Windows[.]Networking[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

Windows.Networking.dll
Size

459KB
MD5

71d302ff6f58fc5b13318fe0009702db
SHA1

326d9dcd22113a521fa6f2677de7d3b8f96e2143
SHA256

745437de5d89756b871d9a52c2a19e956e4ff246eb61e63d08e416ae7d5d7a37
SHA512

b8c24e66751ff501c8babc77098c1a5d9943cfe01718a4f5f0aa05dfe6006a00b3d84caba09d4d2fc8c006f2dec8cd3873a219dc2efbcf5394b5ad345e4b8bed
SSDEEP

6144:6gXX8bRykZYFaaieGHml+MQLTPTMFN53y2qY7nl5zlp4TVI:6pbRykZYU3Hy6PQFN53E4l5hp4Z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Windows.Networking.dll

Files

Windows.Networking.dll
.dll regsvr32 windows:6 windows x86 arch:x86

41af31b98585c91feffab43b5e4941c6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Windows.Networking.pdb

Imports

msvcrt

free
_vsnwprintf
_wtoi
_wcsicmp
_XcptFilter
memcmp
memcpy
??3@YAXPAX@Z
_amsg_exit
_initterm
__CxxFrameHandler3
_except_handler4_common
_onexit
malloc
__dllonexit
memmove_s
_ultow_s
_purecall
??2@YAPAXI@Z
_lock
realloc
_unlock
memset

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull
WindowsGetStringLen
HSTRING_UserUnmarshal
WindowsCreateStringReference
WindowsCreateString
WindowsSubstring
HSTRING_UserFree
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCompareStringOrdinal
WindowsConcatString
HSTRING_UserMarshal
HSTRING_UserSize
WindowsDuplicateString

api-ms-win-core-winrt-error-l1-1-1

IsErrorPropagationEnabled
RoTransformError
RoOriginateErrorW
GetRestrictedErrorInfo
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
RoOriginateError
SetRestrictedErrorInfo

api-ms-win-core-com-l1-1-1

CoCreateFreeThreadedMarshaler
CreateStreamOnHGlobal
CoMarshalInterface
RoGetAgileReference
CoCopyProxy
CoGetApartmentType
CLSIDFromString
CoGetCallerTID
CoDecrementMTAUsage
CoSetProxyBlanket
CoTaskMemFree
CoIncrementMTAUsage
CoReleaseMarshalData
CoTaskMemAlloc
CoCreateInstance

api-ms-win-core-synch-l1-2-0

InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
InitializeConditionVariable
SleepConditionVariableCS
InitOnceExecuteOnce
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
CreateEventW
SetEvent
WakeAllConditionVariable
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeSRWLock
AcquireSRWLockExclusive

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
TlsFree
GetCurrentProcess
TlsAlloc
OpenThreadToken
SetThreadToken
GetCurrentThread
OpenProcessToken
OpenProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-security-base-l1-2-0

RevertToSelf
CheckTokenCapability
GetTokenInformation
DuplicateTokenEx

api-ms-win-core-errorhandling-l1-1-1

RaiseException
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-devices-config-l1-1-1

CM_Register_Notification
CM_MapCrToWin32Err
CM_Unregister_Notification

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoActivateInstance
RoInitialize
RoGetActivationFactory

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapFree

api-ms-win-core-io-l1-1-1

CancelIoEx
GetOverlappedResultEx

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolIo
CallbackMayRunLong
CloseThreadpoolCleanupGroup
FreeLibraryWhenCallbackReturns
WaitForThreadpoolTimerCallbacks
CloseThreadpoolWait
CreateThreadpoolCleanupGroup
TrySubmitThreadpoolCallback
CreateThreadpoolTimer
CloseThreadpoolIo
StartThreadpoolIo
SetThreadpoolWait
SetThreadpoolTimer
CreateThreadpoolWait
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolWork
CancelThreadpoolIo
CreateThreadpoolWork

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
DisableThreadLibraryCalls
LoadStringW
GetModuleHandleW
FreeLibrary

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWrite

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal
WideCharToMultiByte

rpcrt4

NdrDllUnregisterProxy
NdrDllGetClassObject
NdrCStdStubBuffer2_Release
NdrDllCanUnloadNow
NdrDllRegisterProxy
NdrCStdStubBuffer_Release
IUnknown_QueryInterface_Proxy
NdrStubCall2
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
CStdStubBuffer_AddRef
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
NdrOleFree
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
NdrStubForwardingFunction

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetSystemDirectoryW
GetTickCount64
GetTickCount

api-ms-win-core-psm-app-l1-1-0

PsmUnregisterAppStateChangeNotification
PsmRegisterAppStateChangeNotification
PsmQueryCurrentAppState

ntdll

toupper
RtlDowncaseUnicodeChar
tolower
RtlCompareUnicodeStrings
RtlIpv6AddressToStringW
_wcsnicmp
memmove
RtlAllocateHeap
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwGetTraceLoggerHandle
RtlFreeHeap
_itow_s
WinSqmIncrementDWORD
WinSqmIsOptedIn
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExW

combase

ord5
ord10
ord32
ord6
ord9
ord8
ord34
ord13
ord16
ord14
ord2
ord15
ord33
ord11
ord12
ord7

firewallapi

NetworkIsolationDiagnoseSocketCreation
NetworkIsolationDiagnoseListen

api-ms-win-core-localization-l1-2-1

FormatMessageW
GetCPInfoExW
IdnToAscii
IdnToUnicode

api-ms-win-core-processenvironment-l1-2-0

GetEnvironmentVariableA

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

api-ms-win-core-interlocked-l1-2-0

InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
SetSocketMediaStreamingMode

Sections

.text
Size: 390KB - Virtual size: 389KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 1024B - Virtual size: 825B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 452B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

41af31b98585c91feffab43b5e4941c6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-security-base-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-string-l1-1-0

rpcrt4

api-ms-win-core-util-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-psm-app-l1-1-0

ntdll

combase

firewallapi

api-ms-win-core-localization-l1-2-1

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-interlocked-l1-2-0

Exports

Exports

Sections

.text Size: 390KB - Virtual size: 389KB

.orpc Size: 1024B - Virtual size: 825B

.data Size: 2KB - Virtual size: 33KB

.idata Size: 8KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 452B

.rsrc Size: 23KB - Virtual size: 23KB

.reloc Size: 32KB - Virtual size: 32KB

.text
Size: 390KB - Virtual size: 389KB

.orpc
Size: 1024B - Virtual size: 825B

.data
Size: 2KB - Virtual size: 33KB

.idata
Size: 8KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 452B

.rsrc
Size: 23KB - Virtual size: 23KB

.reloc
Size: 32KB - Virtual size: 32KB