dnsrslvr[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

dnsrslvr.dll
Size

128KB
MD5

2b2483a140fffd86d5e44a08b55b4db2
SHA1

e079c182ac0913dfabb0f07c223a3a476c3b7102
SHA256

4df8abc447a027ae1b4983106f7e5e5ad578906f82ff311e5dc8cf1241f7e642
SHA512

ffc21225d0be8b5e7eff99252a52118938c5899afe3fe36e666d411a7e87dbb8c52f7507f57e9e133d5621b3c1dfaafbc5d9c415cd8842a8172d15f16a21434d
SSDEEP

3072:8VDwLwTNTn3MCse0FS1TcPwQhlKdkgmSIwo3:o79seSS1i/lQxIV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dnsrslvr.dll

Files

dnsrslvr.dll
.dll windows:6 windows x86 arch:x86

11c589d7a6affd9956b18a11aad87897

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dnsrslvr.pdb

Imports

msvcrt

memcpy
atoi
_except_handler4_common
_amsg_exit
_initterm
free
malloc
_XcptFilter
wcsstr
memset
_wcsicmp
_vsnwprintf
_vsnprintf
wcschr

ntdll

EtwTraceMessage
NtQueryInformationProcess
RtlCreateServiceSid
RtlInitUnicodeString
EvtIntReportEventAndSourceAsync
EtwEventRegister
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlInitializeCriticalSection
RtlIpv6AddressToStringA
RtlIpv6AddressToStringExW
RtlIpv4AddressToStringExW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwEventUnregister

ws2_32

accept
getsockname
WSACreateEvent
WSAEventSelect
closesocket
WSASocketW
setsockopt
WSAGetLastError
WSAIoctl
WSAStartup
WSACleanup
inet_ntoa
WSAResetEvent

rpcrt4

RpcServerInqBindings
RpcEpUnregister
RpcBindingVectorFree
RpcServerUnregisterIf
RpcImpersonateClient
RpcRevertToSelf
RpcServerUseProtseqEpW
RpcServerRegisterIfEx
RpcBindingToStringBindingW
RpcStringFreeW
RpcStringBindingParseW
NdrServerCall2

dnsapi

GetCurrentTimeInSeconds
NetInfo_IsAddrConfig
DnsGetProxyInfoPrivate
DnsGetPolicyTableInfoPrivate
NetInfo_GetAdapterByName
DnsFreePolicyConfig
DnsNameCompare_W
HostsFile_Open
HostsFile_ReadLine
HostsFile_Close
Dns_InitializeMsgBuf
Dns_ReadPacketName
Dns_SetRecordsSection
Dns_SetRecordsTtl
Dns_AddRecordsToMessage
Send_MessagePrivate
Dns_RecvTcp
Socket_RecvFrom
IpHelp_IsAddrOnLink
Local_GetRecordsForLocalNameEx
DnsQuery_W
NetInfo_GetAdapterByAddress
NetInfo_GetAdapterByInterfaceIndex
Socket_Create
Socket_JoinMulticast
Socket_SetMulticastLoopBack
Socket_TcpListen
Socket_SetTtl
Dns_AllocateMsgBuf
Socket_CloseEx
Dns_FreeMsgBuf
DnsStatusString
FlushDnsPolicyUnreachableStatus
Trace_Reset
NetInfo_UpdateServerReachability
NetInfo_ResetServerPriorities
NetInfo_Build
NetInfo_Copy
NetInfo_Clean
NetInfo_Free
Reg_ReadUpdateInfo
Reg_FreeUpdateInfo
DnsReplaceRecordSetW
ExtraInfo_Init
DnsModifyRecordsInSet_W
Update_ReplaceAddressRecordsW
Faz_AreServerListsInSameNameSpace
Reg_GetValueEx
Reg_ReadGlobalsEx
DnsGlobals
Security_ContextListTimeout
DnsLogInit
DnsApiFree
DnsApiRealloc
DnsApiAlloc
Socket_CacheInit
DnsTraceServerConfig
DnsLogTime
DnsLogIt
Socket_CacheCleanup
Query_Main
DnsUpdateMachinePresence

winnsi

NsiConnectToServer
NsiRpcDeregisterChangeNotification
NsiDisconnectFromServer
NsiRpcRegisterChangeNotification

nsi

NsiFreeTable
NsiGetParameter
NsiAllocateAndGetTable
NsiGetAllParameters

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-file-l1-1-0

FindFirstChangeNotificationW
FindNextChangeNotification

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapDestroy
GetProcessHeap
HeapFree
HeapCreate
HeapAlloc

api-ms-win-core-interlocked-l1-1-0

InterlockedDecrement
InterlockedIncrement
InterlockedExchange
InterlockedCompareExchange

api-ms-win-core-libraryloader-l1-1-0

LoadLibraryExW
GetProcAddress
DisableThreadLibraryCalls
LoadLibraryExA
FreeLibrary

api-ms-win-core-localization-l1-1-0

LCMapStringW

api-ms-win-core-localregistry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyExW
RegQueryValueExA
RegOpenKeyExA
RegNotifyChangeKeyValue
RegSetValueExW

api-ms-win-core-misc-l1-1-0

LocalFree
LocalAlloc
Sleep

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
CreateThread
GetCurrentThreadId
TerminateThread
OpenThreadToken
GetCurrentThread
GetCurrentProcessId
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW
WideCharToMultiByte

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
SetEvent
CreateEventW
WaitForSingleObject
InitializeSRWLock
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
CreateEventA
ReleaseSRWLockExclusive
InitializeCriticalSection
WaitForMultipleObjectsEx
ResetEvent
EnterCriticalSection
LeaveCriticalSection

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-threadpool-l1-1-0

UnregisterWaitEx

api-ms-win-security-base-l1-1-0

MapGenericMask
IsValidSecurityDescriptor
FreeSid
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
AccessCheck

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

kernelbase

CompareStringA

Exports

Exports

LoadGPExtension
Reg_DoRegisterAdapter
ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

11c589d7a6affd9956b18a11aad87897

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

ws2_32

rpcrt4

dnsapi

winnsi

nsi

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-localization-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-threadpool-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-delayload-l1-1-0

kernelbase

Exports

Exports

Sections

.text Size: 113KB - Virtual size: 113KB

.data Size: 5KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 113KB - Virtual size: 113KB

.data
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 7KB