dot3api[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

dot3api.dll
Size

85KB
MD5

8ab7ea78d3c76c986a385f0f14e4db6d
SHA1

11f6c1eb87583a069af0847f9a1cdda8e5a4c38d
SHA256

6782b370ffcc349af7b069bf8f7432ba41ce368130cf370b3b9a1fc31d82cb57
SHA512

788b00c8d7671782c53e813803b287230d3a6c1bd7b4dd290f6946f13d369fa380d9f435cffc429aea7b52316ef27ffc7013a3a9b0117b49ada0cdb6ccad77d7
SSDEEP

1536:/qGf3Yr7uOCOYzNW1hx9tp3qNuQSNY2jI9rQGNvHsOuc:/qc3tdzNaHTp3Gug2jmE4vMOu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dot3api.dll

Files

dot3api.dll
.dll windows:10 windows x86 arch:x86

e284a6d8d23db1d01fd82d360c3d2730

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dot3api.pdb

Imports

msvcrt

_amsg_exit
_XcptFilter
_initterm
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@XZ
?terminate@@YAXXZ
memcpy_s
_except_handler4_common
??0exception@@QAE@ABV0@@Z
free
_endthreadex
??1exception@@UAE@XZ
_beginthreadex
__CxxFrameHandler3
_callnewh
memcmp
memcpy
_CxxThrowException
??1type_info@@UAE@XZ
memmove_s
malloc
memset

ntdll

RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
RtlUnsubscribeWnfNotificationWaitForCompletion

rpcrt4

NdrClientCall2
NdrAsyncClientCall
RpcAsyncCompleteCall
RpcExceptionFilter
RpcAsyncInitializeHandle
RpcSsDestroyClientContext
RpcBindingFree
RpcStringBindingComposeW
RpcAsyncCancelCall
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcMgmtInqServerPrincNameW
RpcBindingSetOption
RpcEpResolveBinding
RpcBindingFromStringBindingW

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
SetEvent
WaitForSingleObjectEx
EnterCriticalSection
CreateEventW
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
ProcessIdToSessionId
TerminateProcess
GetCurrentProcess
CreateThread
GetCurrentProcessId

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
RaiseException

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
HeapDestroy
GetProcessHeap

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW
GetTickCount

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoCreateInstance
CoUninitialize

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-rtcore-ntuser-window-l1-1-0

GetDesktopWindow

api-ms-win-security-base-l1-1-0

CreateWellKnownSid

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

Dot3CancelPlap
Dot3CloseHandle
Dot3DeinitPlapParams
Dot3DeleteProfile
Dot3DoPlap
Dot3EnumInterfaces
Dot3FreeMemory
Dot3GetCurrentProfile
Dot3GetInterfaceState
Dot3GetProfile
Dot3GetProfileEapUserDataInfo
Dot3InitPlapParams
Dot3OpenHandle
Dot3QueryAutoConfigParameter
Dot3QueryPlapCredentials
Dot3QueryUIRequest
Dot3ReConnect
Dot3ReasonCodeToString
Dot3RegisterNotification
Dot3SetAutoConfigParameter
Dot3SetInterface
Dot3SetProfile
Dot3SetProfileEapUserData
Dot3SetProfileEapXmlUserData
Dot3UIResponse
QueryNetconStatus

Sections

.text
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e284a6d8d23db1d01fd82d360c3d2730

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

rpcrt4

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 73KB - Virtual size: 72KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 96B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 73KB - Virtual size: 72KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 96B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB