fveapibase[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

fveapibase.dll
Size

358KB
MD5

ae58ecc31399adb8f01aa65480c60b70
SHA1

f5b91181ec2e36fe89db5ea59150ca0b7ed244b8
SHA256

d8f43f9c10ced220ca5b2bcea20b06766568be0c27914c4b39541656717fd78d
SHA512

2f2cfa88e3441875845542996373c24ea57ca7b289bd1208a89fb252062c8debe07a800cfa8e6cd0f0b41349da8ce24d049c5cf8386acfedc76022e169943721
SSDEEP

6144:lPKdWf3+Q7/xqTwIBGiC11LvC7HxvfskHy1foPpmZDLY0UOXwSV:1TwTwCrC1LviRlxPpmBU0UOh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fveapibase.dll

Files

fveapibase.dll
.dll windows:10 windows x86 arch:x86

2a2a47cb90c397fb03528554a34a60f4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

fveapibase.pdb

Imports

msvcrt

memmove_s
_vsnwprintf
_purecall
iswdigit
wcstoul
_strnicmp
_stricmp
wcschr
toupper
__CxxFrameHandler3
??1type_info@@UAE@XZ
memcpy
memmove
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
memcmp
_initterm
free
memcpy_s
_amsg_exit
_XcptFilter
_callnewh
malloc
_wcsicmp
memset

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventUnregister
EventProviderEnabled
EventWriteTransfer

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
TlsSetValue
TlsGetValue
TlsFree
TerminateProcess
TlsAlloc
GetCurrentProcess
SetThreadToken
GetCurrentProcessId
OpenThreadToken
GetCurrentThreadId
OpenProcessToken

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemWindowsDirectoryW
GetSystemTime
GetTickCount64

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter

bcd

BcdGetElementData
SyspartGetSystemPartition
BcdCloseObject
BcdOpenObject
BcdOpenSystemStore
BcdCloseStore
BcdQueryObject

bcrypt

BCryptGetFipsAlgorithmMode
BCryptDestroyKey
BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptEncrypt
BCryptGetProperty
BCryptFinishHash
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
BCryptDecrypt
BCryptSetProperty
BCryptGenerateSymmetricKey

tbs

Tbsi_GetDeviceInfo
Tbsi_Get_TCG_Log
Tbsi_Context_Create
Tbsip_Context_Close
Tbsip_Submit_Command_NonBlocking

fveapi

FveGetSecureBootBindingState

ntdll

NtPowerInformation
RtlCheckPortableOperatingSystem
NtQuerySystemEnvironmentValueEx
RtlInitUnicodeString
RtlCompareMemory
RtlSubscribeWnfStateChangeNotification
RtlFreeUnicodeString
RtlStringFromGUID
NtClose
NtQueryValueKey
NtOpenKey
EtwEventWrite
EtwEventUnregister
EtwEventRegister
RtlPublishWnfStateData
NtQueryWnfStateData
NtQueryVolumeInformationFile
NtQuerySystemInformation
RtlSetThreadErrorMode
RtlNtStatusToDosError
RtlUnsubscribeWnfStateChangeNotification

rpcrt4

UuidCreate

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegDeleteValueW
RegSetValueExW
RegUnLoadKeyW
RegOpenKeyExW
RegGetValueA
RegEnumValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegGetValueW
RegLoadKeyW

api-ms-win-security-base-l1-1-0

DuplicateTokenEx
RevertToSelf
AdjustTokenPrivileges

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-file-l1-1-0

CreateFileW
GetDriveTypeW
FindFirstFileW
FindFirstVolumeW
FindNextVolumeW
GetVolumeInformationW
GetLogicalDrives
GetDiskFreeSpaceW
FindVolumeClose
ReadFile
SetFilePointerEx
GetFileAttributesW
FlushFileBuffers
WriteFile
GetFileSizeEx
SetFileAttributesW
DeleteFileW
FindClose

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapSize
HeapAlloc
HeapFree

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleFileNameA
FreeLibrary
GetProcAddress
GetModuleFileNameW
GetModuleHandleExW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
EnterCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObject
OpenSemaphoreW
InitializeCriticalSection
CreateMutexExW
CreateSemaphoreExW
SetEvent
CreateEventW
LeaveCriticalSection

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-eventing-controller-l1-1-0

EnableTraceEx2
StartTraceW
ControlTraceW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

ncrypt

NCryptUnprotectSecret
NCryptCloseProtectionDescriptor
NCryptProtectSecret
NCryptCreateProtectionDescriptor
NCryptGetProtectionDescriptorInfo

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree

crypt32

CryptDecodeObjectEx
CertGetEnhancedKeyUsage
CertVerifyCertificateChainPolicy

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-com-l1-1-0

CLSIDFromString

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy

Exports

Exports

FveAuthElementFromPassPhraseW
FveAuthElementFromPinW
FveAuthElementFromRecoveryPasswordW
FveAuthElementGetKeyFileNameW
FveAuthElementReadExternalKeyW
FveAuthElementToRecoveryPasswordW
FveAuthElementWriteExternalKeyW
FveCanPinExceptionPolicyBeApplied
FveClearUserFlags
FveCloseHandle
FveCloseVolume
FveCommitChanges
FveCommitChangesEx
FveConversionDecrypt
FveConversionDecryptEx
FveConversionPause
FveConversionResume
FveConversionStop
FveConversionStopEx
FveDiscardChanges
FveEnableRawAccess
FveEraseDrive
FveFindFirstVolume
FveFindNextVolume
FveGetAllowKeyExport
FveGetAuthMethodGuids
FveGetAuthMethodInformation
FveGetDataSet
FveGetFipsAllowDisabled
FveGetFveMethod
FveGetFveMethodEDrv
FveGetFveMethodEx
FveGetIdentity
FveGetKeyPackage
FveGetStatus
FveGetStatusW
FveGetUserFlags
FveGetVolumeNameW
FveIsHardwareReadyForConversion
FveIsRecoveryPasswordGroupValidW
FveIsRecoveryPasswordValidW
FveIsVolumeEncryptable
FveLockVolume
FveNotifyVolumeAfterFormat
FveOpenVolumeByHandle
FveOpenVolumeExW
FveOpenVolumeW
FveQuery
FveRevertVolume
FveSelectBestRecoveryPasswordByBackupInformation
FveSetAllowKeyExport
FveSetFipsAllowDisabled
FveSetFveMethod
FveSetRecoveryPasswordBackupInformation
FveSetUserFlags
FveUpgradeVolume
InternalFveIsVolumeEncrypted

Sections

.text
Size: 330KB - Virtual size: 330KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2a2a47cb90c397fb03528554a34a60f4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

bcd

bcrypt

tbs

fveapi

ntdll

rpcrt4

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-timezone-l1-1-0

ncrypt

api-ms-win-core-file-l1-2-0

api-ms-win-core-memory-l1-1-0

crypt32

api-ms-win-core-heap-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-processthreads-l1-1-1

Exports

Exports

Sections

.text Size: 330KB - Virtual size: 330KB

.data Size: 1KB - Virtual size: 2KB

.idata Size: 8KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 60B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 15KB - Virtual size: 15KB

.text
Size: 330KB - Virtual size: 330KB

.data
Size: 1KB - Virtual size: 2KB

.idata
Size: 8KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 60B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 15KB - Virtual size: 15KB