Windows[.]Networking[.]BackgroundTransfer[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
Windows.Networking.BackgroundTransfer.dll
Size 399KB
Sample240527-nvs5sabb24
SHA256 9225bc7009a455e0506f32bff1f987198bdb5db25fecac5263122947e0a32bc8
MD5 d180d4667a385761f1f47401cd097854
SHA1 b469e21f3dd09ad458af6117fc0e72c7e2c3da93
SHA512 bbecbfca381e5dbf1882bc2c990da9c4239cd11812748ff7655b642181ba2199c7fe3defbb0b2d3916bb8bf1e328c98439dc3867711ad3f127fb8fed73cadd8b
SSDEEP 6144:qds4qOZN3FfN6K4T/uESM5ghMYvA2cRsmYa:qd7qg5+LbyhPvA2EsmYa
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Windows.Networking.BackgroundTransfer.dll

File Explorer

Windows.Networking.BackgroundTransfer.dll

.dll 399KB

Windows.Networking.BackgroundTransfer.dll

IMPHASH 4367926df4c0726dad8b4301f0bad2ca
SHA256 9225bc7009a455e0506f32bff1f987198bdb5db25fecac5263122947e0a32bc8
MD5 d180d4667a385761f1f47401cd097854
SHA1 b469e21f3dd09ad458af6117fc0e72c7e2c3da93
SHA512 bbecbfca381e5dbf1882bc2c990da9c4239cd11812748ff7655b642181ba2199c7fe3defbb0b2d3916bb8bf1e328c98439dc3867711ad3f127fb8fed73cadd8b
SSDEEP 6144:qds4qOZN3FfN6K4T/uESM5ghMYvA2cRsmYa:qd7qg5+LbyhPvA2EsmYa
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

87193

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Windows.Networking.BackgroundTransfer.pdb

msvcrt

_onexit ??3@YAXPAX@Z _unlock _lock _initterm __CxxFrameHandler3 _amsg_exit _XcptFilter realloc free malloc _except_handler4_common memmove_s _wcsicmp _ui64tow_s memcpy memcmp _ftol2 _wcstoui64 wcsstr _purecall _itow_s _vsnwprintf ??2@YAPAXI@Z __dllonexit memset

ntdll

RtlNtStatusToDosError WinSqmAddToStreamEx RtlInitUnicodeString

api-ms-win-core-file-l1-2-1

GetTempPathW CreateDirectoryW DeleteFileW ReadFile SetFilePointer CompareFileTime WriteFile GetFileSizeEx FindClose FindFirstFileW FindNextFileW CreateFileW

api-ms-win-core-errorhandling-l1-1-1

GetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter RaiseException

api-ms-win-core-handle-l1-1-0

CloseHandle

rpcrt4

CStdStubBuffer_DebugServerRelease CStdStubBuffer_AddRef CStdStubBuffer_DebugServerQueryInterface UuidCreate NdrClientCall2 RpcBindingFree RpcBindingSetAuthInfoExW IUnknown_Release_Proxy RpcStringBindingComposeW RpcBindingFromStringBindingW UuidFromStringW IUnknown_AddRef_Proxy CStdStubBuffer_CountRefs NdrStubCall2 NdrOleAllocate NdrStubForwardingFunction NdrCStdStubBuffer_Release CStdStubBuffer_Disconnect CStdStubBuffer_IsIIDSupported NdrDllRegisterProxy NdrDllCanUnloadNow NdrCStdStubBuffer2_Release NdrDllGetClassObject CStdStubBuffer_Invoke NdrDllUnregisterProxy NdrOleFree CStdStubBuffer_Connect UuidFromStringA RpcStringFreeW UuidToStringW IUnknown_QueryInterface_Proxy CStdStubBuffer_QueryInterface

api-ms-win-core-synch-l1-2-0

SetEvent CreateEventW InitializeSRWLock CreateMutexW ReleaseSRWLockExclusive AcquireSRWLockShared WaitForSingleObject ReleaseSRWLockShared InitializeCriticalSection DeleteCriticalSection EnterCriticalSection AcquireSRWLockExclusive LeaveCriticalSection InitOnceExecuteOnce WaitForMultipleObjectsEx Sleep WaitForSingleObjectEx ReleaseMutex

api-ms-win-core-file-l2-1-1

MoveFileExW

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId TerminateProcess GetCurrentThread GetCurrentProcessId GetCurrentProcess OpenProcessToken OpenProcess OpenThreadToken GetProcessId

api-ms-win-security-base-l1-2-0

ImpersonateSelf RevertToSelf AllocateAndInitializeSid GetTokenInformation FreeSid

api-ms-win-core-heap-l1-2-0

HeapAlloc GetProcessHeap HeapFree

api-ms-win-eventing-provider-l1-1-0

EventUnregister EventWrite EventRegister

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimePreciseAsFileTime GetTickCount64 GetTickCount GetSystemTimeAsFileTime

api-ms-win-core-string-l1-1-0

MultiByteToWideChar CompareStringOrdinal WideCharToMultiByte

api-ms-win-core-threadpool-l1-2-0

TrySubmitThreadpoolCallback FreeLibraryWhenCallbackReturns CloseThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CallbackMayRunLong SetThreadpoolWait

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary GetModuleHandleExW DisableThreadLibraryCalls LoadStringW

api-ms-win-core-registry-l1-1-0

RegCloseKey RegGetValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegOpenKeyExW

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc LocalFree

combase

ord13 ord11 ord90 ord33 ord8 ord34 ord5 ord32 ord2 ord9 ord12 ord10 ord6 ord36 ord14 ord7 ord16 ord15

systemeventsbrokerclient

SebDeleteEvent SebRegisterWellKnownEvent SebSignalBackgroundDownloadEvent SebCreateUnconstrainedBackgroundDownloadEvent SebCreateBackgroundDownloadEvent

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI DelayLoadFailureHook

Name

.text

Size

332KB

Virtual Size

332KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

1024B

Virtual Size

930B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

minATL

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Windows.Networking.BackgroundTransfer.dll

msvcrt

ntdll

api-ms-win-core-file-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

rpcrt4

api-ms-win-core-synch-l1-2-0

api-ms-win-core-file-l2-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-security-base-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

combase

systemeventsbrokerclient

api-ms-win-core-localization-l1-2-1

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

generic