dhcpcore[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

dhcpcore.dll
Size

250KB
MD5

fa195673e204a26b8cb94542d41ed424
SHA1

899de39f348213208e0551805d72e838df6c4ec5
SHA256

6cec0409e628e6184b87352a1174eef1e3b91440d5bd939fc2c4d4001b600bb0
SHA512

b69c52937ad6975e0eb2864027bc926ad6ca11e0dada6034740ee72765f9d07695aabed60f69ced8deb48a32c7e7245f540272aa314547828fa2861777ebc1f9
SSDEEP

6144:cMQDjTRR6kqLoyQpeNToy4DLFWm5WZjrALI:cMQDjT6kggpeRP4om5wQ8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dhcpcore.dll

Files

dhcpcore.dll
.dll windows:6 windows x86 arch:x86

60322096429a1eb83d409f527c2f18b8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dhcpcore.pdb

Imports

msvcrt

time
_except_handler4_common
_amsg_exit
_initterm
free
srand
memmove
_vsnprintf
_wtol
wcschr
wcsrchr
_wcsicmp
_local_unwind4
_XcptFilter
rand
memset
wcstombs
memcpy
_vsnwprintf
malloc

ntdll

NlsMbOemCodePageTag
RtlGUIDFromString
RtlInitString
RtlxOemStringToUnicodeSize
RtlDeleteSecurityObject
RtlCopySid
RtlLengthSid
RtlSetSaclSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAce
RtlCreateAcl
NtClose
RtlNewSecurityObject
NtOpenProcessToken
RtlxUnicodeStringToOemSize
NtCreateFile
NtDeviceIoControlFile
WinSqmAddToStream
RtlUnicodeStringToOemString
RtlOemStringToUnicodeString
RtlInitUnicodeString
EtwEventWriteTransfer
DbgPrint
EtwEventUnregister
EtwEventRegister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
RtlStringFromGUID
RtlNtStatusToDosError
RtlFreeUnicodeString
EtwEventWrite
EtwEventActivityIdControl
EtwTraceMessage
RtlSetLastWin32Error
NtTraceControl

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapReAlloc
HeapFree
HeapAlloc

api-ms-win-core-interlocked-l1-1-0

InterlockedIncrement
InterlockedExchange
InterlockedCompareExchange
InterlockedDecrement

api-ms-win-core-libraryloader-l1-1-0

LoadLibraryExW
GetProcAddress
LoadLibraryExA
FreeLibrary
DisableThreadLibraryCalls

api-ms-win-core-localregistry-l1-1-0

RegQueryInfoKeyW
RegEnumValueW
RegDeleteKeyExW
RegQueryValueExW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-misc-l1-1-0

Sleep
LocalAlloc
LocalFree

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
CreateThread
GetCurrentProcessId
GetCurrentThreadId
GetCurrentThread
OpenThreadToken
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
AcquireSRWLockShared
InitializeCriticalSection
CreateEventW
ReleaseSemaphore
CreateWaitableTimerExW
InitializeCriticalSectionAndSpinCount
SetWaitableTimer
CancelWaitableTimer
ResetEvent
WaitForSingleObjectEx
OpenEventA
ReleaseSRWLockShared
SetEvent
InitializeSRWLock
CreateSemaphoreExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForMultipleObjectsEx
WaitForSingleObject

api-ms-win-core-sysinfo-l1-1-0

SystemTimeToFileTime
GetSystemTime
GetTickCount64
GetLocalTime
GetTickCount
GetSystemTimeAsFileTime
GetComputerNameExW

api-ms-win-security-base-l1-1-0

AccessCheck
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid

dnsapi

DnsNotifyResolver
DnsDhcpRegisterAddrs
DnsQueryConfigDword
DnsDhcpRemoveRegistrations
DnsDhcpRegisterTerm
DnsDhcpRegisterInit

rpcrt4

RpcEpUnregister
RpcServerUnregisterIfEx
RpcStringBindingParseW
RpcBindingToStringBindingW
RpcEpRegisterW
RpcServerInqBindings
RpcServerRegisterIfEx
RpcServerUseProtseqEpW
RpcBindingVectorFree
RpcRevertToSelf
RpcImpersonateClient
RpcStringFreeW
UuidToStringW
UuidCreate
NdrServerCall2
I_RpcExceptionFilter
RpcServerRegisterAuthInfoW

ws2_32

inet_addr
socket
htonl
ntohl
WSASetEvent
WSAGetLastError
WSACreateEvent
WSAResetEvent
WSACloseEvent
closesocket
inet_ntoa
WSACleanup
WSAStartup
sendto
WSAWaitForMultipleEvents
select
WSAEnumNetworkEvents
WSAEventSelect
ntohs
htons
recvfrom
bind
WSAIoctl
setsockopt

nsi

NsiGetParameter
NsiSetAllParametersEx
NsiGetAllParametersEx
NsiSetParameterEx
NsiSetAllParameters
NsiFreeTable
NsiAllocateAndGetTable

winnsi

NsiConnectToServer
NsiRpcRegisterChangeNotificationEx
NsiDisconnectFromServer
NsiRpcDeregisterChangeNotificationEx

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-file-l1-1-0

CreateFileW
SetFileInformationByHandle

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

Exports

Exports

DhcpGlobalIsShuttingDown
DhcpGlobalServiceSyncEvent
DhcpGlobalTerminateEvent
ServiceMain

Sections

.text
Size: 209KB - Virtual size: 209KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

60322096429a1eb83d409f527c2f18b8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-security-base-l1-1-0

dnsapi

rpcrt4

ws2_32

nsi

winnsi

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

Exports

Exports

Sections

.text Size: 209KB - Virtual size: 209KB

.data Size: 7KB - Virtual size: 7KB

.rsrc Size: 20KB - Virtual size: 19KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: 209KB - Virtual size: 209KB

.data
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 20KB - Virtual size: 19KB

.reloc
Size: 12KB - Virtual size: 12KB