adrclient.pdb
Static task
static1
Behavioral task
behavioral1
Sample
adrclient.dll
Resource
win10v2004-20240426-en
General
-
Target
adrclient.dll
-
Size
98KB
-
MD5
b0f574e33c2d4150ec9e93c8e1658e1b
-
SHA1
e380d36ffd845a4b2d1c73e934279b8ee60f7502
-
SHA256
4c09538e340c8f7a8602439b13b81416846ac0284ee3c4a3fc69f1e2caebd340
-
SHA512
6cdbfde938805dfd8467dd22a24a268b98b45c4bc238d0bd4f88286a671c931d2965d149e318f98eebb649454529d26a9d4b9bf398e4fc55008f5722699b9271
-
SSDEEP
3072:2e8M6jXYgIKPwlCQkDUHCO9rjUVTI0WeR3:2eF61PwlCQkDUiOl4NWa3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource adrclient.dll
Files
-
adrclient.dll.dll regsvr32 windows:10 windows x86 arch:x86
14add8dc76195382e4a76be8a2bec2dd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
malloc
??0exception@@QAE@XZ
_callnewh
??0exception@@QAE@ABV0@@Z
_CxxThrowException
iswalpha
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
_wcsnicmp
??3@YAXPAX@Z
free
iswdigit
_vsnprintf
_snwscanf_s
_vsnwprintf
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
_except_handler4_common
??1type_info@@UAE@XZ
__CxxFrameHandler3
_purecall
memmove
memcmp
?what@exception@@UBEPBDXZ
wcsncmp
??_V@YAXPAX@Z
memcpy
memset
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
oleaut32
GetErrorInfo
SysStringLen
SysAllocString
LoadRegTypeLi
SysFreeString
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
LoadStringW
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleA
FreeLibrary
GetProcAddress
DisableThreadLibraryCalls
api-ms-win-core-heap-l1-1-0
HeapDestroy
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryA
LoadLibraryW
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
api-ms-win-core-file-l1-1-0
GetDriveTypeW
mpr
WNetGetUniversalNameW
wkscli
NetGetJoinInformation
netutils
NetApiBufferFree
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
CreateThread
GetCurrentThreadId
GetCurrentProcessId
GetCurrentThread
OpenProcessToken
GetCurrentProcess
TerminateProcess
dfscli
NetDfsGetClientInfo
api-ms-win-security-base-l1-1-0
GetLengthSid
CopySid
GetSecurityDescriptorOwner
GetFileSecurityW
GetTokenInformation
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetThreadLocale
ws2_32
WSAStartup
GetAddrInfoW
WSACleanup
FreeAddrInfoW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
ntdll
WinSqmIsOptedIn
RtlFreeUnicodeString
WinSqmIncrementDWORD
RtlDosPathNameToNtPathName_U
NtOpenFile
user32
SendMessageW
shell32
ShellExecuteW
mi
MI_Application_InitializeV1
srmtrace
ord7
ord6
ord11
ord5
ord10
ord8
ord9
ord3
dui70
UnInitThread
?_ZeroRelease@Value@DirectUI@@AAEXXZ
?SetValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZHPAVValue@2@@Z
?CreateString@Value@DirectUI@@SGPAV12@PBGPAUHINSTANCE__@@@Z
?ContentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?EndDefer@Element@DirectUI@@QAEXK@Z
?GetContentString@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
CreateDUIWrapper
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
InitThread
StrToID
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
UnInitProcessPriv
InitProcessPriv
api-ms-win-security-lsalookup-l2-1-0
LookupAccountSidW
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-eventlog-legacy-l1-1-0
ReportEventW
RegisterEventSourceW
DeregisterEventSource
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 82KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ