Windows[.]Networking[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

Windows.Networking.dll
Size

422KB
MD5

5411faec401f5764ae39cb3d9a23414f
SHA1

98272f9b73ebc71b26a85bede3fff06c89bc8175
SHA256

28742d52aeba70abf68709e066d143def744390aa710aed67c45220bf492c7d7
SHA512

4971d42e04fd3b680f30c975cf5da7e557a666a9182a0a80f08a0de3b2e764d8bfd7cff7997d7cd05de7e5627c9a1aa01439047c16293cb0340da805a24b3fc2
SSDEEP

12288:nkq3l3Lxhej+GNWiboUX42MdJ6un52EKgCMh9Kt:nkq3l3Lxhej+GNWiboUI2Mj6OZNLh9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Windows.Networking.dll

Files

Windows.Networking.dll
.dll regsvr32 windows:6 windows x86 arch:x86

41af31b98585c91feffab43b5e4941c6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Windows.Networking.pdb

Imports

msvcrt

free
_vsnwprintf
_wtoi
_wcsicmp
_XcptFilter
memcmp
memcpy
??3@YAXPAX@Z
_amsg_exit
_initterm
__CxxFrameHandler3
_except_handler4_common
_onexit
malloc
__dllonexit
memmove_s
_ultow_s
_purecall
??2@YAPAXI@Z
_lock
realloc
_unlock
memset

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull
WindowsGetStringLen
HSTRING_UserUnmarshal
WindowsCreateStringReference
WindowsCreateString
WindowsSubstring
HSTRING_UserFree
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCompareStringOrdinal
WindowsConcatString
HSTRING_UserMarshal
HSTRING_UserSize
WindowsDuplicateString

api-ms-win-core-winrt-error-l1-1-1

IsErrorPropagationEnabled
RoTransformError
RoOriginateErrorW
GetRestrictedErrorInfo
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
RoOriginateError
SetRestrictedErrorInfo

api-ms-win-core-com-l1-1-1

CoCreateFreeThreadedMarshaler
CreateStreamOnHGlobal
CoMarshalInterface
RoGetAgileReference
CoCopyProxy
CoGetApartmentType
CLSIDFromString
CoGetCallerTID
CoDecrementMTAUsage
CoSetProxyBlanket
CoTaskMemFree
CoIncrementMTAUsage
CoReleaseMarshalData
CoTaskMemAlloc
CoCreateInstance

api-ms-win-core-synch-l1-2-0

InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
InitializeConditionVariable
SleepConditionVariableCS
InitOnceExecuteOnce
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
CreateEventW
SetEvent
WakeAllConditionVariable
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeSRWLock
AcquireSRWLockExclusive

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
TlsFree
GetCurrentProcess
TlsAlloc
OpenThreadToken
SetThreadToken
GetCurrentThread
OpenProcessToken
OpenProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-security-base-l1-2-0

RevertToSelf
CheckTokenCapability
GetTokenInformation
DuplicateTokenEx

api-ms-win-core-errorhandling-l1-1-1

RaiseException
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-devices-config-l1-1-1

CM_Register_Notification
CM_MapCrToWin32Err
CM_Unregister_Notification

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoActivateInstance
RoInitialize
RoGetActivationFactory

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapFree

api-ms-win-core-io-l1-1-1

CancelIoEx
GetOverlappedResultEx

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolIo
CallbackMayRunLong
CloseThreadpoolCleanupGroup
FreeLibraryWhenCallbackReturns
WaitForThreadpoolTimerCallbacks
CloseThreadpoolWait
CreateThreadpoolCleanupGroup
TrySubmitThreadpoolCallback
CreateThreadpoolTimer
CloseThreadpoolIo
StartThreadpoolIo
SetThreadpoolWait
SetThreadpoolTimer
CreateThreadpoolWait
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolWork
CancelThreadpoolIo
CreateThreadpoolWork

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
DisableThreadLibraryCalls
LoadStringW
GetModuleHandleW
FreeLibrary

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWrite

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal
WideCharToMultiByte

rpcrt4

NdrDllUnregisterProxy
NdrDllGetClassObject
NdrCStdStubBuffer2_Release
NdrDllCanUnloadNow
NdrDllRegisterProxy
NdrCStdStubBuffer_Release
IUnknown_QueryInterface_Proxy
NdrStubCall2
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
CStdStubBuffer_AddRef
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
NdrOleFree
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
NdrStubForwardingFunction

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetSystemDirectoryW
GetTickCount64
GetTickCount

api-ms-win-core-psm-app-l1-1-0

PsmUnregisterAppStateChangeNotification
PsmRegisterAppStateChangeNotification
PsmQueryCurrentAppState

ntdll

toupper
RtlDowncaseUnicodeChar
tolower
RtlCompareUnicodeStrings
RtlIpv6AddressToStringW
_wcsnicmp
memmove
RtlAllocateHeap
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwGetTraceLoggerHandle
RtlFreeHeap
_itow_s
WinSqmIncrementDWORD
WinSqmIsOptedIn
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExW

combase

ord5
ord10
ord32
ord6
ord9
ord8
ord34
ord13
ord16
ord14
ord2
ord15
ord33
ord11
ord12
ord7

firewallapi

NetworkIsolationDiagnoseSocketCreation
NetworkIsolationDiagnoseListen

api-ms-win-core-localization-l1-2-1

FormatMessageW
GetCPInfoExW
IdnToAscii
IdnToUnicode

api-ms-win-core-processenvironment-l1-2-0

GetEnvironmentVariableA

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

api-ms-win-core-interlocked-l1-2-0

InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
SetSocketMediaStreamingMode

Sections

.text
Size: 340KB - Virtual size: 340KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 1024B - Virtual size: 802B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

minATL
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

41af31b98585c91feffab43b5e4941c6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-security-base-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-string-l1-1-0

rpcrt4

api-ms-win-core-util-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-psm-app-l1-1-0

ntdll

combase

firewallapi

api-ms-win-core-localization-l1-2-1

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-interlocked-l1-2-0

Exports

Exports

Sections

.text Size: 340KB - Virtual size: 340KB

.orpc Size: 1024B - Virtual size: 802B

.data Size: 3KB - Virtual size: 33KB

.idata Size: 8KB - Virtual size: 7KB

minATL Size: 512B - Virtual size: 44B

.rsrc Size: 23KB - Virtual size: 23KB

.reloc Size: 44KB - Virtual size: 44KB

.text
Size: 340KB - Virtual size: 340KB

.orpc
Size: 1024B - Virtual size: 802B

.data
Size: 3KB - Virtual size: 33KB

.idata
Size: 8KB - Virtual size: 7KB

minATL
Size: 512B - Virtual size: 44B

.rsrc
Size: 23KB - Virtual size: 23KB

.reloc
Size: 44KB - Virtual size: 44KB