libcares-2[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

libcares-2.dll
Size

4.3MB
MD5

93fb1d866472e1280e4a93343db3ed13
SHA1

fcc4cbab5f13bfbcac6b7610309ca6c3bdbd58ac
SHA256

089da3c21bdd12618e7d5f757d1742a48dc961b367a8515703c94d9febc965c9
SHA512

79d49f319ab38945714b59c071ee61888135326718ffb91c333806c31f8b36b108ca121884366092aee4fbc2991af16fc4eb811c25a66590911d0493d028448e
SSDEEP

49152:TO4Yher6KfKDd0faVjaNpYzooELJJC4L0357+LnT3ODeJaYxdVIwG4HK0VglLa3N:TVrDQhzooyrnRvOqx9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
libcares-2.dll

Files

libcares-2.dll
.dll windows:6 windows x64 arch:x64

69331c1d0fd9da1b6773cea279048fb0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

advapi32

AdjustTokenPrivileges
DeregisterEventSource
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegisterEventSourceW
ReportEventW

bcrypt

BCryptCreateHash
BCryptDestroyHash
BCryptFinishHash
BCryptGenRandom
BCryptGetProperty
BCryptHashData
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider

kernel32

TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
CancelIoEx
CancelSynchronousIo
CancelThreadpoolIo
CloseHandle
CloseThreadpoolIo
CloseThreadpoolWait
CloseThreadpoolWork
CompareStringEx
CompareStringOrdinal
CreateDirectoryW
CreateEventExW
CreateFileW
CreatePipe
CreateProcessW
CreateThread
CreateThreadpoolIo
CreateThreadpoolTimer
CreateThreadpoolWait
CreateThreadpoolWork
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
EnumCalendarInfoExEx
EnumTimeFormatsEx
ExitProcess
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNLSStringEx
FindStringOrdinal
FlushFileBuffers
FormatMessageW
FreeConsole
FreeLibrary
GetCPInfoExW
GetCalendarInfoEx
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumberEx
GetCurrentThread
GetCurrentThreadId
GetDynamicTimeZoneInformation
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesExW
GetFileInformationByHandleEx
GetFileType
GetFullPathNameW
GetLastError
GetLocaleInfoEx
GetLongPathNameW
GetModuleFileNameW
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetProcessId
GetStdHandle
GetSystemDirectoryW
GetSystemTime
GetThreadPriority
GetTickCount64
GetTimeZoneInformation
GetUserPreferredUILanguages
HeapAlloc
HeapFree
InitializeConditionVariable
InitializeCriticalSection
IsDebuggerPresent
IsWow64Process
K32EnumProcessModulesEx
K32EnumProcesses
K32GetModuleBaseNameW
K32GetModuleFileNameExW
K32GetModuleInformation
LCMapStringEx
LeaveCriticalSection
LoadLibraryExW
LocalAlloc
LocalFree
LocaleNameToLCID
MultiByteToWideChar
OpenProcess
OpenThread
QueryPerformanceCounter
QueryPerformanceFrequency
QueryUnbiasedInterruptTime
RaiseFailFastException
ReadConsoleW
ReadFile
ResetEvent
ResolveLocaleName
ResumeThread
SetEvent
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SetLastError
SetThreadErrorMode
SetThreadPriority
SetThreadpoolTimer
SetThreadpoolWait
Sleep
SleepConditionVariableCS
StartThreadpoolIo
SubmitThreadpoolWork
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
VirtualAlloc
VirtualFree
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForThreadpoolWaitCallbacks
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
FlushProcessWriteBuffers
WaitForSingleObjectEx
AddVectoredExceptionHandler
GetModuleHandleW
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
VerSetConditionMask
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
SwitchToThread
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
CreateMemoryResourceNotification
QueryInformationJobObject
GetModuleHandleExW
GetProcessAffinityMask
VerifyVersionInfoW
InitializeContext
GetEnabledXStateFeatures
LocateXStateFeature
SetXStateFeaturesMask
VirtualQuery
GetSystemTimeAsFileTime
InitializeCriticalSectionEx
SleepEx
DebugBreak
GlobalMemoryStatusEx
GetSystemInfo
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
RtlUnwindEx
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry

ole32

CoUninitialize
CoWaitForMultipleHandles
CoInitializeEx
CoCreateGuid
CoGetApartmentType

user32

LoadStringW

api-ms-win-crt-math-l1-1-0

pow
tan
floor
cos
ceil
sin
modf

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc
calloc

api-ms-win-crt-string-l1-1-0

strcpy_s
strncpy_s
wcsncmp
_stricmp
strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_crt_atexit
_initterm
_cexit
_seh_filter_dll
_register_onexit_function
abort
_configure_narrow_argv
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table
terminate

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsprintf_s
__stdio_common_vsscanf

Exports

Exports

1ITe1p2k1R3Ytz9GXNcBXQRWyFmlHkI
WaNX1JcJRRS3
ares_array_at
ares_array_at_const
ares_array_claim_at
ares_array_create
ares_array_destroy
ares_array_finish
ares_array_first
ares_array_first_const
ares_array_insert_at
ares_array_insert_first
ares_array_insert_last
ares_array_insertdata_at
ares_array_insertdata_first
ares_array_insertdata_last
ares_array_last
ares_array_last_const
ares_array_len
ares_array_remove_at
ares_array_remove_first
ares_array_remove_last
ares_array_set_size
ares_array_sort
ares_buf_append
ares_buf_append_be16
ares_buf_append_be32
ares_buf_append_byte
ares_buf_append_finish
ares_buf_append_num_dec
ares_buf_append_num_hex
ares_buf_append_start
ares_buf_append_str
ares_buf_begins_with
ares_buf_consume
ares_buf_consume_charset
ares_buf_consume_line
ares_buf_consume_nonwhitespace
ares_buf_consume_until_charset
ares_buf_consume_until_seq
ares_buf_consume_whitespace
ares_buf_create
ares_buf_create_const
ares_buf_destroy
ares_buf_fetch_be16
ares_buf_fetch_be32
ares_buf_fetch_bytes
ares_buf_fetch_bytes_dup
ares_buf_fetch_bytes_into_buf
ares_buf_fetch_str_dup
ares_buf_finish_bin
ares_buf_finish_str
ares_buf_get_position
ares_buf_hexdump
ares_buf_len
ares_buf_load_file
ares_buf_parse_dns_binstr
ares_buf_parse_dns_str
ares_buf_peek
ares_buf_peek_byte
ares_buf_reclaim
ares_buf_set_length
ares_buf_set_position
ares_buf_split
ares_buf_split_str
ares_buf_split_str_array
ares_buf_tag
ares_buf_tag_clear
ares_buf_tag_fetch
ares_buf_tag_fetch_bytes
ares_buf_tag_fetch_constbuf
ares_buf_tag_fetch_strdup
ares_buf_tag_fetch_string
ares_buf_tag_length
ares_buf_tag_rollback
ares_cancel
ares_create_query
ares_destroy
ares_destroy_options
ares_dns_addr_to_ptr
ares_dns_class_fromstr
ares_dns_class_tostr
ares_dns_opcode_tostr
ares_dns_opt_get_datatype
ares_dns_opt_get_name
ares_dns_parse
ares_dns_pton
ares_dns_rcode_tostr
ares_dns_rec_type_fromstr
ares_dns_rec_type_tostr
ares_dns_record_create
ares_dns_record_destroy
ares_dns_record_duplicate
ares_dns_record_get_flags
ares_dns_record_get_id
ares_dns_record_get_opcode
ares_dns_record_get_rcode
ares_dns_record_query_add
ares_dns_record_query_cnt
ares_dns_record_query_get
ares_dns_record_query_set_name
ares_dns_record_query_set_type
ares_dns_record_rr_add
ares_dns_record_rr_cnt
ares_dns_record_rr_del
ares_dns_record_rr_get
ares_dns_record_rr_get_const
ares_dns_record_set_id
ares_dns_rr_add_abin
ares_dns_rr_del_abin
ares_dns_rr_del_opt_byid
ares_dns_rr_get_abin
ares_dns_rr_get_abin_cnt
ares_dns_rr_get_addr
ares_dns_rr_get_addr6
ares_dns_rr_get_bin
ares_dns_rr_get_class
ares_dns_rr_get_keys
ares_dns_rr_get_name
ares_dns_rr_get_opt
ares_dns_rr_get_opt_byid
ares_dns_rr_get_opt_cnt
ares_dns_rr_get_str
ares_dns_rr_get_ttl
ares_dns_rr_get_type
ares_dns_rr_get_u16
ares_dns_rr_get_u32
ares_dns_rr_get_u8
ares_dns_rr_key_datatype
ares_dns_rr_key_to_rec_type
ares_dns_rr_key_tostr
ares_dns_rr_set_addr
ares_dns_rr_set_addr6
ares_dns_rr_set_bin
ares_dns_rr_set_opt
ares_dns_rr_set_str
ares_dns_rr_set_u16
ares_dns_rr_set_u32
ares_dns_rr_set_u8
ares_dns_section_tostr
ares_dns_write
ares_dup
ares_expand_name
ares_expand_string
ares_fds
ares_free
ares_free_array
ares_free_data
ares_free_hostent
ares_free_string
ares_freeaddrinfo
ares_get_servers
ares_get_servers_csv
ares_get_servers_ports
ares_getaddrinfo
ares_gethostbyaddr
ares_gethostbyname
ares_gethostbyname_file
ares_getnameinfo
ares_getsock
ares_htable_asvp_create
ares_htable_asvp_destroy
ares_htable_asvp_get
ares_htable_asvp_get_direct
ares_htable_asvp_insert
ares_htable_asvp_keys
ares_htable_asvp_num_keys
ares_htable_asvp_remove
ares_htable_dict_create
ares_htable_dict_destroy
ares_htable_dict_get
ares_htable_dict_get_direct
ares_htable_dict_insert
ares_htable_dict_keys
ares_htable_dict_num_keys
ares_htable_dict_remove
ares_htable_strvp_claim
ares_htable_strvp_create
ares_htable_strvp_destroy
ares_htable_strvp_get
ares_htable_strvp_get_direct
ares_htable_strvp_insert
ares_htable_strvp_num_keys
ares_htable_strvp_remove
ares_htable_szvp_create
ares_htable_szvp_destroy
ares_htable_szvp_get
ares_htable_szvp_get_direct
ares_htable_szvp_insert
ares_htable_szvp_num_keys
ares_htable_szvp_remove
ares_htable_vpstr_create
ares_htable_vpstr_destroy
ares_htable_vpstr_get
ares_htable_vpstr_get_direct
ares_htable_vpstr_insert
ares_htable_vpstr_num_keys
ares_htable_vpstr_remove
ares_htable_vpvp_create
ares_htable_vpvp_destroy
ares_htable_vpvp_get
ares_htable_vpvp_get_direct
ares_htable_vpvp_insert
ares_htable_vpvp_num_keys
ares_htable_vpvp_remove
ares_inet_ntop
ares_inet_pton
ares_init
ares_init_options
ares_is_hostname
ares_library_cleanup
ares_library_init
ares_library_init_mem
ares_library_initialized
ares_llist_clear
ares_llist_create
ares_llist_destroy
ares_llist_first_val
ares_llist_insert_after
ares_llist_insert_before
ares_llist_insert_first
ares_llist_insert_last
ares_llist_last_val
ares_llist_len
ares_llist_node_claim
ares_llist_node_destroy
ares_llist_node_first
ares_llist_node_idx
ares_llist_node_last
ares_llist_node_mvparent_first
ares_llist_node_mvparent_last
ares_llist_node_next
ares_llist_node_parent
ares_llist_node_prev
ares_llist_node_replace
ares_llist_node_val
ares_llist_replace_destructor
ares_malloc
ares_malloc_zero
ares_memeq
ares_memeq_ci
ares_memmem
ares_mkquery
ares_parse_a_reply
ares_parse_aaaa_reply
ares_parse_caa_reply
ares_parse_mx_reply
ares_parse_naptr_reply
ares_parse_ns_reply
ares_parse_ptr_reply
ares_parse_soa_reply
ares_parse_srv_reply
ares_parse_txt_reply
ares_parse_txt_reply_ext
ares_parse_uri_reply
ares_process
ares_process_fd
ares_process_fds
ares_process_pending_write
ares_query
ares_query_dnsrec
ares_queue_active_queries
ares_queue_wait_empty
ares_realloc
ares_realloc_zero
ares_reinit
ares_save_options
ares_search
ares_search_dnsrec
ares_send
ares_send_dnsrec
ares_set_local_dev
ares_set_local_ip4
ares_set_local_ip6
ares_set_pending_write_cb
ares_set_server_state_callback
ares_set_servers
ares_set_servers_csv
ares_set_servers_ports
ares_set_servers_ports_csv
ares_set_socket_callback
ares_set_socket_configure_callback
ares_set_socket_functions
ares_set_socket_functions_ex
ares_set_sortlist
ares_str_isalnum
ares_str_isnum
ares_str_isprint
ares_str_lower
ares_str_ltrim
ares_str_rtrim
ares_str_trim
ares_strcasecmp
ares_strcaseeq
ares_strcaseeq_max
ares_strcmp
ares_strcpy
ares_strdup
ares_streq
ares_streq_max
ares_strerror
ares_strlen
ares_strncasecmp
ares_strncmp
ares_threadsafety
ares_timeout
ares_tolower
ares_version
gogZLPQ9
guj4cA3KMH

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 185KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

69331c1d0fd9da1b6773cea279048fb0

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

bcrypt

kernel32

ole32

user32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

Exports

Exports

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 14KB - Virtual size: 1.1MB

.pdata Size: 185KB - Virtual size: 184KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 14KB - Virtual size: 1.1MB

.pdata
Size: 185KB - Virtual size: 184KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB