dhcpcore[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

dhcpcore.dll
Size

321KB
MD5

8ddf48cc1c9bbdc0a28dfba3826ac732
SHA1

ee52ead7fb66c23525ebfd58800f4fd0cfadb200
SHA256

1b09d7255365a900b7f899eb10a98e298b4017b377143a63f69087439373f464
SHA512

557dd7b04582f883879184492f74cf141df4141d655edfef41222220ee6f3d5fca1dddb29c094f06afcc166d807a3e3f9de75d7f939e70c7a851d094de6441f3
SSDEEP

6144:APTWySclAQEfvudaCBaEtTPa7qMPBkdci3QKEfRIj1Lo:AxAQE0baqiBkdNAKQ21U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dhcpcore.dll

Files

dhcpcore.dll
.dll windows:10 windows x86 arch:x86

4f371c065cc9676fdf95b1e9816920ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dhcpcore.pdb

Imports

api-ms-win-core-crt-l1-1-0

_except_handler4_common
_ftol2
_local_unwind4
memcmp
memcpy
memmove
memset
_wcsicmp
memcpy_s
wcsrchr
_wtol
wcschr
_vsnprintf_s
_vsnwprintf_s

api-ms-win-core-crt-l2-1-0

_initterm
time
_initterm_e

ntdll

RtlOemStringToUnicodeString
RtlUnicodeStringToOemString
RtlInitUnicodeString
EtwEventWrite
EtwEventRegister
RtlNtStatusToDosError
EtwEventWriteTransfer
EtwTraceMessage
EtwEventUnregister
EtwUnregisterTraceGuids
NtDeviceIoControlFile
RtlxUnicodeStringToOemSize
RtlInitString
RtlxOemStringToUnicodeSize
RtlGUIDFromString
RtlGetDeviceFamilyInfoEnum
RtlIsStateSeparationEnabled
RtlSetSaclSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAddAce
RtlLengthSid
RtlNewSecurityObject
RtlCopySid
RtlCreateAcl
RtlSetGroupSecurityDescriptor
RtlCreateSecurityDescriptor
RtlDeleteSecurityObject
RtlIdnToAscii
RtlIdnToUnicode
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
RtlFreeUnicodeString
RtlRandomEx
EtwEventActivityIdControl
NtCreateFile
RtlStringFromGUID
WinSqmAddToStream
DbgPrint

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap
HeapReAlloc

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
LoadLibraryExW
FreeLibrary
GetProcAddress

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegEnumValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegSetValueExA
RegDeleteValueA
RegDeleteKeyExW
RegDeleteValueW

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc
LocalFree

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
CreateThread
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-synch-l1-1-0

OpenEventA
ReleaseSRWLockShared
AcquireSRWLockShared
DeleteCriticalSection
InitializeCriticalSection
WaitForMultipleObjectsEx
CreateWaitableTimerExW
LeaveCriticalSection
EnterCriticalSection
ResetEvent
InitializeSRWLock
CreateEventW
CancelWaitableTimer
CreateSemaphoreExW
ReleaseSemaphore
WaitForSingleObject
SetEvent
ReleaseSRWLockExclusive
SetWaitableTimer
AcquireSRWLockExclusive
InitializeCriticalSectionAndSpinCount

api-ms-win-core-synch-l1-2-0

InitializeConditionVariable
Sleep
SleepConditionVariableCS
WakeConditionVariable

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetComputerNameExW
GetTickCount
GetLocalTime
GetTickCount64
GetSystemTime

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorDacl
GetTokenInformation
InitializeSecurityDescriptor
AllocateAndInitializeSid
AddAccessAllowedAce
FreeSid
GetLengthSid
InitializeAcl
AccessCheck

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW
RpcImpersonateClient
RpcRevertToSelf
NdrServerCall2
I_RpcExceptionFilter
RpcServerUseProtseqEpW
RpcServerRegisterIf3
RpcServerInqBindings
RpcEpRegisterW
RpcBindingVectorFree
RpcEpUnregister
RpcServerUnregisterIfEx
RpcBindingToStringBindingW
RpcStringBindingParseW

api-ms-win-eventing-provider-l1-1-0

EventSetInformation

api-ms-win-power-base-l1-1-0

CallNtPowerInformation

api-ms-win-core-file-l1-1-0

CreateFileW
SetFileInformationByHandle
CreateFileA

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-rtlsupport-l1-2-0

RtlCompareMemory

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DhcpGlobalIsShuttingDown
DhcpGlobalServiceSyncEvent
DhcpGlobalTerminateEvent
ServiceMain

Sections

.text
Size: 262KB - Virtual size: 262KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 392B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f371c065cc9676fdf95b1e9816920ae

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-crt-l1-1-0

api-ms-win-core-crt-l2-1-0

ntdll

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-security-base-l1-1-0

rpcrt4

api-ms-win-eventing-provider-l1-1-0

api-ms-win-power-base-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 262KB - Virtual size: 262KB

.data Size: 512B - Virtual size: 4KB

.idata Size: 6KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 392B

.rsrc Size: 34KB - Virtual size: 34KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 262KB - Virtual size: 262KB

.data
Size: 512B - Virtual size: 4KB

.idata
Size: 6KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 392B

.rsrc
Size: 34KB - Virtual size: 34KB

.reloc
Size: 16KB - Virtual size: 15KB