fdeploy[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fdeploy.dll
Size

127KB
MD5

161386b012d0689c1f1708228e941e6b
SHA1

c0aee719a9d734c093f4b287ade9bcad70e0d261
SHA256

48cd653c396365044fb226954b5b2cd089af2a4eff065362e9e0fcc32884e206
SHA512

dab2b197a9e838af349d48228e6409769f3b5219a8c282ff67bc74dc04fbc40e5888390f58f1003bfc58ee2eae8f78af735198b89c9da1655e87cc8fa32ec3dd
SSDEEP

3072:t+Hni+H3RR73yFY9LBfHlAUicqFH8DzL5wbmeVq1:tyR7iO9LlHlfWH82bm8q1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fdeploy.dll

Files

fdeploy.dll
.dll windows:10 windows x86 arch:x86

48f0934d4dcc6a74b196e602ee236e11

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

fdeploy.pdb

Imports

msvcrt

_initterm
_unlock
_amsg_exit
_lock
?terminate@@YAXXZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
memmove
__CxxFrameHandler3
free
_XcptFilter
_wcsicmp
_onexit
__dllonexit
??1type_info@@UAE@XZ
memcpy
_CxxThrowException
swscanf
qsort
_wcsnicmp
??0exception@@QAE@ABQBDH@Z
wcschr
malloc
towupper
_purecall
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memcpy_s
_vsnwprintf
_except_handler4_common
memset

shell32

SHGetKnownFolderPath
SHGetFolderPathEx

shlwapi

ord219
SHStrDupW
PathIsUNCW
ord270
PathRemoveBackslashW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetProcAddress
LoadStringW
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleHandleW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
SetThreadToken
OpenThreadToken
TerminateProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter

oleaut32

SafeArrayCreateVector
SafeArrayRedim
VariantCopyInd
SysStringLen
VariantChangeType
VariantCopy
SafeArrayPutElement
SafeArrayCreate
SafeArrayLock
SafeArrayUnlock
SafeArrayCopy
SafeArrayGetVartype
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocString
SysFreeString
VariantClear
VariantInit
SysAllocStringLen

api-ms-win-security-base-l1-1-0

CheckTokenMembership
DuplicateToken
DuplicateTokenEx
ImpersonateLoggedOnUser
EqualSid
RevertToSelf
GetTokenInformation

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CLSIDFromString
CoGetMalloc
CoTaskMemAlloc
CoGetCallContext
CoRevertToSelf
StringFromGUID2
CoCreateInstance

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableFlags
TraceMessage
RegisterTraceGuidsW
GetTraceEnableLevel

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

userenv

RsopResetPolicySettingStatus
ExpandEnvironmentStringsForUserW
GetProfileType

wldap32

ord224
ord167
ord73
ord97
ord145
ord301
ord127
ord88
ord41
ord140
ord26
ord14
ord147
ord208
ord18
ord16
ord36
ord13
ord27

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister

api-ms-win-core-heap-l2-1-0

LocalFree
GlobalAlloc
GlobalFree

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
WaitForSingleObjectEx
ReleaseSemaphore
ReleaseMutex
ReleaseSRWLockExclusive
OpenSemaphoreW
CreateMutexExW
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateSemaphoreExW
EnterCriticalSection
AcquireSRWLockExclusive

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCreateKeyExW
RegOpenCurrentUser
RegGetValueW
RegSetValueExW
RegDeleteValueW
RegOpenKeyExW
RegCloseKey
RegEnumValueW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetVersionExW
GetSystemTime
GetSystemTimeAsFileTime

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSidToStringSidW

api-ms-win-core-file-l1-1-0

DeleteFileW
CreateFileW
WriteFile
ReadFile
GetFileSizeEx
GetTempFileNameW

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
Sleep
WakeAllConditionVariable

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

wkscli

NetGetJoinInformation

logoncli

DsGetDcNameW

netutils

NetApiBufferFree

api-ms-win-security-lsalookup-l1-1-0

LookupAccountSidLocalW

api-ms-win-security-activedirectoryclient-l1-1-0

DsUnBindW
DsFreeNameResultW
DsBindWithSpnExW
DsCrackNamesW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW
RegEnumKeyW

gpsvc

ord106

ntdll

WinSqmAddToStream
EtwTraceMessage

cscapi

OfflineFilesQueryStatusEx
OfflineFilesStart

kernel32

lstrcmpiW
GetComputerNameW
GetPrivateProfileStringW
GetPrivateProfileIntW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

GenerateGroupPolicy
ProcessGroupPolicyEx
ProcessWmiPolicy

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

48f0934d4dcc6a74b196e602ee236e11

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

shell32

shlwapi

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

oleaut32

api-ms-win-security-base-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-string-l1-1-0

userenv

wldap32

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

wkscli

logoncli

netutils

api-ms-win-security-lsalookup-l1-1-0

api-ms-win-security-activedirectoryclient-l1-1-0

api-ms-win-core-registry-l2-1-0

gpsvc

ntdll

cscapi

kernel32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 96KB - Virtual size: 95KB

.data Size: 2KB - Virtual size: 3KB

.idata Size: 6KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 13KB - Virtual size: 13KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 96KB - Virtual size: 95KB

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 6KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 13KB - Virtual size: 13KB

.reloc
Size: 7KB - Virtual size: 6KB