dhcpcore6.pdb
Static task
static1
Behavioral task
behavioral1
Sample
dhcpcore6.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dhcpcore6.dll
Resource
win10v2004-20240508-en
General
-
Target
dhcpcore6.dll
-
Size
190KB
-
MD5
db45251ad7ac8de30ca837fbd70ea01b
-
SHA1
90c441e2d4e02c4ef5ebeb215f297101870fce77
-
SHA256
07f0be51b1390f640513272d46d64737b86465037a42418480f1674ff51549b7
-
SHA512
d44c1406ae6530752abbf4337378506a6f86294988f0a5933697d515e5150d046054b0611e32e277747e15f896ced60fb97082862fdf90c7d81b1803a16cd07b
-
SSDEEP
3072:V1gXWqLX4VevLiq4ApVIn33N3+9nGPV7koPjelSiS3sS9Q/sRyrzZvIuUF0kSTXU:zgGkX4Vev+aKPdhzcixy/Zv9UG2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dhcpcore6.dll
Files
-
dhcpcore6.dll.dll windows:6 windows x86 arch:x86
dd97bcdb356aabec4fc050e26a7facfc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_except_handler4_common
_amsg_exit
_initterm
_XcptFilter
wcsrchr
wcschr
malloc
free
_ftol2_sse
rand
_ftol2
_local_unwind4
_vsnprintf
srand
_wcsicmp
memcpy
memset
time
_vsnwprintf
ntdll
RtlStringFromGUID
RtlFreeUnicodeString
EtwEventWriteTransfer
DbgPrint
RtlGUIDFromString
RtlNtStatusToDosError
RtlDeleteSecurityObject
RtlCopySid
RtlLengthSid
RtlSetSaclSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAce
RtlCreateAcl
NtClose
RtlNewSecurityObject
NtOpenProcessToken
RtlxOemStringToUnicodeSize
RtlInitString
RtlOemStringToUnicodeString
RtlUnicodeStringToOemString
RtlInitUnicodeString
NlsMbOemCodePageTag
RtlxUnicodeStringToOemSize
RtlIpv6AddressToStringW
EtwEventActivityIdControl
EtwEventWrite
EtwEventUnregister
EtwEventRegister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwTraceMessage
RtlSetLastWin32Error
NtTraceControl
dnsapi
DnsQueryConfigDword
DnsNotifyResolver
DnsDhcpRegisterAddrs
rpcrt4
RpcRevertToSelf
RpcServerUnregisterIfEx
RpcEpUnregister
RpcServerInqBindings
RpcStringFreeW
RpcStringBindingParseW
RpcServerRegisterAuthInfoW
RpcImpersonateClient
RpcBindingToStringBindingW
RpcEpRegisterW
RpcServerRegisterIfEx
RpcServerUseProtseqEpW
NdrServerCall2
RpcBindingVectorFree
I_RpcExceptionFilter
ws2_32
WSACloseEvent
WSACleanup
WSAStartup
htonl
htons
ntohs
ntohl
setsockopt
WSAGetLastError
WSAWaitForMultipleEvents
socket
sendto
select
WSAResetEvent
WSASetEvent
freeaddrinfo
bind
getaddrinfo
WSAEnumNetworkEvents
WSACreateEvent
WSAEventSelect
closesocket
recvfrom
cryptbase
SystemFunction036
nsi
NsiSetAllParametersEx
NsiGetAllParametersEx
NsiAllocateAndGetTable
NsiFreeTable
winnsi
NsiDisconnectFromServer
NsiRpcRegisterChangeNotificationEx
NsiConnectToServer
NsiRpcDeregisterChangeNotificationEx
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-file-l1-1-0
SetFileInformationByHandle
CreateFileW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-interlocked-l1-1-0
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
InterlockedIncrement
api-ms-win-core-libraryloader-l1-1-0
FreeLibrary
GetProcAddress
LoadLibraryExW
DisableThreadLibraryCalls
LoadLibraryExA
api-ms-win-core-localregistry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegQueryValueExW
api-ms-win-core-misc-l1-1-0
LocalFree
LocalAlloc
Sleep
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThread
CreateThread
OpenThreadToken
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-synch-l1-1-0
InitializeSRWLock
CreateSemaphoreExW
InitializeCriticalSection
CancelWaitableTimer
SetEvent
CreateEventW
CreateWaitableTimerExW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
ReleaseSemaphore
WaitForMultipleObjectsEx
ReleaseSRWLockShared
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ResetEvent
SetWaitableTimer
api-ms-win-core-sysinfo-l1-1-0
SystemTimeToFileTime
GetSystemTime
GetTickCount64
GetLocalTime
GetTickCount
GetComputerNameExW
GetSystemTimeAsFileTime
api-ms-win-security-base-l1-1-0
AllocateAndInitializeSid
FreeSid
AccessCheck
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Exports
Exports
Dhcpv6Main
Sections
.text Size: 153KB - Virtual size: 153KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ