dot3ui[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dot3ui.dll
Size

282KB
MD5

e9a5047eeeadb1967aa481ef08913cf1
SHA1

de2c831e8d8429d175c1295fc287697a6df40573
SHA256

dd89db11d7081d08a6acd6d6a3a1b281b8452c4bc57ade7f78a286a71c74ef3d
SHA512

8de950933c5a5890dc8e4f833ebbb3768cf83d10c093ebdb913326b830b7e9efd8dc3af73c39f5a92d85cad2862f607ed7ec78ef6e214a9c38a183b3f1bcedb4
SSDEEP

6144:iPWsHckBoXaIV3FPxozTTc8oIACENB/QN6MSx:w8kKPxoLcDB/QtG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dot3ui.dll

Files

dot3ui.dll
.dll windows:10 windows x86 arch:x86

9e6625d58b8fede59d3cecdf0f9a7a7b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dot3ui.pdb

Imports

msvcrt

memcpy
_endthreadex
_beginthreadex
??0exception@@QAE@ABQBD@Z
_itow
?terminate@@YAXXZ
memcmp
_ftol2_sse
_CIlog
??1type_info@@UAE@XZ
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
realloc
_errno
memcpy_s
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
memmove_s
_purecall
wcsncpy_s
malloc
free
_except_handler4_common
memset

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegDeleteValueW

gdi32

GetStockObject
GetDeviceCaps
SetTextColor
SetBkMode
Rectangle
DeleteObject
CreateSolidBrush
SelectObject
GetTextExtentPoint32W

user32

IsWindowEnabled
GetSysColor
SetClassLongW
ShowWindow
LoadStringW
DrawIcon
IsWindowVisible
PostMessageW
MessageBoxW
CheckDlgButton
GetDlgItem
CheckRadioButton
UnregisterClassA
GetMessageW
GetKeyState
GetLastInputInfo
SetWindowTextW
SetTimer
SetFocus
DrawTextW
TranslateMessage
KillTimer
SystemParametersInfoW
InvalidateRect
BeginPaint
EndPaint
EnableWindow
GetWindowLongW
SetWindowLongW
GetWindowRect
GetDC
SendMessageW
GetSystemMetrics
GetDlgCtrlID
GetDlgItemInt
SetDlgItemInt
GetParent
ReleaseDC
CharNextW
MsgWaitForMultipleObjects
DispatchMessageW
PeekMessageW
EnumChildWindows
GetWindowInfo
MoveWindow
LoadIconW
IsDlgButtonChecked

dot3api

Dot3SetProfile
Dot3GetProfileEapUserDataInfo
Dot3SetProfileEapUserData
Dot3CloseHandle
Dot3OpenHandle
Dot3FreeMemory
Dot3QueryAutoConfigParameter
Dot3GetCurrentProfile
Dot3ReasonCodeToString

kernel32

GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetSystemTimeAsFileTime
DelayLoadFailureHook
lstrcmpW
SetLastError
GetProcessHeap
HeapAlloc
HeapFree
FindResourceW
LockResource
LoadLibraryExW
GetTickCount
OutputDebugStringA
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
GetSystemWindowsDirectoryW
CloseHandle
ResolveDelayLoadedAPI
lstrcmpiW
FreeLibrary
GetModuleHandleW
DeleteCriticalSection
GetProcAddress
LoadResource
FindResourceExW
RaiseException
GetLastError
MultiByteToWideChar
InitializeCriticalSection
LeaveCriticalSection
GetModuleFileNameW
EnterCriticalSection
SizeofResource

ntdll

RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
EtwTraceMessage
RtlQueryWnfStateData

Exports

Exports

Dot3CreatePsPage

Sections

.text
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9e6625d58b8fede59d3cecdf0f9a7a7b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-registry-l1-1-0

gdi32

user32

dot3api

kernel32

ntdll

Exports

Exports

Sections

.text Size: 113KB - Virtual size: 113KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 4KB

.didat Size: 1024B - Virtual size: 692B

.rsrc Size: 156KB - Virtual size: 156KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 113KB - Virtual size: 113KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 4KB

.didat
Size: 1024B - Virtual size: 692B

.rsrc
Size: 156KB - Virtual size: 156KB

.reloc
Size: 5KB - Virtual size: 5KB