FirewallAPI.pdb
Static task
static1
Behavioral task
behavioral1
Sample
FirewallAPI.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
FirewallAPI.dll
Resource
win10v2004-20240508-en
General
-
Target
FirewallAPI.dll
-
Size
503KB
-
MD5
fca25104e526b1783f0366ff3b4e4445
-
SHA1
c6931a7349bddfb4996cfaff571dacbdc67f2783
-
SHA256
1156027076b432f8be84d56a2739dc4957837f10e8756b2d37be5ef870430be4
-
SHA512
0f8bcb12bc277cbc88b5a1a3eaca437be1429a9280b95e77c616655010d7caae00f44b5cd17e14ed9f81cf9112470c570f9e217e4d13f7feeba9ab32cf9d818e
-
SSDEEP
12288:2XMjrmEN+x/tC2rTOI4ReYNQAZh3kGo5n9/9EkEJ9c:2XI1+xlvTOI4UYNlh3kGo5nV9EkEJy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource FirewallAPI.dll
Files
-
FirewallAPI.dll.dll regsvr32 windows:6 windows x86 arch:x86
5fec608235b9f1ad74b252d183c724b1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
towupper
iswalpha
wcspbrk
memmove
wcsncmp
wcschr
wcstoul
_XcptFilter
_amsg_exit
_ultow
_wcsnicmp
qsort
wcstok
_wcsicmp
_vsnwprintf
_initterm
?terminate@@YAXXZ
_purecall
??1type_info@@UAE@XZ
_except_handler4_common
??_V@YAXPAX@Z
??_U@YAPAXI@Z
wcscpy_s
??2@YAPAXI@Z
realloc
wcscat_s
malloc
free
??3@YAXPAX@Z
memcpy
memcmp
__CxxFrameHandler3
_CxxThrowException
iswdigit
memset
ntdll
EtwEventWrite
RtlIpv6AddressToStringW
RtlIpv4AddressToStringW
RtlCopySid
RtlLengthSid
RtlNtStatusToDosError
NtQueryObject
NtClose
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
RtlInitUnicodeString
RtlIpv6StringToAddressW
RtlIpv4StringToAddressW
EtwTraceMessage
EtwEventUnregister
EtwEventRegister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
rpcrt4
UuidCreate
RpcStringFreeW
UuidToStringW
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
NdrStubCall2
NdrOleAllocate
NdrStubForwardingFunction
NdrOleFree
IUnknown_QueryInterface_Proxy
NdrDllUnregisterProxy
NdrDllGetClassObject
NdrCStdStubBuffer2_Release
NdrDllCanUnloadNow
NdrDllRegisterProxy
RpcBindingFree
NdrAsyncClientCall
NdrClientCall2
RpcAsyncCancelCall
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcEpResolveBinding
RpcAsyncCompleteCall
RpcBindingSetAuthInfoExW
RpcBindingSetOption
RpcAsyncInitializeHandle
api-ms-win-core-synch-l1-2-0
CreateEventW
Sleep
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
SetEvent
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
GetProcAddress
LoadLibraryExW
FreeLibrary
FindResourceExW
SizeofResource
GetModuleFileNameW
DisableThreadLibraryCalls
LoadResource
GetModuleHandleW
api-ms-win-core-string-l2-1-0
CharNextW
CharPrevW
api-ms-win-core-errorhandling-l1-1-1
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegEnumKeyExW
RegNotifyChangeKeyValue
RegSetValueExW
RegQueryInfoKeyW
RegCreateKeyExW
RegDeleteValueW
RegDeleteTreeW
RegCloseKey
RegEnumValueW
RegOpenCurrentUser
RegSaveKeyExW
RegRestoreKeyW
RegQueryValueExW
api-ms-win-core-sysinfo-l1-2-1
GetSystemTimeAsFileTime
GetComputerNameExW
GetVersionExW
GetTickCount
GetSystemInfo
api-ms-win-core-memory-l1-1-2
VirtualQuery
VirtualProtect
VirtualAlloc
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringW
MultiByteToWideChar
CompareStringOrdinal
api-ms-win-core-heap-l1-2-0
HeapFree
HeapDestroy
GetProcessHeap
HeapAlloc
api-ms-win-security-base-l1-2-0
IsValidSecurityDescriptor
GetSecurityDescriptorDacl
GetAce
DuplicateTokenEx
FreeSid
AdjustTokenPrivileges
AllocateAndInitializeSid
CreateWellKnownSid
RevertToSelf
GetTokenInformation
CheckTokenMembership
AccessCheck
CheckTokenCapability
api-ms-win-core-version-l1-1-0
GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW
api-ms-win-core-localization-l1-2-1
GetThreadUILanguage
GetSystemDefaultLangID
FormatMessageW
api-ms-win-core-processthreads-l1-1-2
GetCurrentThreadId
OpenProcessToken
OpenThreadToken
TerminateProcess
GetCurrentProcessId
SetThreadToken
GetCurrentThread
GetCurrentProcess
api-ms-win-core-processenvironment-l1-2-0
ExpandEnvironmentStringsW
api-ms-win-core-file-l1-2-1
CreateFileW
GetLongPathNameW
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
api-ms-win-core-debug-l1-1-1
IsDebuggerPresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-shlwapi-legacy-l1-1-0
PathCanonicalizeW
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
UnregisterWaitEx
api-ms-win-core-threadpool-private-l1-1-0
RegisterWaitForSingleObjectEx
api-ms-win-core-string-obsolete-l1-1-0
lstrcpynW
lstrcmpiW
api-ms-win-core-heap-obsolete-l1-1-0
LocalAlloc
LocalFree
api-ms-win-core-shlwapi-obsolete-l1-1-0
SHLoadIndirectString
combase
ord15
ord18
ord19
ord34
ord14
ord24
ord22
ord7
ord16
ord25
ord11
ord33
ord13
ord35
ord21
ord17
ord32
ord10
ord12
ord9
ord6
ord8
ord23
ord20
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
DelayLoadFailureHook
Exports
Exports
CalculateOpenPortOrAuthAppAddrStringSize
CreateDefaultPerInterfaceIcmpRule
CreateDefaultPerInterfaceOpenPortRule
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
FWAddAuthenticationSet
FWAddConnectionSecurityRule
FWAddCryptoSet
FWAddFirewallRule
FWAddMainModeRule
FWChangeNotificationCreate
FWChangeNotificationDestroy
FWChangeTransactionalState
FWClosePolicyStore
FWCopyAuthenticationSet
FWCopyConnectionSecurityRule
FWCopyCryptoSet
FWCopyFirewallRule
FWDeleteAllAuthenticationSets
FWDeleteAllConnectionSecurityRules
FWDeleteAllCryptoSets
FWDeleteAllFirewallRules
FWDeleteAllMainModeRules
FWDeleteAuthenticationSet
FWDeleteConnectionSecurityRule
FWDeleteCryptoSet
FWDeleteFirewallRule
FWDeleteMainModeRule
FWDeletePhase1SAs
FWDeletePhase2SAs
FWDiagGetAppList
FWEnumAdapters
FWEnumAuthenticationSets
FWEnumConnectionSecurityRules
FWEnumCryptoSets
FWEnumFirewallRules
FWEnumMainModeRules
FWEnumNetworks
FWEnumPhase1SAs
FWEnumPhase2SAs
FWEnumProducts
FWExportPolicy
FWFreeAdapters
FWFreeAuthenticationSet
FWFreeAuthenticationSets
FWFreeAuthenticationSetsByHandle
FWFreeConnectionSecurityRule
FWFreeConnectionSecurityRules
FWFreeConnectionSecurityRulesByHandle
FWFreeCryptoSet
FWFreeCryptoSets
FWFreeCryptoSetsByHandle
FWFreeDiagAppList
FWFreeFirewallRule
FWFreeFirewallRules
FWFreeFirewallRulesByHandle
FWFreeFirewallRulesOld
FWFreeMainModeRule
FWFreeMainModeRules
FWFreeMainModeRulesByHandle
FWFreeNetworks
FWFreePhase1SAs
FWFreePhase2SAs
FWFreeProducts
FWGPLock
FWGPUnlock
FWGetConfig
FWGetConfig2
FWGetGlobalConfig
FWGetGlobalConfig2
FWGetGlobalConfig3
FWGetIndicatedPortInUse
FWImportPolicy
FWIndicatePortInUse
FWIndicateProxyForUrl
FWIndicateProxyResolverRefresh
FWIndicateTupleInUse
FWIsTargetAProxy
FWOpenPolicyStore
FWQueryAuthenticationSets
FWQueryConnectionSecurityRules
FWQueryCryptoSets
FWQueryFirewallRules
FWQueryIsolationType
FWQueryMainModeRules
FWRegisterProduct
FWResetIndicatedPortInUse
FWResetIndicatedTupleInUse
FWResolveGPONames
FWRestoreDefaults
FWRestoreGPODefaults
FWRevertTransaction
FWSelectConSecRule
FWSetAuthenticationSet
FWSetConfig
FWSetConnectionSecurityRule
FWSetCryptoSet
FWSetFirewallRule
FWSetGPHelperFnPtrs
FWSetGlobalConfig
FWSetGlobalConfig2
FWSetMainModeRule
FWStatusMessageFromStatusCode
FWUnregisterProduct
FWVerifyAuthenticationSet
FWVerifyAuthenticationSetQuery
FWVerifyConnectionSecurityRule
FWVerifyConnectionSecurityRuleQuery
FWVerifyCryptoSet
FWVerifyCryptoSetQuery
FWVerifyFirewallRule
FWVerifyFirewallRuleQuery
FWVerifyMainModeRule
FWVerifyMainModeRuleQuery
FreeAbsoluteInterfaces
FwActivate
FwAddRule
FwAddSet
FwAddrChangeSourceInitialize
FwAddrChangeSourceShutdown
FwAddrChangeSourceSignal
FwAdvPolicyDecodeFirewallRule
FwAdvPolicyEncodeRule
FwAlloc
FwAllocCheckSize
FwAnalyzeFirewallPolicy
FwAnalyzeFirewallPolicyOnProfile
FwAppContainerChangeFree
FwAreAllContainedInAddresses
FwBinariesFree
FwBstrToPorts
FwCSRuleEmpty
FwCSRuleVerify
FwCanonizeAuthorizedApps
FwChangeSourceInitialize
FwChangeSourceShutdown
FwChangeSourceSignal
FwChangeSourceSignalStart
FwChkBuildSidAndAttributesFree
FwClosePolicyStore
FwConvertIPv6SubNetToRange
FwCopyAuthSet
FwCopyAuthSetListToLowerVersion
FwCopyAuthsetToHigherVersion
FwCopyCSRule
FwCopyCryptoSet
FwCopyICMPTypeCode
FwCopyInterfaceLuids
FwCopyLUID
FwCopyMMRule
FwCopyMainModeRule
FwCopyPlatform
FwCopyPortRange
FwCopyPortsContents
FwCopyRule
FwCopyWFAddressesContents
FwCreateLocalTempStore
FwDeleteAllRules
FwDeleteAllSets
FwDeleteRule
FwDeleteSet
FwDestroyLocalTempStore
FwDoNothingOnObject
FwEmptyWFAddresses
FwEmptyWFRule
FwEnableMemTracing
FwEnumRules
FwEnumSets
FwFree
FwFreeAddresses
FwFreeRules
FwFreeSets
FwFreeWFRule
FwGetAddressesAsString
FwGetAppBlockList
FwGetConfig
FwGetCurrentProfile
FwGetGlobalConfig
FwGetGlobalConfigFromLocalTempStore
FwGetRule
FwGetVersionField
FwICFProfileToWfProfile
FwICFProtocolToWfProtocol
FwIPV4RangeContainsMulticast
FwIPV6RangeContainsMulticast
FwImageListDestroy
FwImageListHasImage
FwIsGroupPolicyEnforced
FwIsRemoteManagementEnabled
FwIsV6AddrLoopback
FwMMRuleVerify
FwMergeAddresses
FwMigrateLegacyAuthenticatedBypassSddl
FwMigrateLegacySettings
FwNegateAddresses
FwOpenAppCDbPolicyStore
FwOpenPolicyStore
FwParseAddressToken
FwPortsToString
FwReduceObjectsToVersion
FwRemoveDuplicateAddresses
FwResolveIndirectString
FwRuleResolveFlags
FwSddlStringVerify
FwSetConfig
FwSetGlobalConfig
FwSetMemLeakPolicy
FwSetResolveFlags
FwSetRule
FwSetSet
FwSidAndAttributesCopy
FwSidAndAttributesFree
FwSidCopy
FwSidsToString
FwStringToAddresses
FwStringToSids
FwSubtractAddresses
FwUniteWFAddressesContents
FwVerifyNoHeapLeaks
FwVerifyWFRuleSemantics
FwWfProtocolToICFProtocol
GetDisabledInterfaces
GetOpenPortOrAuthAppAddrScope
IcfAddrChangeNotificationCreate
IcfChangeNotificationCreate
IcfChangeNotificationDestroy
IcfConnect
IcfDisconnect
IcfFreeDynamicFwPorts
IcfFreeProfile
IcfFreeTickets
IcfGetCurrentProfileType
IcfGetDynamicFwPorts
IcfGetOperationalMode
IcfGetProfile
IcfGetTickets
IcfIsPortAllowed
IcfOpenDynamicFwPortWithoutSocket
IcfSubNetsGetScope
IsAddressesEmpty
IsEqualAddresses
IsFirewallInCoExistanceMode
IsPortOrICMPAllowed
IsPortsEmpty
IsRuleOldAuthApp
IsRuleOldGlobalOpenPort
IsRuleOpenPortOrAuthApp
IsRulePerInterfaceIcmp
IsRulePerInterfaceOpenPort
IsUnicastExplicitAddressesEmpty
Isv4Orv6AddressesEmpty
LoadGPExtensionDll
MakeAbsoluteInterfaces
NetworkIsolationCreateAppContainer
NetworkIsolationDeleteAppContainer
NetworkIsolationDiagnoseConnectFailure
NetworkIsolationDiagnoseConnectFailureAndGetInfo
NetworkIsolationDiagnoseListen
NetworkIsolationDiagnoseSocketCreation
NetworkIsolationEnumAppContainers
NetworkIsolationEnumerateAppContainerRules
NetworkIsolationFreeAppContainers
NetworkIsolationGetAppContainerConfig
NetworkIsolationRegisterForAppContainerChanges
NetworkIsolationSetAppContainerConfig
NetworkIsolationSetupAppContainerBinaries
NetworkIsolationUnregisterForAppContainerChanges
OpenPortOrAuthAppAddrToString
ValidatePortOrAppAddressString
Sections
.text Size: 429KB - Virtual size: 429KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 512B - Virtual size: 362B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ