dot3api[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

dot3api.dll
Size

85KB
MD5

d5157fc84eae08d8d91553f314453c68
SHA1

e5687fad32e462be1c859a5a409cc424aef1dca2
SHA256

49291310e1f3ed5218aad499cbe6f8623cad9d3a72890d63bb56d264fc6bde6d
SHA512

7d8a084d841f7981e06ca9bc715cb84588742218f89c3b210722a4a56e63840f6d67f235415ed9962317f280cb45ff1fa385ea5309ea4e20caf52792ebbe9b9e
SSDEEP

1536:mqG03Yr7uOCOYzNW1hx9tp3qNuQSNY2jI9lQxNzPauc:mqj3tdzNaHTp3Gug2jmOnrau

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dot3api.dll

Files

dot3api.dll
.dll windows:10 windows x86 arch:x86

e284a6d8d23db1d01fd82d360c3d2730

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dot3api.pdb

Imports

msvcrt

_amsg_exit
_XcptFilter
_initterm
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@XZ
?terminate@@YAXXZ
memcpy_s
_except_handler4_common
??0exception@@QAE@ABV0@@Z
free
_endthreadex
??1exception@@UAE@XZ
_beginthreadex
__CxxFrameHandler3
_callnewh
memcmp
memcpy
_CxxThrowException
??1type_info@@UAE@XZ
memmove_s
malloc
memset

ntdll

RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
RtlUnsubscribeWnfNotificationWaitForCompletion

rpcrt4

NdrClientCall2
NdrAsyncClientCall
RpcAsyncCompleteCall
RpcExceptionFilter
RpcAsyncInitializeHandle
RpcSsDestroyClientContext
RpcBindingFree
RpcStringBindingComposeW
RpcAsyncCancelCall
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcMgmtInqServerPrincNameW
RpcBindingSetOption
RpcEpResolveBinding
RpcBindingFromStringBindingW

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
SetEvent
WaitForSingleObjectEx
EnterCriticalSection
CreateEventW
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
ProcessIdToSessionId
TerminateProcess
GetCurrentProcess
CreateThread
GetCurrentProcessId

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
RaiseException

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
HeapDestroy
GetProcessHeap

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW
GetTickCount

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoCreateInstance
CoUninitialize

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-rtcore-ntuser-window-l1-1-0

GetDesktopWindow

api-ms-win-security-base-l1-1-0

CreateWellKnownSid

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

Dot3CancelPlap
Dot3CloseHandle
Dot3DeinitPlapParams
Dot3DeleteProfile
Dot3DoPlap
Dot3EnumInterfaces
Dot3FreeMemory
Dot3GetCurrentProfile
Dot3GetInterfaceState
Dot3GetProfile
Dot3GetProfileEapUserDataInfo
Dot3InitPlapParams
Dot3OpenHandle
Dot3QueryAutoConfigParameter
Dot3QueryPlapCredentials
Dot3QueryUIRequest
Dot3ReConnect
Dot3ReasonCodeToString
Dot3RegisterNotification
Dot3SetAutoConfigParameter
Dot3SetInterface
Dot3SetProfile
Dot3SetProfileEapUserData
Dot3SetProfileEapXmlUserData
Dot3UIResponse
QueryNetconStatus

Sections

.text
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e284a6d8d23db1d01fd82d360c3d2730

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

rpcrt4

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 73KB - Virtual size: 72KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 96B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 73KB - Virtual size: 72KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 96B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB