a4b32826e794845c39f9770da5cc05d59809303d554e3f635500ca4ffbc22fa114e8eb39241370fefd40910005468226c75cc5900368726556ba4c394ad5b5
SSDEEP

3072:we/dyyFdetJOiOT/tStTbkGqaES0YB/Jp8AvwCi+RU3w8eI9vYyicp5h:w0IbtJ6tibNqaES0u/frypw8eI98YP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fde.dll

Files

fde.dll
.dll windows:10 windows x86 arch:x86

b81dd8dc1e09863ad6112f3a9f5fff8f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

fde.pdb

Imports

mfc42u

ord3621
ord1143
ord1634
ord2810
ord2606
ord940
ord942
ord922
ord924
ord4199
ord1899
ord489
ord768
ord2362
ord2293
ord2350
ord3092
ord5949
ord4704
ord4253
ord4419
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4829
ord3793
ord5283
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1767
ord4073
ord6048
ord2506
ord4992
ord4848
ord4371
ord5261
ord4352
ord4942
ord4970
ord4736
ord4899
ord5154
ord5156
ord5155
ord860
ord561
ord815
ord3948
ord2717
ord1128
ord3733
ord4418
ord4616
ord3396
ord5710
ord5285
ord5303
ord4692
ord4074
ord5298
ord5296
ord3341
ord2388
ord5193
ord1089
ord3917
ord268
ord2504
ord2546
ord4480
ord6371
ord3806
ord925
ord927
ord2813
ord4197
ord926
ord6278
ord6279
ord6920
ord4124
ord941
ord2755
ord4270
ord2371
ord324
ord641
ord2403
ord2015
ord4213
ord2570
ord6051
ord1768
ord4392
ord5286
ord4831
ord3397
ord3577
ord567
ord616
ord3716
ord795
ord2567
ord4390
ord3569
ord609
ord3605
ord656
ord3871
ord2078
ord6211
ord3133
ord6193
ord6195
ord2294
ord4229
ord2859
ord6237
ord3592
ord5276
ord4847
ord6024
ord2634
ord3694
ord2574
ord4396
ord3365
ord3635
ord693
ord3296
ord5845
ord1166
ord565
ord817
ord3993
ord6898
ord6896
ord3991
ord4279
ord2638
ord5977
ord4370
ord3067
ord2910
ord5679
ord826
ord269
ord600
ord1240
ord1571
ord1250
ord1568
ord1570
ord342
ord1179
ord1248
ord1115
ord1194
ord1563
ord1165
ord3658
ord1560
ord2406
ord2385
ord3566
ord858
ord823
ord538
ord535
ord861
ord1258
ord800
ord4155
ord540
ord6466
ord5727
ord825

msvcrt

??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
memcpy_s
_purecall
__CxxFrameHandler3
memcmp
__RTDynamicCast
swscanf
_wtoi
memmove_s
_wcsicmp
??0exception@@QAE@ABV0@@Z
_vsnwprintf
memcpy
wcschr
free
_wcsnicmp
wcsstr
_vsnprintf_s
wcsrchr
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
malloc
??0exception@@QAE@XZ
memset

atl

ord32
ord21
ord15
ord16

oleaut32

SysAllocString
VariantInit
SysFreeString
VariantClear

api-ms-win-core-com-l1-1-0

CoSetProxyBlanket
CoGetMalloc
CoCreateInstance
StringFromCLSID
CreateStreamOnHGlobal
CLSIDFromString
CoTaskMemFree
CoTaskMemAlloc

api-ms-win-core-heap-l2-1-0

GlobalAlloc
GlobalFree
LocalAlloc
LocalFree

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
DeleteCriticalSection
ReleaseSRWLockShared
InitializeCriticalSectionEx
OpenSemaphoreW
ReleaseSemaphore
AcquireSRWLockShared
CreateSemaphoreExW
LeaveCriticalSection
CreateMutexExW
InitializeCriticalSection
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObjectEx
AcquireSRWLockExclusive
EnterCriticalSection

api-ms-win-security-base-l1-1-0

FreeSid

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-file-l1-1-0

SetFileAttributesW
WriteFile
CreateFileW
CreateDirectoryW
GetFileAttributesW
DeleteFileW

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
LoadLibraryExW
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
GetModuleFileNameW
LoadStringW

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegGetValueW
RegOpenKeyExW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer

logoncli

DsGetDcNameW

netutils

NetApiBufferFree

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW
LookupAccountNameW

mpr

WNetGetUniversalNameW

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
Sleep
SleepConditionVariableSRW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

comctl32

CreatePropertySheetPageW

kernel32

lstrcmpiW
GlobalLock
GlobalUnlock
lstrcmpW
WritePrivateProfileSectionW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
lstrlenW

ntdll

RtlUnicodeStringToInteger
RtlFreeUnicodeString
RtlConvertSidToUnicodeString
RtlAllocateAndInitializeSid

ole32

ReleaseStgMedium
CoInitialize

shell32

SHGetPathFromIDListW
SHBrowseForFolderW

shlwapi

ord158
PathCompactPathW
PathIsUNCW
StrDupW

user32

RegisterClipboardFormatW
LoadBitmapW
SetCursor
MessageBeep
GetParent
EnableWindow
UnhookWindowsHookEx
SendMessageW
MessageBoxW
GetWindowRect
SetWindowsHookExW
ScreenToClient
GetClientRect
IsWindowVisible
SetParent
LoadCursorW
CallNextHookEx

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b81dd8dc1e09863ad6112f3a9f5fff8f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc42u

msvcrt

atl

oleaut32

api-ms-win-core-com-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

logoncli

netutils

api-ms-win-security-lsalookup-l2-1-0

mpr

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

comctl32

kernel32

ntdll

ole32

shell32

shlwapi

user32

Exports

Exports

Sections

.text Size: 123KB - Virtual size: 122KB

.data Size: 3KB - Virtual size: 13KB

.idata Size: 7KB - Virtual size: 7KB

.rsrc Size: 9KB - Virtual size: 9KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: 123KB - Virtual size: 122KB

.data
Size: 3KB - Virtual size: 13KB

.idata
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 9KB - Virtual size: 9KB

.reloc
Size: 12KB - Virtual size: 12KB