BdeUi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bdeui.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
bdeui.dll
Resource
win10v2004-20240508-en
General
-
Target
bdeui.dll
-
Size
22KB
-
MD5
afb1e208d9a15efaf45a2cb43b84cef5
-
SHA1
8430dedc2c2ebd64ffb5a063fb02d15d793e437b
-
SHA256
aded42f4619d9a2e732821117e9e8591dd5d1e41b351c72ca0be401261674e47
-
SHA512
a31ed7915d408d24dbc47ff1d3c0c25e9f8e90c8b873516510af1af289276174d95f7f986f7edc9818249aee6fe2cf8e6df2a03bd2b6321755d0c72d52105e7a
-
SSDEEP
384:77oDebU1uZRilJ09M7K+qiHK9BHxAHrV2dYSXTuVzMZ0aIRsiobinrUWy6+W+C:7BDmlJJmNiH7VTzQInr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bdeui.dll
Files
-
bdeui.dll.dll windows:6 windows x86 arch:x86
3881d90ac2513ba394d7bbcfc275ccab
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
towupper
??2@YAPAXI@Z
_wcsicmp
??3@YAXPAX@Z
memset
_XcptFilter
malloc
free
_except_handler4_common
_vsnwprintf
_amsg_exit
_initterm
ntdll
VerSetConditionMask
RtlVerifyVersionInfo
fveapi
FveIsHardwareReadyForConversion
FveIsVolumeEncryptable
FveOpenVolumeW
FveGetStatus
FveCloseVolume
bcrypt
BCryptGetFipsAlgorithmMode
ole32
CoCreateInstance
CoGetObject
StringFromGUID2
CoTaskMemFree
StringFromIID
oleaut32
SysAllocString
VariantInit
VariantClear
SysFreeString
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetVolumePathNamesForVolumeNameW
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
FindFirstVolumeW
GetLastError
InterlockedDecrement
InterlockedIncrement
CreateMutexW
CloseHandle
GetCurrentThreadId
FindNextVolumeW
FindVolumeClose
GetVolumeNameForVolumeMountPointW
GetVolumeInformationW
user32
GetWindowThreadProcessId
AllowSetForegroundWindow
EnumChildWindows
FindWindowW
SendMessageTimeoutW
Exports
Exports
??0BuiVolume@@QAE@XZ
??0BuiVolume@@QAE@_N@Z
??0VolumeFveStatus@@IAE@XZ
??0VolumeFveStatus@@QAE@KJ@Z
??1BuiVolume@@QAE@XZ
??4BuiVolume@@QAEAAV0@ABV0@@Z
??4VolumeFveStatus@@QAEAAV0@ABV0@@Z
?AllowForegroundWindowDisplay@BuiVolume@@AAEJXZ
?AttemptAutoUnlock@BuiVolume@@QAEJXZ
?BasicDispatch@BuiVolume@@AAEJJPBG0PAHPAJ@Z
?BasicDispatch@BuiVolume@@AAEJJPBG0PAJ@Z
?BasicDispatch@BuiVolume@@AAEJJPBGPAHPAJ@Z
?BasicDispatch@BuiVolume@@AAEJJPBGPAJ@Z
?BasicDispatch@BuiVolume@@AAEJJPBGPAPAG@Z
?BasicDispatch@BuiVolume@@AAEJJPBGPAUtagVARIANT@@@Z
?BuisCreateElevatedProxyObject@@YGJPAUHWND__@@PAPAUIDispatch@@@Z
?BuisCreateProxyObject@@YGJPAPAUIDispatch@@@Z
?BuisDetectExistingWizard@@YGJPBG00PAPAX@Z
?BuisIsFipsEnabled@@YG_NXZ
?BuisIsHardwareReadyForConversion@@YGJXZ
?BuisLaunchHelp@@YGJABU_GUID@@@Z
?CanRefreshStatus@BuiVolume@@AAE_NXZ
?ClearProxyObject@BuiVolume@@QAEXXZ
?Decrypt@BuiVolume@@QAEJXZ
?DeleteVolumeList@BuiVolume@@SGXPAPAU_BuiVolumeNode@@@Z
?Disable@BuiVolume@@QAEJXZ
?Dispatch@BuiVolume@@AAEJJPAUtagDISPPARAMS@@PAJ@Z
?Dispatch@BuiVolume@@AAEJJPAUtagDISPPARAMS@@PAUtagVARIANT@@@Z
?EnableAutoUnlock@BuiVolume@@QAEJXZ
?FailedDryRun@VolumeFveStatus@@QAE_NXZ
?FindMountPoint@BuiVolume@@AAEJXZ
?FormatNameAndMountPoint@BuiVolume@@AAEJXZ
?GetAllVolumes@BuiVolume@@SGJPAPAU_BuiVolumeNode@@@Z
?GetConvertedPercent@BuiVolume@@QAENXZ
?GetDescription@BuiVolume@@QAEJPAPAG@Z
?GetLastConvertStatus@VolumeFveStatus@@QAEJXZ
?GetOsVolume@BuiVolume@@SGJPAPAV1@@Z
?GetPasswordId@BuiVolume@@QAEJPAPAG@Z
?GetStatusFlags@VolumeFveStatus@@QAEKXZ
?HasAutoUnlockVolumesBound@BuiVolume@@QAE_NXZ
?HasExternalKey@VolumeFveStatus@@QAE_NXZ
?HasPassphraseProtector@VolumeFveStatus@@QAE_NXZ
?HasPinProtector@VolumeFveStatus@@QAE_NXZ
?HasRecoveryData@VolumeFveStatus@@QAE_NXZ
?HasRecoveryPassword@VolumeFveStatus@@QAE_NXZ
?HasSmartCardProtector@VolumeFveStatus@@QAE_NXZ
?HasStartupKeyProtector@VolumeFveStatus@@QAE_NXZ
?HasTpmProtector@VolumeFveStatus@@QAE_NXZ
?ImplicitPauseConversion@BuiVolume@@QAEJXZ
?Init@BuiVolume@@QAEJPAG@Z
?InitMembers@BuiVolume@@AAEXXZ
?IsAutoUnlockEnabled@BuiVolume@@QAE_NXZ
?IsConverting@VolumeFveStatus@@QAE_NXZ
?IsDecrypted@VolumeFveStatus@@QAE_NXZ
?IsDecrypting@VolumeFveStatus@@QAE_NXZ
?IsDisabled@VolumeFveStatus@@QAE_NXZ
?IsEncrypted@VolumeFveStatus@@QAE_NXZ
?IsEncrypting@VolumeFveStatus@@QAE_NXZ
?IsFveNotifyNecessary@VolumeFveStatus@@QAE_NXZ
?IsLocked@VolumeFveStatus@@QAE_NXZ
?IsOn@VolumeFveStatus@@QAE_NXZ
?IsOsVolume@VolumeFveStatus@@QAE_NXZ
?IsPartiallyConverted@VolumeFveStatus@@QAE_NXZ
?IsPaused@VolumeFveStatus@@QAE_NXZ
?IsRoamingDevice@VolumeFveStatus@@QAE_NXZ
?IsSecure@VolumeFveStatus@@QAE_NXZ
?IsServerSku@BuiVolume@@QAE_NXZ
?LaunchUpdate@BuiVolume@@QAEJXZ
?LaunchWizard@BuiVolume@@QAEJG@Z
?NO_DRIVE_LETTER@BuiVolume@@2IB
?NeedsDiscoveryVolumeUpdate@BuiVolume@@QAEJPAH@Z
?NeedsRestart@VolumeFveStatus@@QAE_NXZ
?PauseConversion@BuiVolume@@QAEJXZ
?ProxyAreVolumesBound@BuiVolume@@AAEJXZ
?ProxyAttemptAutoUnlock@BuiVolume@@AAEJXZ
?ProxyDecrypt@BuiVolume@@AAEJXZ
?ProxyDisable@BuiVolume@@AAEJXZ
?ProxyEnableAutoUnlock@BuiVolume@@AAEJXZ
?ProxyGetDescription@BuiVolume@@AAEJPAPAG@Z
?ProxyGetPasswordId@BuiVolume@@AAEJPAPAG@Z
?ProxyGetProcessId@BuiVolume@@AAEJPAK@Z
?ProxyImplicitPauseConversion@BuiVolume@@AAEJXZ
?ProxyIsAutoUnlockEnabled@BuiVolume@@AAEJXZ
?ProxyLaunchUpdate@BuiVolume@@AAEJXZ
?ProxyLaunchWizard@BuiVolume@@AAEJG@Z
?ProxyNeedsDiscoveryVolumeUpdate@BuiVolume@@AAEJPAH@Z
?ProxyPauseConversion@BuiVolume@@AAEJXZ
?ProxyResumeConversion@BuiVolume@@AAEJXZ
?ProxyServiceDiscoveryVolume@BuiVolume@@AAEJXZ
?ProxyUnlockVolumeWithKey@BuiVolume@@AAEJPBGPAH@Z
?ProxyUnlockVolumeWithPassphrase@BuiVolume@@AAEJPBGPAH@Z
?ProxyUnlockVolumeWithPassword@BuiVolume@@AAEJPBGPAH@Z
?ProxyUnlockVolumeWithSmartCard@BuiVolume@@AAEJPAUHWND__@@PAH@Z
?RefreshStatus@BuiVolume@@QAEJ_N@Z
?RequiresElevation@BuiVolume@@QAE_NXZ
?ResetStatusRefreshing@BuiVolume@@QAEXXZ
?ResumeConversion@BuiVolume@@QAEJXZ
?ResumeStatusRefreshing@BuiVolume@@QAEXXZ
?ServiceDiscoveryVolume@BuiVolume@@QAEJXZ
?SetProxyObject@BuiVolume@@QAEXPAUIDispatch@@@Z
?SuspendStatusRefreshing@BuiVolume@@QAEXXZ
?UnlockWithKey@BuiVolume@@QAEJPBGPAH@Z
?UnlockWithPassphrase@BuiVolume@@QAEJPBGPAH@Z
?UnlockWithPassword@BuiVolume@@QAEJPBGPAH@Z
?UnlockWithSmartCard@BuiVolume@@QAEJPAUHWND__@@PAH@Z
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 860B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 616B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ