dot3api[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

dot3api.dll
Size

91KB
MD5

ee9cdc641e681f71ba2dbf0c23a394cd
SHA1

e2cf75d39c575206bc642982d6257a01262e9010
SHA256

e6720a980da769be648c5bf70280eeb1b405cd6e034ca912283302cca54f35d2
SHA512

b53b0649e8e2f22a8cc71d39e55166a4310de1a91b61d23c600e23de8739cbe228bdd782471581088af559b109d4818fb31617b6a35f8b743b02e04dd40d3570
SSDEEP

1536:RjlrUukKri7Ran/FS8YTw7iQGYFYqqhvNNN3RH5PrPH:DkKriIngN02aehvNNN3RZPrPH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dot3api.dll

Files

dot3api.dll
.dll windows:6 windows x64 arch:x64

99afa4d98ca1938379149bd87fc05d44

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dot3api.pdb

Imports

msvcrt

memcmp
memcpy
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_CxxThrowException
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
malloc
free
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
memcpy_s
??0exception@@QEAA@AEBV0@@Z
_endthreadex
_beginthreadex
memset

atl

ord21
ord16
ord32

ntdll

RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
CreateThread
TerminateProcess

rpcrt4

NdrClientCall3
Ndr64AsyncClientCall
RpcAsyncCompleteCall
RpcExceptionFilter
RpcAsyncInitializeHandle
RpcSsDestroyClientContext
RpcBindingFree
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcEpResolveBinding
RpcBindingSetOption
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcAsyncCancelCall
RpcMgmtInqServerPrincNameW

eappcfg

EapHostPeerFreeErrorMemory
EapHostPeerFreeMemory
EapHostPeerCredentialsXml2Blob
EapHostPeerConfigXml2Blob

kernel32

EnterCriticalSection
LeaveCriticalSection
SetEvent
CloseHandle
ProcessIdToSessionId
WaitForSingleObjectEx
GetSystemWindowsDirectoryW
SetLastError
lstrcmpW
RaiseException
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
WaitForSingleObject
CompareFileTime
HeapFree
GetSystemTimeAsFileTime
QueryPerformanceCounter
Sleep
WaitForMultipleObjects
OutputDebugStringA
ResolveDelayLoadedAPI
DelayLoadFailureHook
GetTickCount
CreateEventW
InitializeCriticalSection
DeleteCriticalSection
HeapAlloc
GetProcessHeap

api-ms-win-security-base-l1-2-0

CreateWellKnownSid

Exports

Exports

Dot3CancelPlap
Dot3CloseHandle
Dot3DeinitPlapParams
Dot3DeleteProfile
Dot3DoPlap
Dot3EnumInterfaces
Dot3FreeMemory
Dot3GetCurrentProfile
Dot3GetInterfaceState
Dot3GetProfile
Dot3GetProfileEapUserDataInfo
Dot3InitPlapParams
Dot3OpenHandle
Dot3QueryAutoConfigParameter
Dot3QueryPlapCredentials
Dot3QueryUIRequest
Dot3ReConnect
Dot3ReasonCodeToString
Dot3RegisterNotification
Dot3SetAutoConfigParameter
Dot3SetInterface
Dot3SetProfile
Dot3SetProfileEapUserData
Dot3SetProfileEapXmlUserData
Dot3UIResponse
QueryNetconStatus

Sections

.text
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

99afa4d98ca1938379149bd87fc05d44

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

atl

ntdll

api-ms-win-core-processthreads-l1-1-2

rpcrt4

eappcfg

kernel32

api-ms-win-security-base-l1-2-0

Exports

Exports

Sections

.text Size: 76KB - Virtual size: 76KB

.data Size: 3KB - Virtual size: 2KB

.pdata Size: 3KB - Virtual size: 2KB

.idata Size: 4KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 200B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 612B

.text
Size: 76KB - Virtual size: 76KB

.data
Size: 3KB - Virtual size: 2KB

.pdata
Size: 3KB - Virtual size: 2KB

.idata
Size: 4KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 200B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 612B