dnsapi[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dnsapi.dll
Size

574KB
MD5

b1548f2f4711a2246fd2f63d69cd3019
SHA1

433ae5c749f24472867eb70beedf16d97014a195
SHA256

b979af8fb3a4a23ccada22036838d50977649283d09b589028e5662baa8ec37d
SHA512

a29b2607e6d0879211d9d9e693b51242c01663d99357aceea3ad7b94028f5d23a0d525dd80bf54d260fa39840549d71eb3f6ff2fbfe5268002ee8aa809638389
SSDEEP

12288:fl7ifoQx8HU9gYo7JKf2amK84jwpe5jlrgBzevGiKbwWFDa:flG5G09mNKffmK8Be5d37KbwWFu

Score

1^/10

Malware Config

Signatures

Files

dnsapi.dll
.dll windows:10 windows x86 arch:x86

b63042fcd2f55e6c69419576a45ac7eb

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

64:ab:20:45:59:a2:51:90:01:ce:d5:93:39:72:f6:84:e7:a3:e0:26:ec:04:9b:bc:87:7c:77:41:e2:36:36:7d
Signer

Actual PE Digest

64:ab:20:45:59:a2:51:90:01:ce:d5:93:39:72:f6:84:e7:a3:e0:26:ec:04:9b:bc:87:7c:77:41:e2:36:36:7d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dnsapi.pdb

Imports

api-ms-win-core-crt-l1-1-0

wcspbrk
_wcsnicmp
_wcsicmp
_strnicmp
_stricmp
wcstoul
wcschr
towlower
swprintf_s
memcpy_s
vswprintf_s
wcstok_s
wcsncpy_s
qsort_s
_wcslwr_s
memmove
memcpy
memcmp
wcsnlen
_vsnwprintf_s
_vscwprintf
wcsstr
_strupr_s
strncmp
strtoul
_wtoi
_wtol
_strlwr_s
strnlen
atoi
_vsnprintf_s
_except_handler4_common
memset

api-ms-win-core-crt-l2-1-0

__dllonexit3
time
_initterm_e
_purecall
_onexit
_initterm

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter

api-ms-win-core-file-l1-1-0

SetFilePointer
CreateFileA
ReadFile

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-heap-l1-1-0

HeapReAlloc
GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExA
GetModuleHandleW
GetModuleHandleExW
DisableThreadLibraryCalls
LoadLibraryExW
GetModuleFileNameW
FreeLibrary
GetProcAddress

api-ms-win-core-localization-l1-2-0

LCMapStringW

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyA
RegQueryValueExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyExW
RegQueryInfoKeyW
RegGetValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW

api-ms-win-core-heap-l2-1-0

LocalAlloc

api-ms-win-core-synch-l1-1-0

TryAcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
CreateSemaphoreExW
CreateEventW
LeaveCriticalSection
ReleaseSemaphore
WaitForMultipleObjectsEx
EnterCriticalSection
ReleaseSRWLockExclusive
DeleteCriticalSection
InitializeCriticalSection
InitializeSRWLock
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
AcquireSRWLockExclusive

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
CreateThread
GetCurrentProcess
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemDirectoryA
GetVersionExW
GetSystemDirectoryW
GetTickCount64
GetSystemTimeAsFileTime

api-ms-win-security-base-l1-1-0

GetSidSubAuthorityCount
GetSidSubAuthority
RevertToSelf
CopySid
ImpersonateSelf
GetLengthSid
IsValidSid
GetTokenInformation

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolIoCallbacks
CreateThreadpoolIo
DisassociateCurrentThreadFromCallback
StartThreadpoolIo
CancelThreadpoolIo
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpoolIo

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringW
MultiByteToWideChar

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

ntdll

EtwEventRegister
EtwEventUnregister
EtwUnregisterTraceGuids
EtwEventWriteTransfer
RtlPublishWnfStateData
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle
RtlInitializeCriticalSection
EtwLogTraceEvent
EtwEventEnabled
EtwEventWrite
RtlGetDeviceFamilyInfoEnum
RtlIpv6StringToAddressW
RtlIpv4StringToAddressW
RtlGetCurrentServiceSessionId
RtlInitUnicodeString
RtlNtStatusToDosError
NtCreateFile
NtCancelIoFile
EtwTraceMessageVa
RtlIpv6AddressToStringA
RtlGUIDFromString
RtlStringFromGUIDEx
RtlIpv4StringToAddressA
RtlIpv6StringToAddressExW
RtlIpv6AddressToStringW
RtlIpv6StringToAddressA
NtQueryLicenseValue
RtlIdnToNameprepUnicode
RtlIdnToAscii
RtlIdnToUnicode
RtlGetPersistedStateLocation
NtDeviceIoControlFile
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlQueryPackageIdentity
EtwGetTraceEnableLevel

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

AdaptiveTimeout_ClearInterfaceSpecificConfiguration
AdaptiveTimeout_ResetAdaptiveTimeout
AddRefQueryBlobEx
BreakRecordsIntoBlob
Coalesce_UpdateNetVersion
CombineRecordsInBlob
DeRefQueryBlobEx
DelaySortDAServerlist
DnsAcquireContextHandle_A
DnsAcquireContextHandle_W
DnsAllocateRecord
DnsApiAlloc
DnsApiAllocZero
DnsApiFree
DnsApiHeapReset
DnsApiRealloc
DnsApiSetDebugGlobals
DnsAsyncRegisterHostAddrs
DnsAsyncRegisterInit
DnsAsyncRegisterTerm
DnsCancelQuery
DnsCheckNrptRuleIntegrity
DnsCheckNrptRules
DnsCleanupTcpConnections
DnsConnectionDeletePolicyEntries
DnsConnectionDeletePolicyEntriesPrivate
DnsConnectionDeleteProxyInfo
DnsConnectionFreeNameList
DnsConnectionFreeProxyInfo
DnsConnectionFreeProxyInfoEx
DnsConnectionFreeProxyList
DnsConnectionGetHandleForHostUrlPrivate
DnsConnectionGetNameList
DnsConnectionGetProxyInfo
DnsConnectionGetProxyInfoForHostUrl
DnsConnectionGetProxyList
DnsConnectionSetPolicyEntries
DnsConnectionSetPolicyEntriesPrivate
DnsConnectionSetProxyInfo
DnsConnectionUpdateIfIndexTable
DnsCopyStringEx
DnsCreateReverseNameStringForIpAddress
DnsCreateStandardDnsNameCopy
DnsCreateStringCopy
DnsDeRegisterLocal
DnsDhcpRegisterAddrs
DnsDhcpRegisterHostAddrs
DnsDhcpRegisterInit
DnsDhcpRegisterTerm
DnsDhcpRemoveRegistrations
DnsDhcpSrvRegisterHostAddr
DnsDhcpSrvRegisterHostAddrEx
DnsDhcpSrvRegisterHostName
DnsDhcpSrvRegisterHostNameEx
DnsDhcpSrvRegisterInit
DnsDhcpSrvRegisterInitEx
DnsDhcpSrvRegisterInitialize
DnsDhcpSrvRegisterTerm
DnsDisableIdnEncoding
DnsDowncaseDnsNameLabel
DnsExtractRecordsFromMessage_UTF8
DnsExtractRecordsFromMessage_W
DnsFindAuthoritativeZone
DnsFlushResolverCache
DnsFlushResolverCacheEntry_A
DnsFlushResolverCacheEntry_UTF8
DnsFlushResolverCacheEntry_W
DnsFree
DnsFreeAdaptersInfo
DnsFreeConfigStructure
DnsFreeNrptRule
DnsFreeNrptRuleNamesList
DnsFreePolicyConfig
DnsFreeProxyName
DnsGetAdaptersInfo
DnsGetApplicationIdentifier
DnsGetBufferLengthForStringCopy
DnsGetCacheDataTable
DnsGetCacheDataTableEx
DnsGetDnsServerList
DnsGetDomainName
DnsGetInterfaceSettings
DnsGetLastFailedUpdateInfo
DnsGetNrptRuleNamesList
DnsGetPolicyTableInfo
DnsGetPolicyTableInfoPrivate
DnsGetPrimaryDomainName_A
DnsGetProxyInfoPrivate
DnsGetProxyInformation
DnsGetQueryRetryTimeouts
DnsGetSettings
DnsGlobals
DnsIpv6AddressToString
DnsIpv6StringToAddress
DnsIsAMailboxType
DnsIsNSECType
DnsIsStatusRcode
DnsIsStringCountValidForTextType
DnsLogEvent
DnsMapRcodeToStatus
DnsModifyRecordsInSet_A
DnsModifyRecordsInSet_UTF8
DnsModifyRecordsInSet_W
DnsNameCompareEx_A
DnsNameCompareEx_UTF8
DnsNameCompareEx_W
DnsNameCompare_A
DnsNameCompare_UTF8
DnsNameCompare_W
DnsNameCopy
DnsNameCopyAllocate
DnsNetworkInfo_CreateFromFAZ
DnsNetworkInformation_CreateFromFAZ
DnsNotifyResolver
DnsNotifyResolverClusterIp
DnsNotifyResolverEx
DnsQueryConfig
DnsQueryConfigAllocEx
DnsQueryConfigDword
DnsQueryEx
DnsQueryExA
DnsQueryExUTF8
DnsQueryExW
DnsQuery_A
DnsQuery_UTF8
DnsQuery_W
DnsRecordBuild_UTF8
DnsRecordBuild_W
DnsRecordCompare
DnsRecordCopyEx
DnsRecordListFree
DnsRecordListUnmapV4MappedAAAAInPlace
DnsRecordSetCompare
DnsRecordSetCopyEx
DnsRecordSetDetach
DnsRecordStringForType
DnsRecordStringForWritableType
DnsRecordTypeForName
DnsRegisterLocal
DnsReleaseContextHandle
DnsRemoveNrptRule
DnsRemoveRegistrations
DnsReplaceRecordSetA
DnsReplaceRecordSetUTF8
DnsReplaceRecordSetW
DnsResetQueryRetryTimeouts
DnsResolverOp
DnsResolverQueryHvsi
DnsScreenLocalAddrsForRegistration
DnsServiceBrowse
DnsServiceBrowseCancel
DnsServiceConstructInstance
DnsServiceCopyInstance
DnsServiceDeRegister
DnsServiceFreeInstance
DnsServiceRegister
DnsServiceRegisterCancel
DnsServiceResolve
DnsServiceResolveCancel
DnsSetConfigDword
DnsSetConfigValue
DnsSetInterfaceSettings
DnsSetNrptRule
DnsSetNrptRules
DnsSetQueryRetryTimeouts
DnsSetSettings
DnsStartMulticastQuery
DnsStatusString
DnsStopMulticastQuery
DnsStringCopyAllocateEx
DnsTraceServerConfig
DnsUnicodeToUtf8
DnsUpdate
DnsUpdateMachinePresence
DnsUpdateTest_A
DnsUpdateTest_UTF8
DnsUpdateTest_W
DnsUtf8ToUnicode
DnsValidateNameOrIp_TempW
DnsValidateName_A
DnsValidateName_UTF8
DnsValidateName_W
DnsValidateServerArray_A
DnsValidateServerArray_W
DnsValidateServerStatus
DnsValidateServer_A
DnsValidateServer_W
DnsValidateUtf8Byte
DnsWriteQuestionToBuffer_UTF8
DnsWriteQuestionToBuffer_W
DnsWriteReverseNameStringForIpAddress
Dns_AddRecordsToMessage
Dns_AllocateMsgBuf
Dns_BuildPacket
Dns_CacheServiceCleanup
Dns_CacheServiceInit
Dns_CacheServiceStopIssued
Dns_CleanupWinsock
Dns_CloseConnection
Dns_CloseSocket
Dns_CreateMulticastSocket
Dns_CreateSocket
Dns_CreateSocketEx
Dns_ExtractRecordsFromMessage
Dns_FindAuthoritativeZoneLib
Dns_FreeMsgBuf
Dns_GetRandomXid
Dns_InitializeMsgBuf
Dns_InitializeMsgRemoteSockaddr
Dns_InitializeWinsock
Dns_OpenTcpConnectionAndSend
Dns_ParseMessage
Dns_ParsePacketRecord
Dns_PingAdapterServers
Dns_ReadPacketName
Dns_ReadPacketNameAllocate
Dns_ReadRecordStructureFromPacket
Dns_RecvTcp
Dns_ResetNetworkInfo
Dns_SendAndRecvUdp
Dns_SendEx
Dns_SetRecordDatalength
Dns_SetRecordsSection
Dns_SetRecordsTtl
Dns_SkipPacketName
Dns_SkipToRecord
Dns_UpdateLib
Dns_UpdateLibEx
Dns_WriteDottedNameToPacket
Dns_WriteQuestionToMessage
Dns_WriteRecordStructureToPacketEx
ExtraInfo_Init
Faz_AreServerListsInSameNameSpace
FlushDnsPolicyUnreachableStatus
GetCurrentTimeInSeconds
HostsFile_Close
HostsFile_Open
HostsFile_ReadLine
IpHelp_IsAddrOnLink
Local_GetRecordsForLocalName
Local_GetRecordsForLocalNameEx
NetInfo_Build
NetInfo_Clean
NetInfo_Copy
NetInfo_CopyNetworkIndex
NetInfo_CreatePerNetworkNetinfo
NetInfo_Free
NetInfo_GetAdapterByAddress
NetInfo_GetAdapterByInterfaceIndex
NetInfo_GetAdapterByName
NetInfo_IsAddrConfig
NetInfo_IsForUpdate
NetInfo_IsTcpipConfigChange
NetInfo_ResetServerPriorities
NetInfo_UpdateDnsInterfaceConfigChange
NetInfo_UpdateNetworkProperties
NetInfo_UpdateServerReachability
QueryDirectEx
Query_Cancel
Query_Main
Reg_FreeUpdateInfo
Reg_GetValueEx
Reg_ReadGlobalsEx
Reg_ReadUpdateInfo
Security_ContextListTimeout
Send_AndRecvUdpWithParam
Send_MessagePrivate
Send_MessagePrivateEx
Send_OpenTcpConnectionAndSend
Socket_CacheCleanup
Socket_CacheInit
Socket_CleanupWinsock
Socket_ClearMessageSockets
Socket_CloseEx
Socket_CloseMessageSockets
Socket_Create
Socket_CreateMulticast
Socket_InitWinsock
Socket_JoinMulticast
Socket_RecvFrom
Socket_SetMulticastInterface
Socket_SetMulticastLoopBack
Socket_SetTtl
Socket_TcpListen
Trace_Reset
Update_ReplaceAddressRecordsW
Util_IsIp6Running
Util_IsRunningOnXboxOne
WriteDnsNrptRulesToRegistry

Sections

.text
Size: 458KB - Virtual size: 458KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.wpp_sf
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 364B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b63042fcd2f55e6c69419576a45ac7eb

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5fCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

64:ab:20:45:59:a2:51:90:01:ce:d5:93:39:72:f6:84:e7:a3:e0:26:ec:04:9b:bc:87:7c:77:41:e2:36:36:7dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-crt-l1-1-0

api-ms-win-core-crt-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-util-l1-1-0

ntdll

api-ms-win-core-memory-l1-1-0

api-ms-win-core-errorhandling-l1-1-2

api-ms-win-core-timezone-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 458KB - Virtual size: 458KB

.wpp_sf Size: 34KB - Virtual size: 34KB

.data Size: 512B - Virtual size: 4KB

.idata Size: 7KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 364B

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 24KB - Virtual size: 23KB

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

64:ab:20:45:59:a2:51:90:01:ce:d5:93:39:72:f6:84:e7:a3:e0:26:ec:04:9b:bc:87:7c:77:41:e2:36:36:7d
Signer

.text
Size: 458KB - Virtual size: 458KB

.wpp_sf
Size: 34KB - Virtual size: 34KB

.data
Size: 512B - Virtual size: 4KB

.idata
Size: 7KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 364B

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 24KB - Virtual size: 23KB