Windows[.]Networking[.]HostName[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

Windows.Networking.HostName.dll
Size

95KB
MD5

28983caf97d72d3058e83b49fad3841c
SHA1

0109d83cec668fef7fef294e843d541938ef128b
SHA256

3def4c30b5ef3bcf46685e2d94062e3b4df8e1bdbac49350d3f9339997027d1f
SHA512

72f5ca672351db8f2f384f333b584f495089b2bedc2baf382c068d926bbc9a37ba75567490437751f84a1db85ae72c0855b5b203f05fdcb906b533ba1e1544e6
SSDEEP

1536:XS69sBJ+tGTk8jticOJadEt5nU4U6S8COMJEoZxX3cS3msvn3BqsZG5wIM:WSgdMn3ZS8COMXxX3cdsvn3BRZG5tM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Windows.Networking.HostName.dll

Files

Windows.Networking.HostName.dll
.dll regsvr32 windows:6 windows x86 arch:x86

bdfc9028dbb697c4693220bd1f2558ee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Windows.Networking.HostName.pdb

Imports

msvcrt

free
_purecall
realloc
towlower
_XcptFilter
malloc
_amsg_exit
_initterm
_lock
_unlock
__dllonexit
memmove_s
_onexit
_except_handler4_common
_vsnwprintf
memcmp
??3@YAXPAX@Z
_wtoi
??2@YAPAXI@Z
__CxxFrameHandler3
memset

combase

ord32
ord6
ord10
ord14
ord5
ord12
ord7
ord8
ord16
ord33
ord13
ord2
ord9
ord15
ord34
ord11

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
HSTRING_UserFree
WindowsGetStringLen
WindowsDeleteString
WindowsDuplicateString
WindowsCompareStringOrdinal
HSTRING_UserMarshal
WindowsCreateStringReference
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsGetStringRawBuffer
HSTRING_UserUnmarshal
HSTRING_UserSize

api-ms-win-core-winrt-error-l1-1-1

RoTransformError
RoOriginateErrorW
RoOriginateError

api-ms-win-core-synch-l1-2-0

ReleaseSRWLockShared
AcquireSRWLockShared
Sleep
InitOnceExecuteOnce
AcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockExclusive

api-ms-win-core-com-l1-1-1

CoCreateFreeThreadedMarshaler
CoCreateInstance
RoGetAgileReference
CoTaskMemAlloc

api-ms-win-core-localization-l1-2-1

IdnToUnicode
IdnToAscii

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime
GetComputerNameExW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-registry-l1-1-0

RegGetValueW

rpcrt4

NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrDllRegisterProxy
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
CStdStubBuffer_Connect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
IUnknown_AddRef_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerQueryInterface
IUnknown_Release_Proxy
NdrStubCall2
CStdStubBuffer_CountRefs
NdrOleAllocate
NdrStubForwardingFunction
NdrOleFree
IUnknown_QueryInterface_Proxy
CStdStubBuffer_AddRef
NdrDllUnregisterProxy

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess

ntdll

RtlIpv4AddressToStringW
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExW
RtlIpv6AddressToStringExW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Exports

Exports

CreateEndpointPairFromSockAddrs
CreateHostNameFromSockAddr
CreateHostNameFromString
CreateNetworkAdapterFromGuid
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetAllHostNames
GetSortedEndpointPairs

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 1024B - Virtual size: 523B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

minATL
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bdfc9028dbb697c4693220bd1f2558ee

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

combase

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-localization-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-registry-l1-1-0

rpcrt4

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

ntdll

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 72KB - Virtual size: 71KB

.orpc Size: 1024B - Virtual size: 523B

.data Size: 4KB - Virtual size: 5KB

.idata Size: 4KB - Virtual size: 3KB

minATL Size: 512B - Virtual size: 20B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 72KB - Virtual size: 71KB

.orpc
Size: 1024B - Virtual size: 523B

.data
Size: 4KB - Virtual size: 5KB

.idata
Size: 4KB - Virtual size: 3KB

minATL
Size: 512B - Virtual size: 20B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 11KB - Virtual size: 11KB