adsldpc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
adsldpc.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
adsldpc.dll
Resource
win10v2004-20240508-en
General
-
Target
adsldpc.dll
-
Size
198KB
-
MD5
bd62a37e1b0a7719ac0069be5a123f65
-
SHA1
8f0a4bc525fab918455d216406990aa2e5770961
-
SHA256
3fc30272b1f9ee6195519140d60872ab894d3de91495788995590ec979a4e244
-
SHA512
df484176908d78ddf3fe35f6ddc021e7613898d7cd6608bd303f23efdaa6d8a484919cfbe0e2b227e6bfef28b0dfc8291409a05696160f6f14aabd83b5ad68fe
-
SSDEEP
3072:DhVHMWnSfiS9IHBN8tuZT0DbPqKzYTBsAo/E9ROYOIlQ9T1blMmc1XCHfsG+9N:bSqS9IhN84uHusAo3YVGEGo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource adsldpc.dll
Files
-
adsldpc.dll.dll windows:6 windows x86 arch:x86
07ec77fbca959628420f768d811bd910
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_vsnwprintf
memcpy
wcscpy_s
wcsncpy_s
wcscat_s
_wcsicmp
memcpy_s
wcschr
swscanf_s
_wtol
memset
wcstoul
_wtoi
_except_handler4_common
_amsg_exit
_initterm
free
malloc
_XcptFilter
wcsstr
qsort
bsearch
_wcsnicmp
wcsncat_s
iswdigit
swprintf_s
_itow_s
wcsrchr
ntdll
RtlIdentifierAuthoritySid
EtwEventUnregister
EtwEventRegister
EtwEventWrite
wldap32
ord53
ord29
ord133
ord142
ord77
ord140
ord97
ord127
ord27
ord26
ord120
ord12
ord16
ord94
ord301
ord311
ord300
ord54
ord309
ord310
ord304
ord146
ord147
ord14
ord13
ord10
ord41
ord36
ord167
ord224
ord79
ord18
ord203
ord194
ord206
ord134
ord135
ord138
ord191
ord116
ord100
ord173
ord319
ord321
ord179
ord91
ord88
ord145
ord219
ord73
ord216
ord210
ord208
ord190
ord157
ord155
ord165
ord188
ord161
ord69
ord65
ord113
ord111
ord85
ord40
kernel32
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
Sleep
InterlockedExchange
LoadLibraryExA
InterlockedCompareExchange
DelayLoadFailureHook
ExpandEnvironmentStringsW
CompareFileTime
lstrlenW
DeleteFileW
WriteFile
CreateFileW
GetFileSize
ReadFile
CreateDirectoryW
GetModuleFileNameW
SystemTimeToFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetTickCount
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
GetProcAddress
SetLastError
GetSystemDirectoryW
LoadLibraryW
CompareStringW
GetCurrentThread
GetLastError
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
LocalFree
LocalAlloc
GetCurrentProcessId
GetCurrentProcess
CloseHandle
Exports
Exports
??0CLexer@@QAE@XZ
??1CLexer@@QAE@XZ
?GetNextToken@CLexer@@QAEJPAGPAK@Z
?InitializePath@CLexer@@QAEJPAG@Z
?SetAtDisabler@CLexer@@QAEXH@Z
?SetExclaimnationDisabler@CLexer@@QAEXH@Z
?SetFSlashDisabler@CLexer@@QAEXH@Z
ADSIAbandonSearch
ADSICloseDSObject
ADSICloseSearchHandle
ADSICreateDSObject
ADSIDeleteDSObject
ADSIExecuteSearch
ADSIFreeColumn
ADSIGetColumn
ADSIGetFirstRow
ADSIGetNextColumnName
ADSIGetNextRow
ADSIGetObjectAttributes
ADSIGetPreviousRow
ADSIModifyRdn
ADSIOpenDSObject
ADSIPrint
ADSISetObjectAttributes
ADSISetSearchPreference
ADsAbandonSearch
ADsCloseSearchHandle
ADsCreateAttributeDefinition
ADsCreateClassDefinition
ADsCreateDSObject
ADsCreateDSObjectExt
ADsDecodeBinaryData
ADsDeleteAttributeDefinition
ADsDeleteClassDefinition
ADsDeleteDSObject
ADsEncodeBinaryData
ADsEnumAttributes
ADsEnumClasses
ADsExecuteSearch
ADsFreeColumn
ADsGetColumn
ADsGetFirstRow
ADsGetLastError
ADsGetNextColumnName
ADsGetNextRow
ADsGetObjectAttributes
ADsGetPreviousRow
ADsHelperGetCurrentRowMessage
ADsObject
ADsSetLastError
ADsSetObjectAttributes
ADsSetSearchPreference
ADsWriteAttributeDefinition
ADsWriteClassDefinition
AdsTypeFreeAdsObjects
AdsTypeToLdapTypeCopyConstruct
AdsTypeToLdapTypeCopyDNWithBinary
AdsTypeToLdapTypeCopyDNWithString
AdsTypeToLdapTypeCopyGeneralizedTime
AdsTypeToLdapTypeCopyTime
AllocADsMem
AllocADsStr
BerBvFree
BerEncodingQuotaControl
BuildADsParentPath
BuildADsParentPathFromObjectInfo
BuildADsParentPathFromObjectInfo2
BuildADsPathFromLDAPPath
BuildADsPathFromLDAPPath2
BuildADsPathFromParent
BuildLDAPPathFromADsPath
BuildLDAPPathFromADsPath2
ChangeSeparator
Component
ConvertSidToString
ConvertSidToU2Trustee
ConvertU2TrusteeToSid
FindEntryInSearchTable
FindSearchTableIndex
FreeADsMem
FreeADsStr
FreeObjectInfo
GetDefaultServer
GetDisplayName
GetDomainDNSNameForDomain
GetLDAPTypeName
GetServerAndPort
GetSyntaxOfAttribute
InitObjectInfo
IsGCNamespace
LdapAddExtS
LdapAddS
LdapAttributeFree
LdapCacheAddRef
LdapCloseObject
LdapCompareExt
LdapControlFree
LdapControlsFree
LdapCountEntries
LdapCrackUserDNtoNTLMUser2
LdapCreatePageControl
LdapDeleteExtS
LdapDeleteS
LdapFirstAttribute
LdapFirstEntry
LdapGetDn
LdapGetNextPageS
LdapGetSchemaObjectCount
LdapGetSubSchemaSubEntryPath
LdapGetSyntaxIdOfAttribute
LdapGetSyntaxOfAttributeOnServer
LdapGetValues
LdapGetValuesLen
LdapInitializeSearchPreferences
LdapIsClassNameValidOnServer
LdapMakeSchemaCacheObsolete
LdapMemFree
LdapModDnS
LdapModifyExtS
LdapModifyS
LdapMsgFree
LdapNextAttribute
LdapNextEntry
LdapOpenObject
LdapOpenObject2
LdapParsePageControl
LdapParseResult
LdapReadAttribute
LdapReadAttribute2
LdapReadAttributeFast
LdapRenameExtS
LdapResult
LdapSearch
LdapSearchAbandonPage
LdapSearchExtS
LdapSearchInitPage
LdapSearchS
LdapSearchST
LdapTypeBinaryToString
LdapTypeCopyConstruct
LdapTypeFreeLdapModList
LdapTypeFreeLdapModObject
LdapTypeFreeLdapObjects
LdapTypeToAdsTypeCopyConstruct
LdapTypeToAdsTypeDNWithBinary
LdapTypeToAdsTypeDNWithString
LdapTypeToAdsTypeGeneralizedTime
LdapTypeToAdsTypeUTCTime
LdapValueFree
LdapValueFreeLen
LdapcKeepHandleAround
LdapcSetStickyServer
MapADSTypeToLDAPType
MapLDAPTypeToADSType
PathName
ReadPagingSupportedAttr
ReadSecurityDescriptorControlType
ReadServerSupportsIsADAMControl
ReadServerSupportsIsADControl
ReallocADsMem
ReallocADsStr
SchemaAddRef
SchemaClose
SchemaGetClassInfo
SchemaGetClassInfoByIndex
SchemaGetObjectCount
SchemaGetPropertyInfo
SchemaGetPropertyInfoByIndex
SchemaGetStringsFromStringTable
SchemaGetSyntaxOfAttribute
SchemaIsClassAContainer
SchemaOpen
SortAndRemoveDuplicateOIDs
UnMarshallLDAPToLDAPSynID
intcmp
Sections
.text Size: 185KB - Virtual size: 185KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ