dhcpcore[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

dhcpcore.dll
Size

322KB
MD5

052f1abfc6917040c9d56909919115fa
SHA1

9699d80dbf9aa2c868fe7867a286d284928d584e
SHA256

c9f4b1c28e6d7337afc6234035704864fbecf3c1fef96aa00c2adf33495eb6fd
SHA512

422bed38d194a4d033dca6da029f26938c80ff8c69d96fd6a600e81e21be6fea6fb4a6d7734f7cf132cf075fd2c25cc9cfc0f78fe4f9c9ad2e0688b32e4d0e53
SSDEEP

6144:/JnX2nmeXAsO2LQra/Yx6o/qgFhC59v037Ufr0:MmeXuh6oSgFhIF03u0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dhcpcore.dll

Files

dhcpcore.dll
.dll windows:10 windows x86 arch:x86

4f371c065cc9676fdf95b1e9816920ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dhcpcore.pdb

Imports

api-ms-win-core-crt-l1-1-0

_except_handler4_common
_ftol2
_local_unwind4
memcmp
memcpy
memmove
memset
_wcsicmp
memcpy_s
wcsrchr
_wtol
wcschr
_vsnprintf_s
_vsnwprintf_s

api-ms-win-core-crt-l2-1-0

_initterm
time
_initterm_e

ntdll

RtlOemStringToUnicodeString
RtlUnicodeStringToOemString
RtlInitUnicodeString
EtwEventWrite
EtwEventRegister
RtlNtStatusToDosError
EtwEventWriteTransfer
EtwTraceMessage
EtwEventUnregister
EtwUnregisterTraceGuids
NtDeviceIoControlFile
RtlxUnicodeStringToOemSize
RtlInitString
RtlxOemStringToUnicodeSize
RtlGUIDFromString
RtlGetDeviceFamilyInfoEnum
RtlIsStateSeparationEnabled
RtlSetSaclSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAddAce
RtlLengthSid
RtlNewSecurityObject
RtlCopySid
RtlCreateAcl
RtlSetGroupSecurityDescriptor
RtlCreateSecurityDescriptor
RtlDeleteSecurityObject
RtlIdnToAscii
RtlIdnToUnicode
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
RtlFreeUnicodeString
RtlRandomEx
EtwEventActivityIdControl
NtCreateFile
RtlStringFromGUID
WinSqmAddToStream
DbgPrint

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap
HeapReAlloc

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
LoadLibraryExW
FreeLibrary
GetProcAddress

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegEnumValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegSetValueExA
RegDeleteValueA
RegDeleteKeyExW
RegDeleteValueW

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc
LocalFree

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
CreateThread
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-synch-l1-1-0

OpenEventA
ReleaseSRWLockShared
AcquireSRWLockShared
DeleteCriticalSection
InitializeCriticalSection
WaitForMultipleObjectsEx
CreateWaitableTimerExW
LeaveCriticalSection
EnterCriticalSection
ResetEvent
InitializeSRWLock
CreateEventW
CancelWaitableTimer
CreateSemaphoreExW
ReleaseSemaphore
WaitForSingleObject
SetEvent
ReleaseSRWLockExclusive
SetWaitableTimer
AcquireSRWLockExclusive
InitializeCriticalSectionAndSpinCount

api-ms-win-core-synch-l1-2-0

InitializeConditionVariable
Sleep
SleepConditionVariableCS
WakeConditionVariable

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetComputerNameExW
GetTickCount
GetLocalTime
GetTickCount64
GetSystemTime

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorDacl
GetTokenInformation
InitializeSecurityDescriptor
AllocateAndInitializeSid
AddAccessAllowedAce
FreeSid
GetLengthSid
InitializeAcl
AccessCheck

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW
RpcImpersonateClient
RpcRevertToSelf
NdrServerCall2
I_RpcExceptionFilter
RpcServerUseProtseqEpW
RpcServerRegisterIf3
RpcServerInqBindings
RpcEpRegisterW
RpcBindingVectorFree
RpcEpUnregister
RpcServerUnregisterIfEx
RpcBindingToStringBindingW
RpcStringBindingParseW

api-ms-win-eventing-provider-l1-1-0

EventSetInformation

api-ms-win-power-base-l1-1-0

CallNtPowerInformation

api-ms-win-core-file-l1-1-0

CreateFileW
SetFileInformationByHandle
CreateFileA

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-rtlsupport-l1-2-0

RtlCompareMemory

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DhcpGlobalIsShuttingDown
DhcpGlobalServiceSyncEvent
DhcpGlobalTerminateEvent
ServiceMain

Sections

.text
Size: 263KB - Virtual size: 262KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 392B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f371c065cc9676fdf95b1e9816920ae

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-crt-l1-1-0

api-ms-win-core-crt-l2-1-0

ntdll

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-security-base-l1-1-0

rpcrt4

api-ms-win-eventing-provider-l1-1-0

api-ms-win-power-base-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 263KB - Virtual size: 262KB

.data Size: 512B - Virtual size: 4KB

.idata Size: 6KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 392B

.rsrc Size: 34KB - Virtual size: 34KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 263KB - Virtual size: 262KB

.data
Size: 512B - Virtual size: 4KB

.idata
Size: 6KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 392B

.rsrc
Size: 34KB - Virtual size: 34KB

.reloc
Size: 16KB - Virtual size: 15KB