dot3svc[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

dot3svc.dll
Size

256KB
MD5

811eacbcc7c51a03ae11f13cc27b2ab6
SHA1

919f29ccf4446f22569f921caa96948af3a9101b
SHA256

fab94f84950ffb7d3649bafb8d96d43b880d7fde8d5b879472ae26c4bc4203b0
SHA512

e75a0a6e7725e5416d9418b14d6e53029a2327857ba68640745ea91386f8ff858d91a5c6f0414985dd129cee2807923491b9f94502d0fa7639ebdf549664605e
SSDEEP

6144:OF7W/+YJktUPQfMlOZWxkSxeYAfSknYWw0hGbi:y7jGkrfMlOZWxkSxeZxBW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dot3svc.dll

Files

dot3svc.dll
.dll windows:6 windows x64 arch:x64

af6aa86b9e970317445dcc0795b75656

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dot3svc.pdb

Imports

msvcrt

wcsstr
memcpy_s
memmove_s
calloc
memset
__CxxFrameHandler3
memcmp
memcpy
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
malloc
free
wcsrchr
_vsnwprintf
swprintf_s
wcscpy_s
wcsncmp
wcscmp

ntdll

NtCreateWnfStateName
RtlPublishWnfStateData
NtQueryWnfStateNameInformation
NtQueryWnfStateData
RtlTestAndPublishWnfStateData
WinSqmAddToStream
NtOpenFile
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlNtStatusToDosError
WinSqmIsOptedIn
EtwEventEnabled
EtwEventWrite
EtwEventUnregister
EtwEventRegister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
NtDeleteWnfStateName

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegDeleteKeyExW
RegQueryValueExW
RegDeleteValueW
RegDeleteTreeW
RegOpenKeyExW
RegEnumKeyExW

api-ms-win-service-core-l1-1-1

RegisterServiceCtrlHandlerExW
SetServiceStatus

api-ms-win-service-management-l1-1-0

OpenSCManagerW
OpenServiceW
CloseServiceHandle

api-ms-win-service-management-l2-1-0

QueryServiceStatusEx

rpcrt4

RpcBindingVectorFree
RpcServerInqCallAttributesW
UuidCreate
RpcImpersonateClient
RpcRevertToSelf
RpcRevertToSelfEx
UuidToStringW
UuidFromStringW
RpcServerUnregisterIfEx
RpcEpUnregister
RpcEpRegisterW
RpcServerRegisterIfEx
RpcServerRegisterAuthInfoW
RpcServerInqDefaultPrincNameW
RpcServerInqBindings
RpcServerUseProtseqW
RpcAsyncCompleteCall
RpcAsyncAbortCall
RpcStringFreeW
RpcStringBindingParseW
RpcBindingToStringBindingW
Ndr64AsyncServerCallAll
NdrServerCallAll
NdrServerCall2
NdrAsyncServerCall

user32

UnregisterClassA
UnregisterDeviceNotification
LoadStringW

dot3msm

Dot3MsmInit
Dot3MsmIndicateSessionChange
Dot3MsmInitAdapter
Dot3SetPortAuthenticationState
Dot3MsmDeInitAdapter
Dot3MsmCreateDefaultProfile
Dot3MsmFreeProfile
Dot3MsmQueryState
Dot3MsmFreeMemory
Dot3MsmUIResponse
Dot3MsmQueryPendingUIRequest
Dot3MsmQueryMediaState
Dot3MsmSetRuntimeState
Dot3MsmValidateProfile
Dot3MsmConnect
Dot3MsmDisconnect
Dot3ReasonCodeMsmToString
Dot3MsmReAuthenticate
Dot3MsmDeInit

dot3gpclnt

LANGPADeInit
DeserializeLANPolicy
LANGPAInit

sysntfy

SysNotifyStartServer
SysNotifyStopServer

kernel32

HeapFree
CloseHandle
SetEvent
CreateEventW
GetLastError
Sleep
SetLastError
GetProcessHeap
HeapAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WTSGetActiveConsoleSessionId
DelayLoadFailureHook
ResolveDelayLoadedAPI
HeapDestroy
HeapReAlloc
HeapSize
RegGetValueW
FindResourceExW
RegEnumValueW
lstrcmpW
LoadResource
LockResource
SizeofResource
RaiseException
GetSystemWindowsDirectoryW
DuplicateHandle
GetTickCount64
DebugBreak
CreateFileW
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LocalFree
QueueUserWorkItem
CreateTimerQueue
UnregisterWait
DeleteTimerQueueEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
ChangeTimerQueueTimer
GetModuleHandleExW
FreeLibrary
CreateFileA
DeviceIoControl
GetCurrentThread
GetTickCount
WaitForSingleObject
ResetEvent
InitializeCriticalSectionAndSpinCount
CreateDirectoryW
DeleteFileW

shlwapi

PathAddExtensionW
SHEnumKeyExW
PathAppendW
PathFindFileNameW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

Dot3SvcMain
LanNotifyOnLogoff
LanNotifyOnLogon
SvchostPushServiceGlobals

Sections

.text
Size: 207KB - Virtual size: 206KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 892B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af6aa86b9e970317445dcc0795b75656

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-registry-l1-1-0

api-ms-win-service-core-l1-1-1

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

rpcrt4

user32

dot3msm

dot3gpclnt

sysntfy

kernel32

shlwapi

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 207KB - Virtual size: 206KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 7KB - Virtual size: 6KB

.idata Size: 7KB - Virtual size: 7KB

.didat Size: 1024B - Virtual size: 536B

.rsrc Size: 30KB - Virtual size: 30KB

.reloc Size: 1024B - Virtual size: 892B

.text
Size: 207KB - Virtual size: 206KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 7KB - Virtual size: 6KB

.idata
Size: 7KB - Virtual size: 7KB

.didat
Size: 1024B - Virtual size: 536B

.rsrc
Size: 30KB - Virtual size: 30KB

.reloc
Size: 1024B - Virtual size: 892B