AppXDeploymentClient[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

AppXDeploymentClient.dll
Size

194KB
MD5

31a648d3b844937209eb116025a22dd6
SHA1

1d4dc36a1e094409e2e856a4726024c9e1657bc4
SHA256

bfdad14a0a65572c3b2f255ae5f3b7e3603e85fbfccbb9dd20387abc75bca659
SHA512

74c84687cb1a0382ff4c71e4920a707bbc6f7f63ec52932d2082f4805c8bb0655503de1df9605ff01ee823f95cc48b6aec77b10c3a1aef04e6c14b94615ff37a
SSDEEP

6144:1ZM/5Q6rPwfIBmXBNB+89xxM9vNux4JoEJNbnz:bM/5Q6rPe97M9wx4JpJN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AppXDeploymentClient.dll

Files

AppXDeploymentClient.dll
.dll windows:6 windows x86 arch:x86

36c8a5f4700a0706d4438ce4226af5f2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AppXDeploymentClient.pdb

Imports

api-ms-win-core-crt-l1-1-0

_except_handler4_common
memmove
memcmp
memcpy
memset
wcsrchr
memmove_s

api-ms-win-core-crt-l2-1-0

_initterm
_initterm_e
_purecall
__dllonexit3
_onexit

ntdll

RtlInitializeSRWLock
NtClose
RtlUnsubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
RtlReleaseSRWLockShared
RtlAllocateWnfSerializationGroup
RtlNtStatusToDosErrorNoTeb
NtMapViewOfSection
EtwEventRegister
NtOpenFile
RtlReleaseRelativeName
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtSetInformationFile
NtQueryInformationFile
RtlDeleteCriticalSection
RtlAcquireSRWLockShared
RtlInitializeCriticalSection
RtlGetLastWin32Error
NtQuerySystemInformation
RtlReportException
NtUnmapViewOfSection
RtlAcquireSRWLockExclusive
RtlNtStatusToDosError
RtlFreeUnicodeString
RtlReleaseSRWLockExclusive
RtlConvertSidToUnicodeString
RtlFreeHeap
RtlReAllocateHeap
RtlAllocateHeap
NtQueryInformationThread
RtlEnterCriticalSection
RtlLeaveCriticalSection
EtwEventWrite
EtwEventUnregister
NtCreateSection

rpcrt4

RpcBindingUnbind
RpcBindingFree
RpcBindingCreateW
RpcBindingBind
RpcAsyncCompleteCall
RpcAsyncCancelCall
RpcAsyncInitializeHandle
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
IUnknown_AddRef_Proxy
NdrClientCall2
NdrAsyncClientCall
I_RpcExceptionFilter
NdrDllGetClassObject
NdrCStdStubBuffer2_Release
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerQueryInterface
IUnknown_Release_Proxy
NdrStubCall2
CStdStubBuffer_CountRefs
NdrOleAllocate
NdrStubForwardingFunction
CStdStubBuffer_AddRef
IUnknown_QueryInterface_Proxy
NdrOleFree

api-ms-win-core-heap-l1-2-0

HeapFree
GetProcessHeap
HeapReAlloc
HeapAlloc

api-ms-win-core-com-l1-1-1

CoTaskMemAlloc
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoGetCallContext
CoGetApartmentType
CoUninitialize
CoInitializeEx
CoCreateInstance

api-ms-win-core-winrt-error-l1-1-1

RoOriginateError
RoTransformError
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
SetRestrictedErrorInfo
RoReportFailedDelegate
RoSetErrorReportingFlags
GetRestrictedErrorInfo
RoOriginateErrorW

api-ms-win-core-synch-l1-2-0

SetEvent
ReleaseSRWLockShared
SleepEx
ReleaseSRWLockExclusive
DeleteCriticalSection
CreateEventExW
AcquireSRWLockShared
WaitForSingleObject
AcquireSRWLockExclusive
EnterCriticalSection
InitializeSRWLock
InitOnceExecuteOnce
CreateEventW
InitializeCriticalSection
LeaveCriticalSection

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventUnregister
EventWrite
EventRegister

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
GetCurrentProcess
OpenProcessToken
OpenThreadToken
GetCurrentThreadId
GetCurrentThread
TerminateProcess

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetUnhandledExceptionFilter
SetLastError
RaiseException
UnhandledExceptionFilter

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoInitialize
RoGetActivationFactory

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleFileNameW
LoadLibraryExA
LoadStringW
FreeLibrary

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-file-l1-2-1

RemoveDirectoryW
DeleteFileW
FindClose
CreateFileW
SetFileAttributesW
GetFileAttributesW
FindFirstFileW
FindNextFileW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegDeleteKeyExW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
RegDeleteTreeW
RegSetValueExW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-service-management-l1-1-0

OpenServiceW
OpenSCManagerW
StartServiceW
CloseServiceHandle

api-ms-win-service-management-l2-1-0

QueryServiceStatusEx
NotifyServiceStatusChangeW

api-ms-win-security-base-l1-2-0

ImpersonateLoggedOnUser
CopySid
GetLengthSid
RevertToSelf
GetTokenInformation
InitializeAcl
AddAccessAllowedAceEx
InitializeSecurityDescriptor
SetSecurityDescriptorDacl

api-ms-win-core-string-l1-1-0

CompareStringW
CompareStringEx

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree
LocalAlloc

combase

ord18
ord15
ord19
ord34
ord2
ord9
ord5
ord12
ord32
ord17
ord6
ord14
ord7
ord16
ord11
ord33
ord13
ord8
ord20
ord10

api-ms-win-core-debug-l1-1-1

DebugBreak

Exports

Exports

AppxAddPackageToAllUserStoreForPbr
AppxDeletePackageFiles
AppxGetPackageType
AppxPackageRepositoryRecoverStagedPackages
AppxPackageRepositoryRecoverUserInstalls
AppxPreRegisterPackage
AppxPreStageCleanupRunTask
AppxRecoverUserInstallsForUpgrade
AppxRequestRemovePackageForUser
AppxValidatePackages
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetApplicability
GetPackageApplicabilityForUserLogon
IsPackageInstalled
RDSRecoverRequests
ReArmAppxPreStageCleanupTask

Sections

.text
Size: 157KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 340B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

minATL
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36c8a5f4700a0706d4438ce4226af5f2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-crt-l1-1-0

api-ms-win-core-crt-l2-1-0

ntdll

rpcrt4

api-ms-win-core-heap-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-heap-obsolete-l1-1-0

combase

api-ms-win-core-debug-l1-1-1

Exports

Exports

Sections

.text Size: 157KB - Virtual size: 156KB

.orpc Size: 512B - Virtual size: 340B

.data Size: 1024B - Virtual size: 2KB

.idata Size: 7KB - Virtual size: 7KB

minATL Size: 512B - Virtual size: 20B

.rsrc Size: 12KB - Virtual size: 11KB

.reloc Size: 14KB - Virtual size: 14KB

.text
Size: 157KB - Virtual size: 156KB

.orpc
Size: 512B - Virtual size: 340B

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 7KB - Virtual size: 7KB

minATL
Size: 512B - Virtual size: 20B

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 14KB - Virtual size: 14KB