SDClient[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

SDClient.dll
Size

207KB
MD5

40d4e6d839ab04f86d62c2d9bb61426c
SHA1

ecb011434cea15358a0c9f723c855d2cf9c579b4
SHA256

d420a836806f8f69bf2f4b277bfed43cd89c0153c0b2e405a333652232429ddf
SHA512

0e47052342a1464c4cba855b98e7fea23f93323d46b63a220794deb169d9fdfd5b506408741ec3e3249b49eed262b56181dd8bb1f68e3ab087569505fa663719
SSDEEP

6144:+qRO29JBeamwPHL97Ftzwb7jInwABBTByZDvdcx8n:mQL3tzwb7jInwAT0ZRJn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SDClient.dll

Files

SDClient.dll
.dll regsvr32 windows:10 windows x86 arch:x86

284b17a261d3c79435c0f1eaf8f77c62

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

SDClient.pdb

Imports

msvcrt

_callnewh
_resetstkoflw
memset
_ultow
_vsnprintf
__CxxFrameHandler3
qsort
wcsncpy_s
memcmp
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
realloc
??1type_info@@UAE@XZ
_wcsicmp
??0exception@@QAE@XZ
memmove_s
??0exception@@QAE@ABQBD@Z
?terminate@@YAXXZ
_XcptFilter
??1exception@@UAE@XZ
_initterm
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
_vsnwprintf
_purecall
_amsg_exit
wcscat_s
wcscpy_s
memcpy_s
free
malloc
_errno
memcpy

ntdll

NtDuplicateToken
RtlAcquireResourceExclusive
EtwEventUnregister
RtlReleaseResource
RtlLengthSid
RtlAcquireResourceShared
RtlEqualSid
RtlAllocateAndInitializeSid
RtlNtStatusToDosError
RtlIpv4StringToAddressW
RtlIpv6StringToAddressW
RtlIpv6AddressToStringW
RtlInitializeResource
RtlDeleteResource
RtlFreeSid
EtwEventWriteFull
RtlVerifyVersionInfo

oleaut32

SysFreeString
SysAllocStringLen
LoadTypeLi
VarUI4FromStr
SysAllocString
SysStringLen
RegisterTypeLi
VarBstrCmp
UnRegisterTypeLi
SysStringByteLen
SysAllocStringByteLen

rpcrt4

RpcRevertToSelf
RpcBindingFree
RpcBindingSetAuthInfoExW
RpcEpResolveBinding
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcMgmtStopServerListening
RpcServerUnregisterIf
RpcImpersonateClient
RpcBindingVectorFree
RpcStringFreeW
RpcServerListen
NdrClientCall2
RpcServerRegisterIf
NdrServerCall2
RpcServerUseProtseqEpW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameW
FindResourceExW
LoadResource
GetModuleHandleW
LoadLibraryExW
SizeofResource

api-ms-win-core-com-l1-1-1

CoTaskMemAlloc
CoCreateInstance
StringFromGUID2
CLSIDFromString
CoTaskMemRealloc
CoRevertToSelf
CoImpersonateClient
CoDisconnectObject
CoTaskMemFree

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException
SetLastError

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegGetValueW
RegQueryInfoKeyW
RegQueryValueExW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-synch-l1-2-0

DeleteCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
Sleep
ReleaseSemaphore
LeaveCriticalSection
EnterCriticalSection

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
GetTraceLoggerHandle
TraceMessage
UnregisterTraceGuids

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-2-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventRegister
EventUnregister
EventActivityIdControl

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
OpenThreadToken
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

kernelbase

lstrcmpiW
WTSGetServiceSessionId

regapi

RegGetMachinePolicyNew

user32

UnregisterClassA
LoadStringW

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW

winsta

WinStationQueryInformationW

kernel32

TlsFree
DeleteTimerQueueEx
GetVersionExW
RtlCaptureStackBackTrace
TlsGetValue
GetCurrentThread
VerSetConditionMask
GetComputerNameW
FormatMessageW
GetModuleHandleExA
UnregisterWaitEx
TlsAlloc
RegisterWaitForSingleObject
GetSystemTime
SystemTimeToFileTime
DuplicateHandle
CreateTimerQueue
OpenProcess

api-ms-win-security-base-l1-2-0

CreateWellKnownSid
CheckTokenMembership
DuplicateToken
ImpersonateLoggedOnUser
RevertToSelf
DuplicateTokenEx
GetTokenInformation
AllocateAndInitializeSid

samcli

NetUserGetInfo

crypt32

CryptBinaryToStringW

ws2_32

GetAddrInfoW
WSAStartup
WSACleanup
FreeAddrInfoW

iphlpapi

GetAdaptersAddresses

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

api-ms-win-security-lsalookup-l1-1-1

LookupAccountSidLocalW

api-ms-win-security-lsapolicy-l1-1-0

LsaFreeMemory

cryptsp

CryptReleaseContext
CryptGenRandom
CryptAcquireContextW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

284b17a261d3c79435c0f1eaf8f77c62

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

oleaut32

rpcrt4

api-ms-win-core-heap-l2-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-debug-l1-1-1

api-ms-win-core-profile-l1-1-0

kernelbase

regapi

user32

wtsapi32

winsta

kernel32

api-ms-win-security-base-l1-2-0

samcli

crypt32

ws2_32

iphlpapi

api-ms-win-core-delayload-l1-1-1

api-ms-win-security-lsalookup-l1-1-1

api-ms-win-security-lsapolicy-l1-1-0

cryptsp

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 148KB - Virtual size: 147KB

.data Size: 1024B - Virtual size: 11KB

.idata Size: 7KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 40KB - Virtual size: 40KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 148KB - Virtual size: 147KB

.data
Size: 1024B - Virtual size: 11KB

.idata
Size: 7KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 40KB - Virtual size: 40KB

.reloc
Size: 9KB - Virtual size: 8KB