fdeploy.pdb
Static task
static1
Behavioral task
behavioral1
Sample
fdeploy.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fdeploy.dll
Resource
win10v2004-20240508-en
General
-
Target
fdeploy.dll
-
Size
58KB
-
MD5
6f241d9c35d157a376003cdef2e26cae
-
SHA1
34d0c2cb85e2952e85e60352db13b1984c490800
-
SHA256
a306d1bbc2123eb9666e5d15cf8f658eb0687c090d820e4e0457077ad607f4fb
-
SHA512
42e9bfe76594efd0a011e19b5dc77c1594b27e433eb6656bf3f0dea5ecca81e14e5b983c88213a2f1e3a4c7a199c2bc8952d202385258e775695b8359a148cc9
-
SSDEEP
1536:1RONPi4QCePIniUtgonJheIdD+d0z9/t4KZ:HOY4QCzniUtgonJwIdDIKN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fdeploy.dll
Files
-
fdeploy.dll.dll windows:6 windows x86 arch:x86
ccc675c6203f83c015ee4f55b0e4c8af
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_XcptFilter
free
malloc
_initterm
_except_handler4_common
qsort
_wcsicmp
swscanf
wcschr
_wcsnicmp
_purecall
memcpy
_amsg_exit
__CxxFrameHandler3
_vsnwprintf
memset
kernel32
RegCreateKeyExW
RegOpenKeyExW
GetVersionExW
InterlockedIncrement
InterlockedDecrement
GetLastError
CloseHandle
CompareStringOrdinal
FormatMessageW
LocalFree
RegSetValueExW
RegDeleteValueW
RegEnumValueW
DisableThreadLibraryCalls
RegCloseKey
GetPrivateProfileStringW
GetPrivateProfileIntW
CreateFileW
GetSystemTime
DeleteFileW
RegGetValueW
RegOpenCurrentUser
SetLastError
WriteFile
ReadFile
GetFileSizeEx
GetTempFileNameW
InterlockedExchange
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
ole32
StringFromGUID2
CoTaskMemFree
CoCreateInstance
oleaut32
VariantClear
SafeArrayCreate
SysAllocStringLen
SysAllocString
SysFreeString
VariantInit
SafeArrayDestroy
SafeArrayPutElement
advapi32
GetTokenInformation
ConvertSidToStringSidW
ImpersonateLoggedOnUser
DuplicateTokenEx
EventRegister
EventUnregister
EventWrite
DuplicateToken
CheckTokenMembership
ConvertStringSidToSidW
EqualSid
RevertToSelf
shell32
SHGetKnownFolderPath
SHGetFolderPathEx
userenv
ExpandEnvironmentStringsForUserW
RsopResetPolicySettingStatus
user32
LoadStringW
gpsvc
ord106
shlwapi
ord270
ord219
SHStrDupW
Exports
Exports
GenerateGroupPolicy
ProcessGroupPolicyEx
Sections
.text Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ