OnDemandConnRouteHelper[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

OnDemandConnRouteHelper.dll
Size

51KB
MD5

f878da721d14a7668e2898343f62fa19
SHA1

86d902e123139783a1913f7e6bfee99633de31da
SHA256

b0b77179455cab1a704b63db705d61ec970764bd296e131a8608091f5f412531
SHA512

1338b886687cc85f2a23c22ec2c50de68eb996e8cf321d9a7dfe73c85cfc08967674c7b1553ed9a4fd8a4eaaa6fe1fbd8af4a843b816af87d0dd13d53e57d68f
SSDEEP

768:00CDCJZW0B8oAGPpxn2IpFtlS0MAEXSEiw8QNXGJrTELxExkWcEoFf:VCDCJZWToDPn2AlcqEiA0uGqWcE4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OnDemandConnRouteHelper.dll

Files

OnDemandConnRouteHelper.dll
.dll windows:10 windows x86 arch:x86

a91d55d9ab02e945fd95a17fbc96d8dc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

OnDemandConnRouteHelper.pdb

Imports

msvcrt

_except_handler4_common
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_onexit
memmove
__CxxFrameHandler3
toupper
_lock
_initterm
free
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
malloc
_unlock
_purecall
??0exception@@QAE@ABQBD@Z
??_V@YAXPAX@Z
?what@exception@@UBEPBDXZ
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
??3@YAXPAX@Z
memcpy_s
_vsnwprintf
__dllonexit
memcmp
memcpy
memset

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleExW
FreeLibrary
GetModuleFileNameA
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
AcquireSRWLockExclusive
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
CreateSemaphoreExW
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
SetEvent
CreateEventW

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
UnregisterTraceGuids
TraceMessage
GetTraceLoggerHandle

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventProviderEnabled
EventRegister
EventSetInformation

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoTaskMemFree

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolThreadMaximum
CloseThreadpoolWork
CreateThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpool
FreeLibraryWhenCallbackReturns
SubmitThreadpoolWork
CreateThreadpool
SetThreadpoolThreadMinimum

rpcrt4

RpcBindingSetOption
NdrClientCall4
NdrAsyncClientCall2
RpcBindingFree
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcAsyncCancelCall
RpcStringFreeW
RpcExceptionFilter
RpcSsDestroyClientContext
RpcAsyncCompleteCall
RpcAsyncInitializeHandle

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-heap-l2-1-0

LocalAlloc

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

FreeInterfaceContextTable
GetInterfaceContextTableForHostName
OnDemandAddRouteRequest
OnDemandGetRoutingHint
OnDemandRegisterNotification
OnDemandRemoveMatchingRoute
OnDemandRemoveRouteRequest
OnDemandUnRegisterNotification

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a91d55d9ab02e945fd95a17fbc96d8dc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-threadpool-l1-2-0

rpcrt4

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 40KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 28B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 40KB - Virtual size: 40KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 28B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB