dnsrslvr[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

dnsrslvr.dll
Size

247KB
MD5

1ea4e021c2c91182500231fb13b74e75
SHA1

d18de437dd979d9391d4c2af55f62a57b3d78786
SHA256

33f19081b3bf49f02a1573cf6efbd2d7fd190b4671ae43e2f23b9650fb2d1d4b
SHA512

db145f2b0e8e3c2bc140cbaed3568bcde78a43cc27362ce8097801a4e022a894a0468980ccff4f2813491915ce7855e57ee30a1b42e70f2a05b01d4b7574c293
SSDEEP

6144:qpfekvK3FY2D5KCA7D5GbfXExpzcvVQARHK7WeGn3:qpWkvyFjD5KCA7D8bf0xpzcjQzG3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dnsrslvr.dll

Files

dnsrslvr.dll
.dll windows:6 windows x64 arch:x64

a458e45262f8e917e5288347c4b1a4be

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dnsrslvr.pdb

Imports

api-ms-win-core-crt-l1-1-0

memcmp
memcpy
memset
atoi
wcschr
wcsstr
_wcsicmp
_vsnwprintf_s
_vsnprintf_s
__C_specific_handler
wcscmp

api-ms-win-core-crt-l2-1-0

_initterm
_initterm_e

ntdll

RtlFreeUnicodeString
RtlGUIDFromString
EtwUnregisterTraceGuids
RtlIpv6AddressToStringA
RtlIpv4AddressToStringExW
RtlIpv6AddressToStringExW
RtlStringFromGUID
RtlIdnToUnicode
RtlIdnToAscii
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlInitializeCriticalSection
RtlCreateServiceSid
RtlInitUnicodeString
NtQueryInformationProcess
EtwTraceMessage
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW

ws2_32

WSAEventSelect
WSAGetLastError
closesocket
WSACleanup
WSAStartup
accept
getsockname
WSAResetEvent
WSACreateEvent
WSAIoctl
setsockopt
WSASocketA
inet_ntoa

rpcrt4

RpcServerUnregisterIf
RpcBindingVectorFree
RpcEpUnregister
RpcServerInqBindings
RpcServerRegisterIf3
RpcServerUseProtseqEpW
RpcStringFreeW
RpcStringBindingParseW
RpcBindingToStringBindingW
RpcRevertToSelf
RpcImpersonateClient
RpcServerSubscribeForNotification
RpcServerUnsubscribeForNotification
RpcAsyncCompleteCall
Ndr64AsyncServerCallAll
NdrServerCallAll
NdrAsyncServerCall
NdrServerCall2

dnsapi

Reg_GetValueEx
NetInfo_ResetServerPriorities
NetInfo_CreatePerNetworkNetinfo
NetInfo_UpdateNetworkProperties
NetInfo_Free
Coalesce_UpdateNetVersion
DnsFreePolicyConfig
NetInfo_GetAdapterByName
DnsGetPolicyTableInfoPrivate
DnsGetProxyInfoPrivate
NetInfo_IsAddrConfig
Query_Main
NetInfo_CopyNetworkIndex
Query_Cancel
AddRefQueryBlobEx
DeRefQueryBlobEx
AdaptiveTimeout_ClearInterfaceSpecificConfiguration
HostsFile_Close
HostsFile_ReadLine
HostsFile_Open
GetCurrentTimeInSeconds
DnsNameCompare_W
AdaptiveTimeout_ResetAdaptiveTimeout
Dns_InitializeMsgBuf
Send_MessagePrivate
Dns_AddRecordsToMessage
Dns_SetRecordsTtl
Dns_SetRecordsSection
IpHelp_IsAddrOnLink
Dns_ReadPacketName
Socket_RecvFrom
Dns_RecvTcp
Local_GetRecordsForLocalNameEx
DnsQuery_W
NetInfo_GetAdapterByAddress
Dns_AllocateMsgBuf
Socket_SetTtl
Socket_TcpListen
Socket_SetMulticastLoopBack
Socket_JoinMulticast
Socket_Create
Dns_FreeMsgBuf
Socket_CloseEx
DnsQueryEx
DnsFree
DnsCancelQuery
NetInfo_UpdateDnsInterfaceConfigChange
NetInfo_IsTcpipConfigChange
NetInfo_GetAdapterByInterfaceIndex
DelaySortDAServerlist
Trace_Reset
DnsUpdateMachinePresence
FlushDnsPolicyUnreachableStatus
NetInfo_UpdateServerReachability
NetInfo_Copy
DnsLogEvent
DnsApiFree
DnsApiRealloc
DnsApiAlloc
Dns_CacheServiceInit
Socket_CacheInit
DnsTraceServerConfig
Dns_CacheServiceStopIssued
Socket_CacheCleanup
Dns_CacheServiceCleanup
Reg_ReadGlobalsEx
DnsGlobals
Security_ContextListTimeout
Reg_ReadUpdateInfo
Reg_FreeUpdateInfo
NetInfo_Clean
ExtraInfo_Init
DnsModifyRecordsInSet_W
Update_ReplaceAddressRecordsW
Faz_AreServerListsInSameNameSpace
DnsReplaceRecordSetW
NetInfo_Build

winnsi

NsiConnectToServer
NsiRpcDeregisterChangeNotification
NsiDisconnectFromServer
NsiRpcRegisterChangeNotification

nsi

NsiAllocateAndGetTable
NsiFreeTable
NsiGetParameter
NsiGetAllParameters

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-file-l1-2-1

FlushFileBuffers
FindNextChangeNotification
FindFirstChangeNotificationW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapDestroy
HeapCreate
HeapAlloc
HeapFree

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadLibraryExW
DisableThreadLibraryCalls
FreeLibrary

api-ms-win-core-localization-l1-2-1

LCMapStringW

api-ms-win-core-registry-l1-1-0

RegDeleteKeyExW
RegQueryValueExA
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegNotifyChangeKeyValue
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExA

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree
LocalAlloc

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-2

OpenThreadToken
GetCurrentProcessId
TerminateThread
GetCurrentThreadId
TerminateProcess
GetCurrentThread
GetCurrentProcess
CreateThread

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringW

api-ms-win-core-synch-l1-2-0

ReleaseMutex
ReleaseSRWLockExclusive
WaitForMultipleObjectsEx
InitializeCriticalSection
CreateEventA
ResetEvent
EnterCriticalSection
DeleteCriticalSection
SetEvent
Sleep
CreateEventW
ReleaseSRWLockShared
AcquireSRWLockShared
LeaveCriticalSection
InitializeSRWLock
AcquireSRWLockExclusive
WaitForSingleObject

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount64
GetSystemDirectoryW
GetTickCount
GetLocalTime

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-security-base-l1-2-0

AccessCheck
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
MapGenericMask
IsValidSecurityDescriptor
FreeSid
AllocateAndInitializeSid
GetTokenInformation

api-ms-win-service-core-l1-1-1

RegisterServiceCtrlHandlerExW
SetServiceStatus

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

LoadGPExtension
Reg_DoRegisterAdapter
ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a458e45262f8e917e5288347c4b1a4be

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-crt-l1-1-0

api-ms-win-core-crt-l2-1-0

ntdll

ws2_32

rpcrt4

dnsapi

winnsi

nsi

api-ms-win-core-debug-l1-1-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-service-core-l1-1-1

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 208KB - Virtual size: 207KB

.data Size: 10KB - Virtual size: 10KB

.pdata Size: 13KB - Virtual size: 12KB

.idata Size: 11KB - Virtual size: 10KB

.didat Size: 512B - Virtual size: 104B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 208KB - Virtual size: 207KB

.data
Size: 10KB - Virtual size: 10KB

.pdata
Size: 13KB - Virtual size: 12KB

.idata
Size: 11KB - Virtual size: 10KB

.didat
Size: 512B - Virtual size: 104B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB