dnsapi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1628fff5594a906a045d9e5132f67423530972bda5deb4766ed470ceeeaf38a5.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1628fff5594a906a045d9e5132f67423530972bda5deb4766ed470ceeeaf38a5.dll
Resource
win10v2004-20240508-en
General
-
Target
1628fff5594a906a045d9e5132f67423530972bda5deb4766ed470ceeeaf38a5.exe
-
Size
263KB
-
MD5
e040867395ddf38f1fadaf83d69328a0
-
SHA1
387d73a3a10a02ef830e451617713da6a79f8fb2
-
SHA256
1628fff5594a906a045d9e5132f67423530972bda5deb4766ed470ceeeaf38a5
-
SHA512
832e2f92007ba4e922b8b358ed054f007720eeb6a15dfbc2ab09028da0c81068b976e2ec78c5309ebb551daf11857bcfef20cb02a063d44439e37cfcd3a77c6c
-
SSDEEP
6144:bfhtNfo6tHlY5BMAGBGruwKHEYRjdFBU0yaM:bflrJS5OJBG+kYRjDg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1628fff5594a906a045d9e5132f67423530972bda5deb4766ed470ceeeaf38a5.exe
Files
-
1628fff5594a906a045d9e5132f67423530972bda5deb4766ed470ceeeaf38a5.exe.dll windows:6 windows x86 arch:x86
222b2996cf97de9c241b29c1719216d6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
free
malloc
_XcptFilter
_initterm
towlower
_except_handler4_common
wcschr
wcstoul
atoi
sscanf
strtoul
_strlwr
strncmp
_strupr
_amsg_exit
memcpy
_stricmp
rand
srand
_strnicmp
_wcsnicmp
_wcsicmp
fputs
time
localtime
fprintf
fgets
rewind
fopen
strpbrk
fclose
_vsnwprintf
_vsnprintf
memset
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-interlocked-l1-1-0
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
InterlockedIncrement
api-ms-win-core-libraryloader-l1-1-0
GetProcAddress
FreeLibrary
LoadLibraryExW
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleW
LoadLibraryExA
api-ms-win-core-localregistry-l1-1-0
RegEnumKeyExW
RegCloseKey
RegOpenKeyExW
RegDeleteKeyExW
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
api-ms-win-core-misc-l1-1-0
LocalReAlloc
Sleep
LocalAlloc
LocalFree
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-core-processthreads-l1-1-0
CreateThread
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetVersionExW
GetTickCount
GetSystemDirectoryA
GetTickCount64
api-ms-win-core-synch-l1-1-0
ReleaseMutex
AcquireSRWLockShared
CreateEventA
InitializeCriticalSection
ReleaseSRWLockShared
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SleepEx
ReleaseSemaphore
CreateEventW
CreateSemaphoreExW
WaitForMultipleObjectsEx
WaitForSingleObject
SetEvent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
ws2_32
ntohs
recv
sendto
send
connect
setsockopt
WSAIoctl
listen
closesocket
shutdown
bind
getsockname
WSAJoinLeaf
getprotobynumber
getservbyport
ntohl
getprotobyname
inet_addr
WSAStartup
WSACleanup
GetAddrInfoW
FreeAddrInfoW
inet_ntoa
WSAGetLastError
__WSAFDIsSet
htonl
WSASocketW
htons
select
ntdll
RtlIpv6StringToAddressW
RtlIpv4StringToAddressW
WinSqmIsOptedIn
WinSqmSetDWORD
EtwLogTraceEvent
EtwEventEnabled
EtwEventWrite
EvtIntReportEventAndSourceAsync
EtwEventRegister
EtwEventUnregister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
RtlInitializeCriticalSection
EtwTraceMessage
RtlIpv6StringToAddressA
RtlIpv4StringToAddressA
RtlIpv6AddressToStringA
RtlIpv6StringToAddressExA
RtlIpv6StringToAddressExW
RtlDeleteCriticalSection
RtlDestroyHeap
RtlAllocateHeap
RtlReAllocateHeap
RtlFreeHeap
RtlCreateHeap
nsi
NsiAllocateAndGetTable
NsiGetParameter
NsiFreeTable
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
kernelbase
CompareStringA
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
api-ms-win-core-localization-l1-1-0
LCMapStringW
Exports
Exports
BreakRecordsIntoBlob
CombineRecordsInBlob
DnsAcquireContextHandle_A
DnsAcquireContextHandle_W
DnsAllocateRecord
DnsApiAlloc
DnsApiAllocZero
DnsApiFree
DnsApiHeapReset
DnsApiRealloc
DnsApiSetDebugGlobals
DnsAsyncRegisterHostAddrs
DnsAsyncRegisterInit
DnsAsyncRegisterTerm
DnsCopyStringEx
DnsCreateReverseNameStringForIpAddress
DnsCreateStandardDnsNameCopy
DnsCreateStringCopy
DnsDhcpRegisterAddrs
DnsDhcpRegisterHostAddrs
DnsDhcpRegisterInit
DnsDhcpRegisterTerm
DnsDhcpRemoveRegistrations
DnsDhcpSrvRegisterHostAddr
DnsDhcpSrvRegisterHostAddrEx
DnsDhcpSrvRegisterHostName
DnsDhcpSrvRegisterHostNameEx
DnsDhcpSrvRegisterInit
DnsDhcpSrvRegisterInitialize
DnsDhcpSrvRegisterTerm
DnsDowncaseDnsNameLabel
DnsExtractRecordsFromMessage_UTF8
DnsExtractRecordsFromMessage_W
DnsFindAuthoritativeZone
DnsFlushResolverCache
DnsFlushResolverCacheEntry_A
DnsFlushResolverCacheEntry_UTF8
DnsFlushResolverCacheEntry_W
DnsFree
DnsFreeConfigStructure
DnsFreePolicyConfig
DnsFreeProxyName
DnsGetBufferLengthForStringCopy
DnsGetCacheDataTable
DnsGetDnsServerList
DnsGetDomainName
DnsGetLastFailedUpdateInfo
DnsGetPolicyTableInfo
DnsGetPolicyTableInfoPrivate
DnsGetPrimaryDomainName_A
DnsGetProxyInfoPrivate
DnsGetProxyInformation
DnsGlobals
DnsIpv6AddressToString
DnsIpv6StringToAddress
DnsIsAMailboxType
DnsIsStatusRcode
DnsIsStringCountValidForTextType
DnsLogEvent
DnsLogIn
DnsLogInit
DnsLogIt
DnsLogOut
DnsLogTime
DnsMapRcodeToStatus
DnsModifyRecordsInSet_A
DnsModifyRecordsInSet_UTF8
DnsModifyRecordsInSet_W
DnsNameCompareEx_A
DnsNameCompareEx_UTF8
DnsNameCompareEx_W
DnsNameCompare_A
DnsNameCompare_UTF8
DnsNameCompare_W
DnsNameCopy
DnsNameCopyAllocate
DnsNetworkInfo_CreateFromFAZ
DnsNetworkInformation_CreateFromFAZ
DnsNotifyResolver
DnsNotifyResolverClusterIp
DnsNotifyResolverEx
DnsQueryConfig
DnsQueryConfigAllocEx
DnsQueryConfigDword
DnsQueryExA
DnsQueryExUTF8
DnsQueryExW
DnsQuery_A
DnsQuery_UTF8
DnsQuery_W
DnsRecordBuild_UTF8
DnsRecordBuild_W
DnsRecordCompare
DnsRecordCopyEx
DnsRecordListFree
DnsRecordSetCompare
DnsRecordSetCopyEx
DnsRecordSetDetach
DnsRecordStringForType
DnsRecordStringForWritableType
DnsRecordTypeForName
DnsRegisterClusterAddress
DnsReleaseContextHandle
DnsRemoveRegistrations
DnsReplaceRecordSetA
DnsReplaceRecordSetUTF8
DnsReplaceRecordSetW
DnsResolverOp
DnsScreenLocalAddrsForRegistration
DnsSetConfigDword
DnsStatusString
DnsStringCopyAllocateEx
DnsTraceServerConfig
DnsUnicodeToUtf8
DnsUpdate
DnsUpdateMachinePresence
DnsUpdateTest_A
DnsUpdateTest_UTF8
DnsUpdateTest_W
DnsUtf8ToUnicode
DnsValidateNameOrIp_TempW
DnsValidateName_A
DnsValidateName_UTF8
DnsValidateName_W
DnsValidateServerArray_A
DnsValidateServerArray_W
DnsValidateServerStatus
DnsValidateServer_A
DnsValidateServer_W
DnsValidateUtf8Byte
DnsWriteQuestionToBuffer_UTF8
DnsWriteQuestionToBuffer_W
DnsWriteReverseNameStringForIpAddress
Dns_AddRecordsToMessage
Dns_AllocateMsgBuf
Dns_BuildPacket
Dns_CleanupWinsock
Dns_CloseConnection
Dns_CloseSocket
Dns_CreateMulticastSocket
Dns_CreateSocket
Dns_CreateSocketEx
Dns_ExtractRecordsFromMessage
Dns_FindAuthoritativeZoneLib
Dns_FreeMsgBuf
Dns_GetRandomXid
Dns_InitializeMsgBuf
Dns_InitializeMsgRemoteSockaddr
Dns_InitializeWinsock
Dns_OpenTcpConnectionAndSend
Dns_ParseMessage
Dns_ParsePacketRecord
Dns_PingAdapterServers
Dns_ReadPacketName
Dns_ReadPacketNameAllocate
Dns_ReadRecordStructureFromPacket
Dns_RecvTcp
Dns_ResetNetworkInfo
Dns_SendAndRecvUdp
Dns_SendEx
Dns_SetRecordDatalength
Dns_SetRecordsSection
Dns_SetRecordsTtl
Dns_SkipPacketName
Dns_SkipToRecord
Dns_UpdateLib
Dns_UpdateLibEx
Dns_WriteDottedNameToPacket
Dns_WriteQuestionToMessage
Dns_WriteRecordStructureToPacketEx
ExtraInfo_Init
Faz_AreServerListsInSameNameSpace
FlushDnsPolicyUnreachableStatus
GetCurrentTimeInSeconds
HostsFile_Close
HostsFile_Open
HostsFile_ReadLine
IpHelp_IsAddrOnLink
Local_GetRecordsForLocalName
Local_GetRecordsForLocalNameEx
NetInfo_Build
NetInfo_Clean
NetInfo_Copy
NetInfo_Free
NetInfo_GetAdapterByAddress
NetInfo_GetAdapterByInterfaceIndex
NetInfo_GetAdapterByName
NetInfo_IsAddrConfig
NetInfo_IsForUpdate
NetInfo_ResetServerPriorities
NetInfo_UpdateServerReachability
QueryDirectEx
Query_Main
Reg_FreeUpdateInfo
Reg_GetValueEx
Reg_ReadGlobalsEx
Reg_ReadUpdateInfo
Security_ContextListTimeout
Send_AndRecvUdpWithParam
Send_MessagePrivate
Send_OpenTcpConnectionAndSend
Socket_CacheCleanup
Socket_CacheInit
Socket_CleanupWinsock
Socket_ClearMessageSockets
Socket_CloseEx
Socket_CloseMessageSockets
Socket_Create
Socket_CreateMulticast
Socket_InitWinsock
Socket_JoinMulticast
Socket_RecvFrom
Socket_SetMulticastInterface
Socket_SetMulticastLoopBack
Socket_SetTtl
Socket_TcpListen
Trace_Reset
Update_ReplaceAddressRecordsW
Util_IsIp6Running
Sections
.text Size: 222KB - Virtual size: 222KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ