Malware teardown · reverse engineering

Anatomy of a fake “DNS optimizer”

Someone hands you a 3.6 MB Windows program called DNS一键优化.exe — “one-click DNS optimization” — because the site you want to reach won’t load. It looks like a friendly support tool. I unpacked it to find out what it actually changes on your machine, and why the honest answer is don’t run it.

Windows PE32 3,767,808 bytes UPX packed unsigned requires administrator

Sample analysed 19 Sep 2026 Static analysis only — the binary was never executed (a Windows PE cannot run on macOS in the first place).

01Where it came from

No guessing was required. macOS keeps a receipt for every downloaded file, in an extended attribute called kMDItemWhereFroms, plus a quarantine stamp recording which application fetched it and when:

$ xattr -l DNS一键优化.exe
com.apple.metadata:kMDItemWhereFroms: https://www.218yc[.]com/static/file/DNS一键优化.exe
                                     https://www.218yc[.]com/
com.apple.quarantine: 0081;6aae4c6a;Chrome;67742DF8-…

Domains on this page are written defanged — [.] stands for . — so nothing here can be clicked into a visit or scraped into one.

218yc[.]com is not a software site. It is a search-engine-camouflaged front page for an unlicensed online gambling operation — a mix of scraped news snippets, bank and email links to look legitimate, and links into browser-based casino games. Its front page carries a small “self-rescue” kit for players whose connection refuses to load the site:

All three items solve the same problem: making a blocked website load. That framing is the whole story of this file. It is not a utility that escaped from a software vendor — it is site infrastructure, handed to players as a favour.

02What’s inside the file

Two of these are already the tell. The embedded manifest is stored uncompressed even inside a packed binary, so it can be read without unpacking — and it asks for full administrator rights:

<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />

A DNS tweak is a machine-wide network change, so admin is technically consistent. But combine that with no signature and no version information at all — you cannot verify who built this, you cannot check whether the build in front of you is the build anyone ever reviewed, and there is no update mechanism that would tell you if it changed. That is what a throwaway build looks like.

03The entire program, in four lines

Unpacked, the giveaway sits in one tight cluster of strings. The application’s own class names are UDnsOptimizer / UDnsWindow, and its working code is a thin wrapper around Windows’ own command-line network tool:

netsh interface ip   set dns "%1" static %2
netsh interface ip   add dns "%1" %2 index=2
netsh interface ipv4 set dnsserver "%1" static %2
netsh interface ip   set dns "%1" dhcp        // "reset to automatic"

// and the same change written straight into the registry:
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\%1 → NameServer

The interface is one button, and the messages it shows the user are exactly what you would expect from a “fix my DNS” utility:

Here is the part that matters. The only DNS server addresses anywhere in the binary are 8.8.8.8 and 8.8.4.4 — Google Public DNS. There is no latency measurement, no comparison of providers, no “optimisation” logic of any kind. “Optimise” means one thing: replace your ISP’s DNS servers with Google’s.

And it is not limited to that pair. The binary also carries hidden command-line options — --adapter-index, --preferred-dns-server, --alternate-dns-server — alongside programmatic entry points such as setAllDnsAddressManually(). In other words, whoever launches this program can point your DNS at any resolver they choose, silently, with administrator rights, on every adapter.

04Why a gambling site ships a DNS tool

Because DNS is usually what blocks it. On many networks — and especially across mainland China’s ISP resolvers — casino domains are sinkholed at the DNS layer, so the site simply won’t resolve. The standard workaround is to move resolution to a foreign resolver, and the standard pairing for that is a foreign resolver plus a proxy-capable browser. That is precisely the three-item kit on the site’s help page: change the DNS, install our browser, check the line.

So the tool is not random. It is the first step of a documented access-bypass workflow, packaged as consumer-friendly “one-click” support.

05What I did not find

Being precise here matters, because “I found malware!” is easy to claim and hard to prove. I looked for, and did not find:

• Any command-and-control or network behaviour — no InternetOpen, URLDownloadToFile or WinHttpConnect; no embedded URLs or IP endpoints beyond the Qt library’s own text.
• Any persistence — no Run registry keys, no scheduled tasks, no service installation, no startup folder drops.
• Any second-stage payload, dropped file, or appended overlay data beyond the packed image.
• Any modification of the hosts file, any proxy configuration change, or any tampering with UAC itself (it only reads the UAC state and can open the UAC settings panel).

The strings that look alarming at a glance — .lnk, NetShareEnum, UNC paths — belong to the Qt and Windows shell libraries that every Qt application links, not to this program’s own logic. Reading them as intent is the classic false positive.

06Why you shouldn’t run it — five concrete reasons

1. Unverifiable authorship, with admin rights. No signature, no version resource, no publisher name. You cannot tell this build apart from a modified one, and it runs elevated. Everything else on this list is a consequence of that.
2. It rewrites every network adapter, and rollback is on you. The change is applied per adapter and written into the registry. If it fails halfway, or your VPN, school or work profile depends on its own resolver, you are left with broken name resolution and no undo button — the program has no restore function beyond a blunt “set it back to automatic”.
3. It silently redirects all your DNS traffic to a third party. Every hostname your machine looks up would go to one external resolver. That is a real privacy change, and it commonly breaks things you actually want: split-horizon internal DNS, hotel and airport captive portals, ISP or parental filtering, and some campus networks.
4. It can be aimed at any resolver by whoever runs it. The --preferred-dns-server / --alternate-dns-server switches mean the “optimiser” is a generic DNS-setting engine. A launcher, an installer or a shortcut can drive it to a malicious resolver without the user ever seeing a prompt — and DNS is the layer that decides where your traffic actually goes.
5. Provenance is disqualifying. It is distributed by an unlicensed gambling operation, from a domain dressed up to look like a news site, as part of a workflow whose purpose is to evade network controls. Nothing about that chain gives you a reason to trust it with administrator rights on your machine.

07The pattern to recognise next time

None of this required a malware scanner. The same five questions would have flagged it before execution:

• Was it pushed by a site I was trying to reach, rather than by a vendor? Support tooling that arrives from the thing you are trying to access is a red flag, not a courtesy.
• Does an unsigned binary want administrator rights? If a utility cannot be attributed to anyone and still asks for elevation, stop there.
• Is there no version info at all? Real software ships a publisher, product and version. A blank version tab means nobody intends to be held to it.
• Is the “fix” actually a bypass? “Fixes the black screen”, “works anywhere”, “unblocks the game” — these describe evading a network control, not repairing your computer.
• Is a browser bundled with the fix? A network setting change plus a browser the vendor controls is the two halves of a traffic redirection kit. You should not accept either half from a party you don’t trust.

08How the analysis was done

Entirely static — the sample was never executed, and as a Windows PE it could not have been on this machine anyway. The whole teardown ran on macOS:

09Indicators, and what to do if you already ran it

If it was run on a Windows machine, check what your adapters are actually using and put them back to automatic:

:: see the current DNS servers per adapter
netsh interface ip show dns

:: revert an adapter to the network's own resolvers
netsh interface ip set dns "Wi-Fi" dhcp
netsh interface ip set dns "Ethernet" dhcp

:: the registry values this tool writes
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\

The sample itself is deliberately not hosted here. If you want a scanner’s opinion, submit the hashes above to a service such as VirusTotal rather than running the file.