fundisc[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fundisc.dll
Size

134KB
MD5

ec7562fbc4853fef3943965f5a44b112
SHA1

a64a420490ac21ca6decc5c3ec3e424073bf0378
SHA256

acb3f4aa14f6039d979db4b59163748ea5771f6888f9d37424a0e6f2ccf0a0b6
SHA512

dfb7047e69e7f6a04880914af39b70e2c73ac12a742908ecd82a22a451b2820be74b78bd74e129e6c674064110bdb50953910d7adbe8c20cbc551d8d0447d4ba
SSDEEP

3072:BYQ6dnetnHPi7DMDc1LSOJo7SuGa9anApkTQr29C46:m3deNHPiHMDcDJo7SuGaYd6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fundisc.dll

Files

fundisc.dll
.dll windows:10 windows x86 arch:x86

6a47992e0ddc29fa3d2bf01991ad956e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

FunDisc.pdb

Imports

msvcrt

_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
_callnewh
memcpy
memcmp
malloc
_wtoi
wcsstr
wcsncmp
wcschr
realloc
free
_CxxThrowException
_wcsicmp
memmove
memcpy_s
wcsrchr
_vsnwprintf
memset

ntdll

NtQueryInformationToken
WinSqmAddToStreamEx
NtQueryInformationProcess
RtlCaptureStackBackTrace
WinSqmIsOptedIn
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleHandleW
LoadStringW
GetModuleFileNameW
GetProcAddress
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
DeleteCriticalSection
CreateSemaphoreExW
LeaveCriticalSection
WaitForMultipleObjectsEx
CreateMutexExW
EnterCriticalSection
SetEvent
TryEnterCriticalSection
CreateEventW
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
ReleaseSRWLockExclusive
ResetEvent
OpenSemaphoreW
InitializeSRWLock
AcquireSRWLockExclusive

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

CreateThread
TerminateProcess
OpenProcessToken
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

GetUserDefaultLCID
FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventWriteTransfer
EventUnregister
EventRegister

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegNotifyChangeKeyValue
RegSetValueExW
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyExW
RegEnumValueW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
WakeAllConditionVariable
Sleep
InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6a47992e0ddc29fa3d2bf01991ad956e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 105KB - Virtual size: 105KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 160B

.rsrc Size: 16KB - Virtual size: 15KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 105KB - Virtual size: 105KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 160B

.rsrc
Size: 16KB - Virtual size: 15KB

.reloc
Size: 6KB - Virtual size: 6KB