AppXDeploymentClient[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

AppXDeploymentClient.dll
Size

307KB
MD5

e07c1be1f69c5d113e836cc492f4ae40
SHA1

a3fa984ef0b879017d6d3d8d2c63f74fa1038d78
SHA256

7d2cf7380a9e45256e9bafbd0d16ceeb1163d509a674b200ed42d15795134142
SHA512

1a87e771bf4fc4dd7dcdea16330bee2707c5e295d22c35f1a313ea5ffe1400d549260bb84d3208e71e361d7754a70b16a3526c3b3d618837ef0c4d6020681af3
SSDEEP

6144:muH1u1GmBFuNF/F+ZecSDH0F+72PxADg3Nw:nuKNF/F+4ceH0ozDg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AppXDeploymentClient.dll

Files

AppXDeploymentClient.dll
.dll windows:10 windows x86 arch:x86

e86df6424f82d9b993191c526edd7f97

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AppXDeploymentClient.pdb

Imports

api-ms-win-core-crt-l1-1-0

memmove
wcscpy_s
_except_handler4_common
memcmp
memcpy
memset
wcsrchr
memmove_s
_vsnwprintf_s
memcpy_s

api-ms-win-core-crt-l2-1-0

_purecall
_initterm_e
_initterm
__dllonexit3
_onexit

ntdll

RtlAllocateHeap
RtlInitializeCriticalSection
RtlFreeHeap
RtlConvertSidToUnicodeString
RtlFreeUnicodeString
RtlInitializeSRWLock
RtlLeaveCriticalSection
RtlEnterCriticalSection
NtUnmapViewOfSection
RtlGetLastWin32Error
RtlReportException
RtlNtStatusToDosErrorNoTeb
NtClose
NtCreateSection
EtwEventUnregister
EtwEventWrite
EtwEventRegister
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlAllocateWnfSerializationGroup
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlUnsubscribeWnfStateChangeNotification
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlNtStatusToDosError
NtQueryInformationThread
RtlReAllocateHeap
RtlDeleteCriticalSection
NtQuerySystemInformation
NtQueryInformationFile
RtlDosPathNameToRelativeNtPathName_U_WithStatus
RtlReleaseRelativeName
NtOpenFile
NtMapViewOfSection
NtSetInformationFile

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleFileNameW
LoadLibraryExW
GetModuleFileNameA
LoadStringW
GetProcAddress
LoadLibraryExA
GetModuleHandleExW

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateEventW
CreateSemaphoreExW
InitializeCriticalSectionEx
SleepEx
InitializeSRWLock
CreateEventExW
AcquireSRWLockShared
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
ReleaseSRWLockShared
AcquireSRWLockExclusive
SetEvent
ReleaseSRWLockExclusive
InitOnceExecuteOnce

api-ms-win-core-heap-l1-2-0

HeapFree
GetProcessHeap
HeapAlloc
HeapReAlloc

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
SetThreadToken
TlsSetValue
TlsGetValue
TlsAlloc
OpenThreadToken
OpenProcessToken
OpenProcess

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

rpcrt4

NdrDllCanUnloadNow
NdrDllGetClassObject
NdrClientCall4
NdrCStdStubBuffer2_Release
NdrCStdStubBuffer_Release
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
RpcAsyncInitializeHandle
NdrAsyncClientCall2
I_RpcExceptionFilter
RpcServerInqCallAttributesW
RpcAsyncCancelCall
RpcAsyncCompleteCall
RpcBindingBind
RpcBindingCreateW
RpcBindingFree
RpcBindingUnbind
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
NdrStubCall2
NdrStubForwardingFunction
CStdStubBuffer_Invoke

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient13
ObjectStublessClient7
CStdStubBuffer2_Disconnect
ObjectStublessClient23
ObjectStublessClient15
ObjectStublessClient20
ObjectStublessClient18
ObjectStublessClient3
ObjectStublessClient22
CStdStubBuffer2_QueryInterface
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
ObjectStublessClient6
ObjectStublessClient8
ObjectStublessClient9
ObjectStublessClient17
ObjectStublessClient10
ObjectStublessClient16
ObjectStublessClient12
ObjectStublessClient14
ObjectStublessClient21
NdrProxyForwardingFunction3
CStdStubBuffer2_Connect
CStdStubBuffer2_CountRefs
ObjectStublessClient24
ObjectStublessClient25
ObjectStublessClient19
ObjectStublessClient11

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWrite
EventSetInformation
EventUnregister
EventActivityIdControl
EventWriteTransfer

api-ms-win-core-file-l1-2-1

CreateFileW
GetVolumePathNamesForVolumeNameW
GetFileAttributesW
GetVolumeNameForVolumeMountPointW
FindNextFileW
FindFirstFileW
FindClose
GetVolumePathNameW
GetFullPathNameW
GetFileSizeEx
GetDiskFreeSpaceW
GetVolumeInformationW
DeleteFileW
RemoveDirectoryW
GetDriveTypeW
SetFileAttributesW
GetDiskFreeSpaceExW

api-ms-win-core-winrt-error-l1-1-1

SetRestrictedErrorInfo
RoOriginateError
GetRestrictedErrorInfo
RoSetErrorReportingFlags
RoOriginateErrorW
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
RoTransformError
IsErrorPropagationEnabled

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-com-l1-1-1

CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoDecrementMTAUsage
CoIncrementMTAUsage
CoTaskMemAlloc
CoGetCallContext
CoReleaseMarshalData
StringFromGUID2
CreateStreamOnHGlobal
CoMarshalInterface
CoRevertToSelf
CoGetApartmentType
RoGetAgileReference
CoCreateInstance
CoImpersonateClient

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork
SubmitThreadpoolWork
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork

api-ms-win-security-base-l1-2-0

CopySid
InitializeSecurityDescriptor
AddAccessAllowedAceEx
SetSecurityDescriptorDacl
ImpersonateLoggedOnUser
RevertToSelf
GetTokenInformation
GetLengthSid
InitializeAcl

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoUninitialize
RoInitialize

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
GetTraceEnableLevel
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegDeleteTreeW
RegCreateKeyExW
RegEnumKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW

api-ms-win-core-string-l1-1-0

CompareStringEx
CompareStringOrdinal

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetSystemInfo
GetVersionExW
GetTickCount
GetWindowsDirectoryW

api-ms-win-core-io-l1-1-1

DeviceIoControl

api-ms-win-service-management-l2-1-0

NotifyServiceStatusChangeW
QueryServiceStatusEx

api-ms-win-service-management-l1-1-0

OpenServiceW
OpenSCManagerW
StartServiceW
CloseServiceHandle

api-ms-win-core-memory-l1-1-2

VirtualProtect
VirtualQuery

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

AppxAddPackageToAllUserStoreForPbr
AppxCreateSharedLocalFolder
AppxDeletePackageFiles
AppxDestagePackage
AppxGetPackageInstalledLocation
AppxGetPackageType
AppxGetStagedPackageFullNameFromFamilyName
AppxIsStagedPackageStoreSigned
AppxPackageRepositoryRecoverStagedPackages
AppxPackageRepositoryRecoverUserInstalls
AppxPreRegisterAllInboxPackages
AppxPreRegisterPackage
AppxPreStageCleanupRunTask
AppxRecoverUserInstallsForUpgrade
AppxRequestRemovePackageForUser
AppxStagePackage
AppxValidatePackages
AppxValidatePackagesWithOptions
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetApplicability
GetApplicability2
GetNotificationPayload
GetPackageApplicabilityForUserLogon
IsPackageInstalled
NotifyPackageStatusChanged
RDSRecoverRequests
ReArmAppxPreStageCleanupTask
RegisterNotification
UnregisterNotification
VerifyPackage

Sections

.text
Size: 262KB - Virtual size: 262KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e86df6424f82d9b993191c526edd7f97

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-crt-l1-1-0

api-ms-win-core-crt-l2-1-0

ntdll

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

rpcrt4

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-io-l1-1-1

api-ms-win-service-management-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 262KB - Virtual size: 262KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 10KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 204B

.rsrc Size: 13KB - Virtual size: 13KB

.reloc Size: 19KB - Virtual size: 18KB

.text
Size: 262KB - Virtual size: 262KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 10KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 204B

.rsrc
Size: 13KB - Virtual size: 13KB

.reloc
Size: 19KB - Virtual size: 18KB