RpcNs4[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

RpcNs4.dll
Size

8KB
MD5

bb92cd2d0874b7362db4c0e1e90da7c4
SHA1

432dbab6bb2e4d441dde51b6d71066a0af858e14
SHA256

42f72be73745f161f80a087eb045106c1b37a994b629883030b607733dfe5d90
SHA512

b13834781515e0bbfe1f65c842be8c571c7bb0cf3587ad18194584cf53c7e4d96ecec5ba29c8b1e8e4bb96c65ecafe3ae75ca7dbab4b372f733ee4ea9fb606c7
SSDEEP

96:CHZNGawkE7eqWFITOlALBn42QzaCp869lPmCJ3dwreEWh1BWw:kZNgk5F8MmCJ32PWh1BW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RpcNs4.dll

Files

RpcNs4.dll
.dll windows:6 windows x86 arch:x86

7f279de714207df6fd980cd0fb1d0195

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

RpcNs4.pdb

Imports

ntdll

DbgPrintEx
WinSqmIsOptedIn
RtlIntegerToUnicodeString
WinSqmIncrementDWORD
DbgPrint

advapi32

DeregisterEventSource
RegisterEventSourceW
ReportEventW

kernel32

GetCurrentThreadId
GetCurrentProcess
GetSystemTimeAsFileTime
GetTickCount
TerminateProcess
QueryPerformanceCounter
GetLastError
GetCommandLineW
GetCurrentProcessId
UnhandledExceptionFilter
SetUnhandledExceptionFilter

Exports

Exports

I_RpcNsGetBuffer
I_RpcNsNegotiateTransferSyntax
I_RpcNsRaiseException
I_RpcNsSendReceive
I_RpcReBindBuffer
RpcIfIdVectorFree
RpcNsBindingExportA
RpcNsBindingExportPnPA
RpcNsBindingExportPnPW
RpcNsBindingExportW
RpcNsBindingImportBeginA
RpcNsBindingImportBeginW
RpcNsBindingImportDone
RpcNsBindingImportNext
RpcNsBindingLookupBeginA
RpcNsBindingLookupBeginW
RpcNsBindingLookupDone
RpcNsBindingLookupNext
RpcNsBindingSelect
RpcNsBindingUnexportA
RpcNsBindingUnexportPnPA
RpcNsBindingUnexportPnPW
RpcNsBindingUnexportW
RpcNsEntryExpandNameA
RpcNsEntryExpandNameW
RpcNsEntryObjectInqBeginA
RpcNsEntryObjectInqBeginW
RpcNsEntryObjectInqDone
RpcNsEntryObjectInqNext
RpcNsGroupDeleteA
RpcNsGroupDeleteW
RpcNsGroupMbrAddA
RpcNsGroupMbrAddW
RpcNsGroupMbrInqBeginA
RpcNsGroupMbrInqBeginW
RpcNsGroupMbrInqDone
RpcNsGroupMbrInqNextA
RpcNsGroupMbrInqNextW
RpcNsGroupMbrRemoveA
RpcNsGroupMbrRemoveW
RpcNsMgmtBindingUnexportA
RpcNsMgmtBindingUnexportW
RpcNsMgmtEntryCreateA
RpcNsMgmtEntryCreateW
RpcNsMgmtEntryDeleteA
RpcNsMgmtEntryDeleteW
RpcNsMgmtEntryInqIfIdsA
RpcNsMgmtEntryInqIfIdsW
RpcNsMgmtHandleSetExpAge
RpcNsMgmtInqExpAge
RpcNsMgmtSetExpAge
RpcNsProfileDeleteA
RpcNsProfileDeleteW
RpcNsProfileEltAddA
RpcNsProfileEltAddW
RpcNsProfileEltInqBeginA
RpcNsProfileEltInqBeginW
RpcNsProfileEltInqDone
RpcNsProfileEltInqNextA
RpcNsProfileEltInqNextW
RpcNsProfileEltRemoveA
RpcNsProfileEltRemoveW

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 702B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7f279de714207df6fd980cd0fb1d0195

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

advapi32

kernel32

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 804B

.idata Size: 1024B - Virtual size: 702B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 144B

.text
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 804B

.idata
Size: 1024B - Virtual size: 702B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 144B