adsmsext[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

adsmsext.dll
Size

82KB
MD5

212f04dbf4274bd8fdd6675012a3def9
SHA1

e43d8fdb77b9c9d2cad1085e7b61435cd9aa17ff
SHA256

9ce1ab300bd894aa185ffefcf495b59b80946ad8cb1103c441948a3e7c8d0f64
SHA512

9ab26f5a090bdf8d0dfcae0ffbe6d0e1cac17ba8d2d0ba5e81ae457c2f4af2bcfedb8a5a3126f6d8be79fa59e823c7fb890ea4bc775809d5eb04e7d3220c4242
SSDEEP

1536:nN8wDsEgpkekXknkOUKGe9UO6zwJ9U6EII3zmRbK88Uf1Gcj:ndJETkXknkOU4GwJ9U6EIkmRbp8Uf1Gc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
adsmsext.dll

Files

adsmsext.dll
.dll windows:10 windows x86 arch:x86

e058556a51521ec94d20d7986eb0d423

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

adsmsext.pdb

Imports

msvcrt

memcpy
_wcsicmp
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
wcstok
wcscat_s
wcscpy_s
_purecall
swscanf_s
wcschr
_wcsnicmp
swprintf_s
memset

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSection

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime

api-ms-win-core-file-l1-1-0

LocalFileTimeToFileTime
FileTimeToLocalFileTime

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

ntdll

RtlInitUnicodeString
RtlInitString

activeds

ord9
ord17
ord15
ord16
ord14
ord7
ord18

adsldpc

GetDefaultServer
LdapCrackUserDNtoNTLMUser2
ChangeSeparator
ReadServerSupportsIsADControl
LdapCloseObject
FreeObjectInfo
LdapModifyS
ReadServerSupportsIsADAMControl
LdapGetSyntaxOfAttributeOnServer
ADsObject
LdapCompareExt
BuildLDAPPathFromADsPath2
BuildADsPathFromLDAPPath
LdapValueFree
LdapReadAttributeFast
ADSIPrint
LdapOpenObject

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e058556a51521ec94d20d7986eb0d423

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

ntdll

activeds

adsldpc

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 70KB - Virtual size: 70KB

.data Size: 1024B - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 2KB

.didat Size: 512B - Virtual size: 212B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 70KB - Virtual size: 70KB

.data
Size: 1024B - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 2KB

.didat
Size: 512B - Virtual size: 212B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB