dfsutil[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dfsutil.exe
Size

230KB
MD5

69027a4a04434fef036ae48670fc03cc
SHA1

7c9d7a233bfee324a46207f255f90072f36eebee
SHA256

b93029926fd6f5a664bf9008b8937edd716ac14680338dd03331bcdaf71b419b
SHA512

e1156cc65c04a64e080577f31b06cffa244b3ea4089e28461cb195a6bd7c1f819ab73f65fa18cb0c0abc7b4509bd9fe04309f02ca8889c34587edd7e673e3b9b
SSDEEP

3072:RyGuLkoRicFYyccSTKfmaq8wCVUn/nx7FIu7V5Pj4rH3aoas/xA3gzA8PtH+BnH1:94kqjkCVSpFIA9MjPHxoZnV

Score

N/A

Malware Config

Signatures

Files

dfsutil.exe
.exe windows x86

d9b1e0ec896878830f4ba2c7436e389f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__setusermatherr
_initterm
__getmainargs
__initenv
_onexit
_c_exit
exit
_cexit
_XcptFilter
_exit
__set_app_type
_except_handler3
__p__fmode
printf
__p__commode
_adjust_fdiv
??2@YAPAXI@Z
??3@YAXPAX@Z
free
malloc
swscanf
_controlfp
__dllonexit
_purecall
wprintf

netapi32

NetDfsRemoveFtRootForced
NetDfsRemove
NetDfsAdd
DsAddressToSiteNamesW
DsGetDcNameW
NetDfsSetInfo
NetDfsRemoveStdRoot
NetDfsRemoveFtRoot
NetDfsAddStdRoot
NetDfsAddFtRoot
DsRoleFreeMemory
NetDfsGetInfo
NetShareGetInfo
I_NetDfsIsThisADomainName
DsGetSiteNameW
DsRoleGetPrimaryDomainInformation
NetApiBufferFree
NetDfsEnum

shell32

CommandLineToArgvW

rpcrt4

UuidToStringW
RpcStringFreeW
RpcRevertToSelf
RpcImpersonateClient
UuidCreate

ntdll

wcslen
RtlInitUnicodeString
RtlNtStatusToDosError
NtClose
NtFsControlFile
NtCreateFile
_wcsicmp
_wcsnicmp
RtlCompareUnicodeString
wcschr
_vsnwprintf
RtlUnicodeStringToAnsiString
RtlEqualDomainName
RtlInitUnicodeStringEx
wcscat
wcscpy
wcstoul
wcscmp
wcscspn
NtQueryDirectoryFile
NtQueryInformationFile
NtDeleteFile
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlFreeUnicodeString
RtlIdentifierAuthoritySid
RtlSubAuthorityCountSid
RtlValidAcl
NtQueryVolumeInformationFile
NtOpenFile
memmove
RtlFreeAnsiString
RtlCopyUnicodeString
RtlUpcaseUnicodeChar
RtlPrefixUnicodeString
RtlDosPathNameToNtPathName_U

clusapi

GetNodeClusterState
ClusterControl
OpenCluster
GetClusterResourceNetworkName
ClusterRegCloseKey
ClusterRegOpenKey
GetClusterResourceKey
CloseCluster

oleaut32

VariantInit
SysFreeString
VariantClear
SysAllocString
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx

wldap32

ord79
ord142
ord26
ord41
ord224
ord140
ord145
ord14
ord73
ord18
ord16
ord203
ord155
ord13
ord12

shlwapi

PathAddBackslashW
SHCopyKeyW
SHDeleteKeyW

ws2_32

gethostbyname
WSAGetLastError
inet_addr
WSAStartup

advapi32

OpenThreadToken
AccessCheck
GetAce
DeleteAce
MapGenericMask
RegGetKeySecurity
RegEnumKeyExW
RegConnectRegistryW
IsValidSecurityDescriptor
RegQueryInfoKeyW
RegQueryValueExW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
MakeSelfRelativeSD
MakeAbsoluteSD
RegOpenKeyExW
TraceMessage
RegEnumValueW
SetSecurityDescriptorDacl
DeregisterEventSource
RegisterEventSourceW
RegDeleteValueW
ReportEventW
RegDeleteKeyW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
ChangeServiceConfigW
ControlService
CloseServiceHandle

kernel32

InterlockedIncrement
InterlockedDecrement
WaitForSingleObject
SetEvent
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapCreate
InterlockedCompareExchange
GetCurrentThread
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
CreateEventW
SystemTimeToFileTime
GetSystemTime
InterlockedExchange
MoveFileW
SetUnhandledExceptionFilter
LocalFree
GetLastError
FormatMessageW
GetCommandLineW
GetStdHandle
CreateFileW
WriteFile
WideCharToMultiByte
ReadFile
GetFileSize
GetLocalTime
FlushFileBuffers
GetVolumePathNameW
SetLastError
GetVolumeNameForVolumeMountPointW
HeapFree
HeapAlloc
GetProcessHeap
CloseHandle
LocalAlloc

resutils

ResUtilEnumResources
ResUtilGetDwordValue
ResUtilGetSzValue

activeds

ord4
ord6
ord5
ord9
ord3
ord7

Sections

.text
Size: 163KB - Virtual size: 163KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 17B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d9b1e0ec896878830f4ba2c7436e389f

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

netapi32

shell32

rpcrt4

ntdll

clusapi

oleaut32

ole32

wldap32

shlwapi

ws2_32

advapi32

kernel32

resutils

activeds

Sections

.text Size: 163KB - Virtual size: 163KB

.data Size: 11KB - Virtual size: 72KB

.tls Size: 512B - Virtual size: 17B

.rsrc Size: 54KB - Virtual size: 53KB

.text
Size: 163KB - Virtual size: 163KB

.data
Size: 11KB - Virtual size: 72KB

.tls
Size: 512B - Virtual size: 17B

.rsrc
Size: 54KB - Virtual size: 53KB