dfscli[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

dfscli.dll
Size

43KB
MD5

a9e34fc58adb6b748543543dfa1893b1
SHA1

2a7e757670eaeeaf1e1d80098b36dda78c64dc53
SHA256

d4dd5a598d873c7ac9524fee0f4c411d4950bdb19603109bcea7d3aeb09d3e4f
SHA512

33d067be879a0e4d53f6034db64e46c8cef3e1344f82f5d7056f78604cbe9b3eb9c2513fee4a69fd1508c1d4c6cd36f066c9862b3f501c3e93e750582ebf3408
SSDEEP

768:0ZgSPgrbPLiukAR1UvSYDYNPvkyRPvQvjXtvZvYe87pBphdD1vPP6fG/dPA6LM:0udP+SR1kmN3kWQzlRYe87D3YG/pC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dfscli.dll

Files

dfscli.dll
.dll windows:10 windows x86 arch:x86

ca3decda1b1bdd46f27f86dd2e595e0c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dfscli.pdb

Imports

api-ms-win-crt-string-l1-1-0

wcsncmp
memset

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o___std_type_info_destroy_list
_o___stdio_common_vswprintf
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
memcpy
_o__seh_filter_dll
_o__ultow_s
_o__wcsicmp
_o_free
_o_malloc
_o_wcstoul
_except_handler4_common
wcschr

api-ms-win-security-base-l1-1-0

IsValidSecurityDescriptor
GetSecurityDescriptorLength
MakeSelfRelativeSD
GetSecurityDescriptorControl
GetTokenInformation

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
GetCurrentThread
OpenProcessToken
TerminateProcess
GetCurrentProcess
OpenThreadToken

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegSetKeySecurity
RegGetKeySecurity

rpcrt4

RpcBindingFree
RpcStringFreeW
I_RpcExceptionFilter
RpcStringBindingComposeW
RpcBindingFromStringBindingW
UuidCreate
NdrClientCall2

api-ms-win-core-file-l1-1-0

GetFileAttributesW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

ntdll

NtCreateFile
RtlDnsHostNameToComputerName
RtlNtStatusToDosError
NtFsControlFile
RtlInitUnicodeString
RtlLengthSecurityDescriptor
RtlInitializeCriticalSection
NtClose

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

I_NetDfsIsThisADomainName
NetDfsAdd
NetDfsAddFtRoot
NetDfsAddRootTarget
NetDfsAddStdRoot
NetDfsAddStdRootForced
NetDfsEnum
NetDfsGetClientInfo
NetDfsGetDcAddress
NetDfsGetFtContainerSecurity
NetDfsGetInfo
NetDfsGetSecurity
NetDfsGetStdContainerSecurity
NetDfsGetSupportedNamespaceVersion
NetDfsManagerGetConfigInfo
NetDfsManagerInitialize
NetDfsManagerSendSiteInfo
NetDfsMove
NetDfsRemove
NetDfsRemoveFtRoot
NetDfsRemoveFtRootForced
NetDfsRemoveRootTarget
NetDfsRemoveStdRoot
NetDfsRename
NetDfsSetClientInfo
NetDfsSetFtContainerSecurity
NetDfsSetInfo
NetDfsSetSecurity
NetDfsSetStdContainerSecurity

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ca3decda1b1bdd46f27f86dd2e595e0c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-registry-l1-1-0

rpcrt4

api-ms-win-core-file-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 34KB - Virtual size: 34KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 148B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 34KB - Virtual size: 34KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 148B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB