The netapi32 dll File Malware Analysis

Technical Analysis

File Name	netapi32.dll
File Type	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Scanner Version	1.0.216.174
Database Version	2025-05-07 14:00:18 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	a29e40f620c2702a186cb7b5ca79d468
SHA1	439c80995edc4f44b490db16d0bb0938481c5526
SHA256	ef36d5f7ab0c9a1e0a16ad07acb565c49fba9916d5f24bb27b8fd377852ad2b4
SHA512	e29d5a896c3a2e8cb3753b0b42aeb1141a86303f17b35ec27c52bc1f79eb4ca9239f0c971e2bb3aa574c6c58fca22e6f2504ae2c6ec56bf77d679091053ccc94
ImpHash	9cbd8f3e320718a64e03df2c176eee34

PE Analysis

Basic Information

▼

Image Base	`0x66340000`
Entry Point	`0x663413e0`
Compilation Time	2016-10-03 21:10:38
Checksum	0x00022376 (Actual: 0x00022376)
OS Version	4.0
PEiD Signatures	`PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	3 libraries ADVAPI32, KERNEL32, msvcrt
Exports	305 functions
Resources	0 Resources
Sections	11 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	73,464 bytes	73,728 bytes	6.01 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_16BYTES`	`369DDFC6F9E4C55585614E3026F068EC`
`.data`	`0x00013000`	600 bytes	1,024 bytes	2.02 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_16BYTES`	`98FA714A983C8FD231A1F0C7605944E4`
`.rdata`	`0x00014000`	6,928 bytes	7,168 bytes	4.78 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_16BYTES`	`0892D8815A9E1DC274212C1F148C4C0B`
`.pdata`	`0x00016000`	4,416 bytes	4,608 bytes	4.52 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`76C18B342EBB54EE958CFF359CA3B420`
`.xdata`	`0x00018000`	3,100 bytes	3,584 bytes	1.59 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`EDACD5CB337007042869F60D0FB6BE03`
`.bss`	`0x00019000`	21,552 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_64BYTES`	`D41D8CD98F00B204E9800998ECF8427E`
`.edata`	`0x0001f000`	9,263 bytes	9,728 bytes	5.41 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`CB864C56329832042C8C43A296942255`
`.idata`	`0x00022000`	2,264 bytes	2,560 bytes	4.10 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_4BYTES`	`A6A9B6C6B34243707FCD9D0F575E5DAA`
`.CRT`	`0x00023000`	88 bytes	512 bytes	0.21 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_8BYTES`	`F8AF71113A8182579B032F9AE878D032`
`.tls`	`0x00024000`	104 bytes	512 bytes	0.27 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_32BYTES`	`440ED7FE3FDB868DA845B5CDCBFB907E`
`.reloc`	`0x00025000`	3,356 bytes	3,584 bytes	6.57 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`C001B5EE064819B4F8494D0085B02562`

Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

The netapi32.dll File Analysis