SDClient[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

SDClient.dll
Size

208KB
MD5

2991185fa7134d1d6a1f2523ada3081b
SHA1

953418f8464ba96fbe76e7c47fe6789bc727f06e
SHA256

d5bb35170b6fdfd6eaeee57ac0f940499fca25c2336dccd8732908b5e60c6c09
SHA512

2bc1ac9bc953ed3262be46d5fd9134c06f48c6f819b1929b52988940b00f094090d243b257313f82cf215cf53165979b2f676c5d321e55738ebdde898805fcb9
SSDEEP

6144:lqRO29JBeaUexvZ5L5be+JgLrT4XAjGd3jP3dfx:ExLLI+JgLrT4XAjoTl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SDClient.dll

Files

SDClient.dll
.dll regsvr32 windows:10 windows x86 arch:x86

284b17a261d3c79435c0f1eaf8f77c62

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

SDClient.pdb

Imports

msvcrt

_callnewh
_resetstkoflw
memset
_ultow
_vsnprintf
__CxxFrameHandler3
qsort
wcsncpy_s
memcmp
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
realloc
??1type_info@@UAE@XZ
_wcsicmp
??0exception@@QAE@XZ
memmove_s
??0exception@@QAE@ABQBD@Z
?terminate@@YAXXZ
_XcptFilter
??1exception@@UAE@XZ
_initterm
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
_vsnwprintf
_purecall
_amsg_exit
wcscat_s
wcscpy_s
memcpy_s
free
malloc
_errno
memcpy

ntdll

NtDuplicateToken
RtlAcquireResourceExclusive
EtwEventUnregister
RtlReleaseResource
RtlLengthSid
RtlAcquireResourceShared
RtlEqualSid
RtlAllocateAndInitializeSid
RtlNtStatusToDosError
RtlIpv4StringToAddressW
RtlIpv6StringToAddressW
RtlIpv6AddressToStringW
RtlInitializeResource
RtlDeleteResource
RtlFreeSid
EtwEventWriteFull
RtlVerifyVersionInfo

oleaut32

SysFreeString
SysAllocStringLen
LoadTypeLi
VarUI4FromStr
SysAllocString
SysStringLen
RegisterTypeLi
VarBstrCmp
UnRegisterTypeLi
SysStringByteLen
SysAllocStringByteLen

rpcrt4

RpcRevertToSelf
RpcBindingFree
RpcBindingSetAuthInfoExW
RpcEpResolveBinding
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcMgmtStopServerListening
RpcServerUnregisterIf
RpcImpersonateClient
RpcBindingVectorFree
RpcStringFreeW
RpcServerListen
NdrClientCall2
RpcServerRegisterIf
NdrServerCall2
RpcServerUseProtseqEpW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameW
FindResourceExW
LoadResource
GetModuleHandleW
LoadLibraryExW
SizeofResource

api-ms-win-core-com-l1-1-1

CoTaskMemAlloc
CoCreateInstance
StringFromGUID2
CLSIDFromString
CoTaskMemRealloc
CoRevertToSelf
CoImpersonateClient
CoDisconnectObject
CoTaskMemFree

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException
SetLastError

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegGetValueW
RegQueryInfoKeyW
RegQueryValueExW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-synch-l1-2-0

DeleteCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
Sleep
ReleaseSemaphore
LeaveCriticalSection
EnterCriticalSection

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
GetTraceLoggerHandle
TraceMessage
UnregisterTraceGuids

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-2-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventRegister
EventUnregister
EventActivityIdControl

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
OpenThreadToken
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

kernelbase

lstrcmpiW
WTSGetServiceSessionId

regapi

RegGetMachinePolicyNew

user32

UnregisterClassA
LoadStringW

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW

winsta

WinStationQueryInformationW

kernel32

TlsFree
DeleteTimerQueueEx
GetVersionExW
RtlCaptureStackBackTrace
TlsGetValue
GetCurrentThread
VerSetConditionMask
GetComputerNameW
FormatMessageW
GetModuleHandleExA
UnregisterWaitEx
TlsAlloc
RegisterWaitForSingleObject
GetSystemTime
SystemTimeToFileTime
DuplicateHandle
CreateTimerQueue
OpenProcess

api-ms-win-security-base-l1-2-0

CreateWellKnownSid
CheckTokenMembership
DuplicateToken
ImpersonateLoggedOnUser
RevertToSelf
DuplicateTokenEx
GetTokenInformation
AllocateAndInitializeSid

samcli

NetUserGetInfo

crypt32

CryptBinaryToStringW

ws2_32

GetAddrInfoW
WSAStartup
WSACleanup
FreeAddrInfoW

iphlpapi

GetAdaptersAddresses

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

api-ms-win-security-lsalookup-l1-1-1

LookupAccountSidLocalW

api-ms-win-security-lsapolicy-l1-1-0

LsaFreeMemory

cryptsp

CryptReleaseContext
CryptGenRandom
CryptAcquireContextW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

284b17a261d3c79435c0f1eaf8f77c62

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

oleaut32

rpcrt4

api-ms-win-core-heap-l2-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-debug-l1-1-1

api-ms-win-core-profile-l1-1-0

kernelbase

regapi

user32

wtsapi32

winsta

kernel32

api-ms-win-security-base-l1-2-0

samcli

crypt32

ws2_32

iphlpapi

api-ms-win-core-delayload-l1-1-1

api-ms-win-security-lsalookup-l1-1-1

api-ms-win-security-lsapolicy-l1-1-0

cryptsp

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 148KB - Virtual size: 148KB

.data Size: 1024B - Virtual size: 11KB

.idata Size: 7KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 40KB - Virtual size: 40KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 148KB - Virtual size: 148KB

.data
Size: 1024B - Virtual size: 11KB

.idata
Size: 7KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 40KB - Virtual size: 40KB

.reloc
Size: 9KB - Virtual size: 8KB