dnsapi[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dnsapi.dll
Size

641KB
MD5

4de4caebab7e425a69e6d18ce18e1d19
SHA1

a84bf919e7131e0f0c2c61a661ddba99daac2d2c
SHA256

1466a725885b4cba6623b884d6845da5f59201586f4b51767454c913344fe7f3
SHA512

782b1f38f53180490c3d4032b427527cbc260191e6eb7bc44e67101062c68bfc76b16f2e95dbeee0e87c1cafa375e0e759c1b30ca8b11cbb60b2baf881ead464
SSDEEP

12288:dHwhXoiGV5NmSzfooe5mSQYWgT9mZwTN4QT2U1H42lt:1S4iGV+SleQSmgT9mZwrF423

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dnsapi.dll

Files

dnsapi.dll
.dll windows:6 windows x64 arch:x64

b62546c19c132ed535051c3b176439ea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dnsapi.pdb

Imports

api-ms-win-core-crt-l1-1-0

atoi
_strlwr_s
_strupr_s
strncmp
strtoul
_wtoi
memcmp
memcpy
memset
towlower
wcschr
wcstoul
wcscpy_s
_stricmp
_strnicmp
_wcsicmp
_wcsnicmp
wcspbrk
_vsnwprintf_s
_vsnprintf_s
swprintf_s
wcscat_s
__C_specific_handler
strcmp

api-ms-win-core-crt-l2-1-0

time
_initterm_e
_initterm

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-file-l1-2-1

ReadFile
SetFilePointer
CreateFileA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapFree

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExA
LoadLibraryExW
GetProcAddress
FreeLibrary
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleFileNameW
GetModuleHandleW

api-ms-win-core-localization-l1-2-1

LCMapStringW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegGetValueW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyExW
RegEnumKeyExW

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc
LocalFree
LocalReAlloc

api-ms-win-core-processenvironment-l1-2-0

GetEnvironmentVariableW

api-ms-win-core-processthreads-l1-1-2

GetCurrentThread
OpenThreadToken
CreateThread
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringW

api-ms-win-core-sysinfo-l1-2-1

GetTickCount64
GetSystemDirectoryA
GetVersionExW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-synch-l1-2-0

LeaveCriticalSection
DeleteCriticalSection
CreateEventA
ReleaseMutex
EnterCriticalSection
SetEvent
CreateEventW
CreateSemaphoreExW
WaitForSingleObject
ReleaseSemaphore
WaitForMultipleObjectsEx
ResetEvent
InitializeCriticalSection
Sleep
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
AcquireSRWLockShared
ReleaseSRWLockShared

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-security-base-l1-2-0

GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolIoCallbacks
CreateThreadpoolIo
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
StartThreadpoolIo
CancelThreadpoolIo
DisassociateCurrentThreadFromCallback
CloseThreadpoolIo
WaitForThreadpoolTimerCallbacks

ws2_32

socket
closesocket
htons
htonl
send
sendto
__WSAFDIsSet
select
WSAIoctl
connect
WSARecv
ntohs
getservbyport
FreeAddrInfoW
getprotobyname
inet_addr
getsockname
setsockopt
WSASocketW
listen
shutdown
WSAJoinLeaf
bind
ntohl
GetAddrInfoW
inet_ntoa
WSAStartup
WSACleanup
getprotobynumber
WSAGetLastError

ntdll

EtwEventEnabled
EtwEventWrite
EtwLogTraceEvent
RtlIpv4StringToAddressW
EtwEventRegister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
RtlInitUnicodeString
RtlNtStatusToDosError
NtCreateFile
NtCancelIoFile
NtDeviceIoControlFile
EtwEventUnregister
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
RtlInitializeCriticalSection
RtlStringFromGUID
RtlFreeUnicodeString
RtlGUIDFromString
RtlIpv6StringToAddressA
RtlIpv4StringToAddressA
RtlIpv6AddressToStringW
RtlIpv6AddressToStringA
RtlIpv6StringToAddressExW
RtlIdnToUnicode
RtlIdnToAscii
RtlIdnToNameprepUnicode
RtlAllocateHeap
RtlReAllocateHeap
RtlFreeHeap
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WinSqmAddToStream
EtwTraceMessage
WinSqmSetDWORD
WinSqmIsOptedIn
RtlIpv6StringToAddressW

nsi

NsiAllocateAndGetTable
NsiGetParameter
NsiGetAllParameters
NsiFreeTable

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

AdaptiveTimeout_ClearInterfaceSpecificConfiguration
AdaptiveTimeout_ResetAdaptiveTimeout
AddRefQueryBlobEx
BreakRecordsIntoBlob
Coalesce_UpdateNetVersion
CombineRecordsInBlob
DeRefQueryBlobEx
DelaySortDAServerlist
DnsAcquireContextHandle_A
DnsAcquireContextHandle_W
DnsAllocateRecord
DnsApiAlloc
DnsApiAllocZero
DnsApiFree
DnsApiHeapReset
DnsApiRealloc
DnsApiSetDebugGlobals
DnsAsyncRegisterHostAddrs
DnsAsyncRegisterInit
DnsAsyncRegisterTerm
DnsCancelQuery
DnsCopyStringEx
DnsCreateReverseNameStringForIpAddress
DnsCreateStandardDnsNameCopy
DnsCreateStringCopy
DnsDhcpRegisterAddrs
DnsDhcpRegisterHostAddrs
DnsDhcpRegisterInit
DnsDhcpRegisterTerm
DnsDhcpRemoveRegistrations
DnsDhcpSrvRegisterHostAddr
DnsDhcpSrvRegisterHostAddrEx
DnsDhcpSrvRegisterHostName
DnsDhcpSrvRegisterHostNameEx
DnsDhcpSrvRegisterInit
DnsDhcpSrvRegisterInitEx
DnsDhcpSrvRegisterInitialize
DnsDhcpSrvRegisterTerm
DnsDisableIdnEncoding
DnsDowncaseDnsNameLabel
DnsExtractRecordsFromMessage_UTF8
DnsExtractRecordsFromMessage_W
DnsFindAuthoritativeZone
DnsFlushResolverCache
DnsFlushResolverCacheEntry_A
DnsFlushResolverCacheEntry_UTF8
DnsFlushResolverCacheEntry_W
DnsFree
DnsFreeConfigStructure
DnsFreePolicyConfig
DnsFreeProxyName
DnsGetBufferLengthForStringCopy
DnsGetCacheDataTable
DnsGetDnsServerList
DnsGetDomainName
DnsGetLastFailedUpdateInfo
DnsGetPolicyTableInfo
DnsGetPolicyTableInfoPrivate
DnsGetPrimaryDomainName_A
DnsGetProxyInfoPrivate
DnsGetProxyInformation
DnsGetQueryRetryTimeouts
DnsGlobals
DnsIpv6AddressToString
DnsIpv6StringToAddress
DnsIsAMailboxType
DnsIsNSECType
DnsIsStatusRcode
DnsIsStringCountValidForTextType
DnsLogEvent
DnsMapRcodeToStatus
DnsModifyRecordsInSet_A
DnsModifyRecordsInSet_UTF8
DnsModifyRecordsInSet_W
DnsNameCompareEx_A
DnsNameCompareEx_UTF8
DnsNameCompareEx_W
DnsNameCompare_A
DnsNameCompare_UTF8
DnsNameCompare_W
DnsNameCopy
DnsNameCopyAllocate
DnsNetworkInfo_CreateFromFAZ
DnsNetworkInformation_CreateFromFAZ
DnsNotifyResolver
DnsNotifyResolverClusterIp
DnsNotifyResolverEx
DnsQueryConfig
DnsQueryConfigAllocEx
DnsQueryConfigDword
DnsQueryEx
DnsQueryExA
DnsQueryExUTF8
DnsQueryExW
DnsQuery_A
DnsQuery_UTF8
DnsQuery_W
DnsRecordBuild_UTF8
DnsRecordBuild_W
DnsRecordCompare
DnsRecordCopyEx
DnsRecordListFree
DnsRecordListUnmapV4MappedAAAAInPlace
DnsRecordSetCompare
DnsRecordSetCopyEx
DnsRecordSetDetach
DnsRecordStringForType
DnsRecordStringForWritableType
DnsRecordTypeForName
DnsReleaseContextHandle
DnsRemoveRegistrations
DnsReplaceRecordSetA
DnsReplaceRecordSetUTF8
DnsReplaceRecordSetW
DnsResetQueryRetryTimeouts
DnsResolverOp
DnsScreenLocalAddrsForRegistration
DnsSetConfigDword
DnsSetQueryRetryTimeouts
DnsStatusString
DnsStringCopyAllocateEx
DnsTraceServerConfig
DnsUnicodeToUtf8
DnsUpdate
DnsUpdateMachinePresence
DnsUpdateTest_A
DnsUpdateTest_UTF8
DnsUpdateTest_W
DnsUtf8ToUnicode
DnsValidateNameOrIp_TempW
DnsValidateName_A
DnsValidateName_UTF8
DnsValidateName_W
DnsValidateServerArray_A
DnsValidateServerArray_W
DnsValidateServerStatus
DnsValidateServer_A
DnsValidateServer_W
DnsValidateUtf8Byte
DnsWriteQuestionToBuffer_UTF8
DnsWriteQuestionToBuffer_W
DnsWriteReverseNameStringForIpAddress
Dns_AddRecordsToMessage
Dns_AllocateMsgBuf
Dns_BuildPacket
Dns_CacheServiceCleanup
Dns_CacheServiceInit
Dns_CacheServiceStopIssued
Dns_CleanupWinsock
Dns_CloseConnection
Dns_CloseSocket
Dns_CreateMulticastSocket
Dns_CreateSocket
Dns_CreateSocketEx
Dns_ExtractRecordsFromMessage
Dns_FindAuthoritativeZoneLib
Dns_FreeMsgBuf
Dns_GetRandomXid
Dns_InitializeMsgBuf
Dns_InitializeMsgRemoteSockaddr
Dns_InitializeWinsock
Dns_OpenTcpConnectionAndSend
Dns_ParseMessage
Dns_ParsePacketRecord
Dns_PingAdapterServers
Dns_ReadPacketName
Dns_ReadPacketNameAllocate
Dns_ReadRecordStructureFromPacket
Dns_RecvTcp
Dns_ResetNetworkInfo
Dns_SendAndRecvUdp
Dns_SendEx
Dns_SetRecordDatalength
Dns_SetRecordsSection
Dns_SetRecordsTtl
Dns_SkipPacketName
Dns_SkipToRecord
Dns_UpdateLib
Dns_UpdateLibEx
Dns_WriteDottedNameToPacket
Dns_WriteQuestionToMessage
Dns_WriteRecordStructureToPacketEx
ExtraInfo_Init
Faz_AreServerListsInSameNameSpace
FlushDnsPolicyUnreachableStatus
GetCurrentTimeInSeconds
HostsFile_Close
HostsFile_Open
HostsFile_ReadLine
IpHelp_IsAddrOnLink
Local_GetRecordsForLocalName
Local_GetRecordsForLocalNameEx
NetInfo_Build
NetInfo_Clean
NetInfo_Copy
NetInfo_CopyNetworkIndex
NetInfo_CreatePerNetworkNetinfo
NetInfo_Free
NetInfo_GetAdapterByAddress
NetInfo_GetAdapterByInterfaceIndex
NetInfo_GetAdapterByName
NetInfo_IsAddrConfig
NetInfo_IsForUpdate
NetInfo_IsTcpipConfigChange
NetInfo_ResetServerPriorities
NetInfo_UpdateDnsInterfaceConfigChange
NetInfo_UpdateNetworkProperties
NetInfo_UpdateServerReachability
QueryDirectEx
Query_Cancel
Query_Main
Reg_FreeUpdateInfo
Reg_GetValueEx
Reg_ReadGlobalsEx
Reg_ReadUpdateInfo
Security_ContextListTimeout
Send_AndRecvUdpWithParam
Send_MessagePrivate
Send_OpenTcpConnectionAndSend
Socket_CacheCleanup
Socket_CacheInit
Socket_CleanupWinsock
Socket_ClearMessageSockets
Socket_CloseEx
Socket_CloseMessageSockets
Socket_Create
Socket_CreateMulticast
Socket_InitWinsock
Socket_JoinMulticast
Socket_RecvFrom
Socket_SetMulticastInterface
Socket_SetMulticastLoopBack
Socket_SetTtl
Socket_TcpListen
Trace_Reset
Update_ReplaceAddressRecordsW
Util_IsIp6Running

Sections

.text
Size: 546KB - Virtual size: 545KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b62546c19c132ed535051c3b176439ea

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-crt-l1-1-0

api-ms-win-core-crt-l2-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-threadpool-l1-2-0

ws2_32

ntdll

nsi

api-ms-win-core-debug-l1-1-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 546KB - Virtual size: 545KB

.data Size: 15KB - Virtual size: 14KB

.pdata Size: 34KB - Virtual size: 34KB

.idata Size: 8KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 360B

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 546KB - Virtual size: 545KB

.data
Size: 15KB - Virtual size: 14KB

.pdata
Size: 34KB - Virtual size: 34KB

.idata
Size: 8KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 360B

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 3KB - Virtual size: 2KB