dhcpcore6[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

dhcpcore6.dll
Size

263KB
MD5

22673b767e78380932f15a4ebfb79b94
SHA1

d88a195fe95c3b161f54f2260f97e1cc6bd11e79
SHA256

359d33cb4af2303e3ecddc97d26dabb65282bf593b9aae5f0aacc7add871e0d6
SHA512

2c6b6333cffc203b9c62e2927917d2b707c79f7ffc8c8003702daba85fe048a7eb9eef7c62e5f012e83756abf51e6aa4b496f9cf91f1e90554f0482175e6257d
SSDEEP

6144:FWtw61zRjIP3J1df9A0NAQzxHXsQ1X4zV0:c31ze3Bf9A0NAQzxcQRu+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dhcpcore6.dll

Files

dhcpcore6.dll
.dll windows:6 windows x64 arch:x64

ad483b31c7023689773d061d11217e0c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dhcpcore6.pdb

Imports

api-ms-win-core-crt-l1-1-0

__C_specific_handler
_local_unwind
memcmp
memcpy
memset
wcsrchr
wcschr
_vsnprintf_s
_wcsicmp
_vsnwprintf_s

api-ms-win-core-crt-l2-1-0

time
_initterm_e
_initterm

ntdll

RtlIpv6AddressToStringW
EtwEventWrite
RtlInitUnicodeString
EtwEventRegister
EtwEventUnregister
EtwEventActivityIdControl
RtlAddAce
RtlCreateAcl
RtlSetDaclSecurityDescriptor
RtlDeleteSecurityObject
RtlCopySid
RtlNewSecurityObject
RtlSetGroupSecurityDescriptor
RtlSetSaclSecurityDescriptor
NtClose
NtOpenProcessToken
RtlLengthSid
RtlCreateSecurityDescriptor
RtlSetOwnerSecurityDescriptor
EtwUnregisterTraceGuids
NlsMbOemCodePageTag
RtlxUnicodeStringToOemSize
RtlUnicodeStringToOemString
RtlInitString
RtlOemStringToUnicodeString
RtlxOemStringToUnicodeSize
RtlGUIDFromString
RtlNtStatusToDosError
DbgPrint
RtlRandomEx
EtwEventWriteTransfer
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
RtlStringFromGUID
RtlFreeUnicodeString
WinSqmAddToStream
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

dnsapi

DnsQueryConfigDword
DnsDhcpRegisterAddrs
DnsNotifyResolver

rpcrt4

RpcServerRegisterIf3
RpcServerInqBindings
RpcEpRegisterW
RpcBindingVectorFree
RpcEpUnregister
I_RpcExceptionFilter
RpcRevertToSelf
RpcImpersonateClient
NdrServerCallAll
RpcServerUnregisterIfEx
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcStringFreeW
NdrServerCall2
RpcServerUseProtseqEpW

ws2_32

WSASetEvent
closesocket
recvfrom
select
sendto
WSAWaitForMultipleEvents
WSAEventSelect
WSACreateEvent
getaddrinfo
freeaddrinfo
WSACloseEvent
WSACleanup
WSAStartup
WSAResetEvent
ntohl
htons
htonl
ntohs
socket
WSAGetLastError
setsockopt
bind
WSAEnumNetworkEvents

cryptbase

SystemFunction036

nsi

NsiGetParameter
NsiGetAllParametersEx
NsiSetAllParametersEx
NsiFreeTable
NsiAllocateAndGetTable

winnsi

NsiDisconnectFromServer
NsiConnectToServer
NsiRpcRegisterChangeNotificationEx
NsiRpcDeregisterChangeNotificationEx

api-ms-win-core-errorhandling-l1-1-1

GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-file-l1-2-1

CreateFileA
CreateFileW
SetFileInformationByHandle

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-io-l1-1-1

DeviceIoControl

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
DisableThreadLibraryCalls
FreeLibrary
GetProcAddress

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegDeleteKeyExW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegGetValueW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree
LocalAlloc

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
CreateThread
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-synch-l1-2-0

SetEvent
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
EnterCriticalSection
LeaveCriticalSection
InitializeSRWLock
CreateWaitableTimerExW
CreateEventW
Sleep
WaitForSingleObject
ReleaseSemaphore
WaitForMultipleObjectsEx
ResetEvent
InitializeCriticalSection
DeleteCriticalSection
SetWaitableTimer
CancelWaitableTimer
CreateSemaphoreExW
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableCS

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetComputerNameExW
GetSystemTime
GetTickCount
GetTickCount64
GetLocalTime

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-security-base-l1-2-0

FreeSid
AllocateAndInitializeSid
AccessCheck

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-rtlsupport-l1-2-0

RtlCompareMemory

api-ms-win-eventing-controller-l1-1-0

ControlTraceW
StartTraceW
EnableTraceEx2

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

Dhcpv6Main

Sections

.text
Size: 206KB - Virtual size: 205KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ad483b31c7023689773d061d11217e0c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-crt-l1-1-0

api-ms-win-core-crt-l2-1-0

ntdll

dnsapi

rpcrt4

ws2_32

cryptbase

nsi

winnsi

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 206KB - Virtual size: 205KB

.data Size: 9KB - Virtual size: 8KB

.pdata Size: 8KB - Virtual size: 8KB

.idata Size: 8KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 72B

.rsrc Size: 28KB - Virtual size: 28KB

.reloc Size: 1024B - Virtual size: 572B

.text
Size: 206KB - Virtual size: 205KB

.data
Size: 9KB - Virtual size: 8KB

.pdata
Size: 8KB - Virtual size: 8KB

.idata
Size: 8KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 72B

.rsrc
Size: 28KB - Virtual size: 28KB

.reloc
Size: 1024B - Virtual size: 572B