iasads[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

iasads.dll
Size

56KB
MD5

b7a987e106fc51911c62d6e3beb54d87
SHA1

e4db605be1fb2de80c19a906e353ba7704c4d5bb
SHA256

894aed537ec84f235f128f35d5a8741fea87b3ed4f27ce37a40fc60d1c0c481d
SHA512

1d152dd6d01e065ceafe161a194f7ade2fec3a27e1d6e03a1232a2507da6c6f6c0e6273de2c3ace51c453496c58039b625a6537e51bdea05e717bc1e4c3bd410
SSDEEP

768:tZAKTLVzASqq3g+XjTAPSg3M/4mZUZebV2ewe7m7Xrrdi/WsjqTucLCfnCLvYIFW:t+YGpc/VtwcafdgWJzCGvYIFY0ucV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
iasads.dll

Files

iasads.dll
.dll regsvr32 windows:10 windows x86 arch:x86

b7023990e1c9857fb27e43cd420e48c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

iasads.pdb

Imports

msvcrt

??0exception@@QAE@ABQBD@Z
memcpy
memcpy_s
memmove_s
?what@exception@@UBEPBDXZ
malloc
_callnewh
??1exception@@UAE@XZ
_CxxThrowException
_XcptFilter
_amsg_exit
_initterm
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
memmove
__CxxFrameHandler3
??0exception@@QAE@ABV0@@Z
free
??0exception@@QAE@XZ
_except_handler4_common
_wcsicmp
wcsncpy_s
wcschr
wcscpy_s
wcscat_s
wcstoul
swprintf_s
memset

atl

ord15
ord18
ord22
ord30
ord32
ord21
ord16

iassvcs

IASVariantChangeType
IASRegisterComponent

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
LocalAlloc
DisableThreadLibraryCalls
SetThreadStackGuarantee
GetCurrentThreadId
GetSystemInfo
VirtualQuery
VirtualAlloc
VirtualProtect
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
LocalFree
GetCurrentProcess
Sleep

advapi32

UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

activeds

ord9

netutils

NetApiBufferFree

samcli

NetUserGetInfo
NetUserSetInfo

oleaut32

SafeArrayRedim
SafeArrayPtrOfIndex
SysAllocString
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
UnRegisterTypeLi
SetErrorInfo
LoadRegTypeLi
SysAllocStringLen
SafeArrayAccessData
SafeArrayCreateVector
SafeArrayUnaccessData
VariantCopy
SysStringLen
SysAllocStringByteLen
SysFreeString
SysStringByteLen
VariantClear
VariantInit
SafeArrayGetDim

ntdll

RtlImageNtHeader
RtlFreeHeap
RtlCompareMemory
RtlNtStatusToDosError
RtlInitUnicodeString
RtlAllocateHeap

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b7023990e1c9857fb27e43cd420e48c3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

atl

iassvcs

kernel32

advapi32

activeds

netutils

samcli

oleaut32

ntdll

Exports

Exports

Sections

.text Size: 41KB - Virtual size: 41KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 2KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 41KB - Virtual size: 41KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 3KB - Virtual size: 3KB