adsldpc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
adsldpc.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
adsldpc.dll
Resource
win10v2004-20240226-en
General
-
Target
adsldpc.dll
-
Size
214KB
-
MD5
9c71865feaff30df3fa7910747a97867
-
SHA1
8b1f1fa383c359e7eab1b8e56c48935c94578e0a
-
SHA256
44a3f1fbe7b307001895ce1a6c1b5b80c93098d4c7d70ad638c091a98bc49361
-
SHA512
b20e904167bb027b34c753ab4c364d8653cb44e65b5e7418ea1e891586a8c38f66cdd5cf2491d3df48137fb2b0b65a279dbd8d50e2f5195d8adb03f4d3094f59
-
SSDEEP
3072:mg4oPZWffmeJtH4PzdZVjMlblT1Q9IOIlWkIbuU+xyPPlQnxoylwot+E:SAZWTH4PpZVF+wPP6nxblwD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource adsldpc.dll
Files
-
adsldpc.dll.dll windows:6 windows x86 arch:x86
904a9f53236aea56e2e5dadb7a878ddb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
memcmp
memcpy
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
_vsnwprintf
_wcsnicmp
wcsstr
bsearch
qsort
wcsncat_s
iswdigit
swprintf_s
_itow_s
_wtoi
wcsrchr
wcstoul
swscanf_s
_wtol
_wcsicmp
memcpy_s
wcschr
wcscat_s
wcsncpy_s
wcscpy_s
memset
ntdll
EtwEventWrite
EtwEventUnregister
EtwEventRegister
RtlIdentifierAuthoritySid
wldap32
ord191
ord116
ord100
ord173
ord319
ord321
ord91
ord29
ord53
ord138
ord120
ord12
ord16
ord147
ord146
ord54
ord14
ord94
ord300
ord311
ord301
ord304
ord310
ord309
ord219
ord145
ord88
ord216
ord73
ord13
ord208
ord210
ord36
ord190
ord157
ord155
ord165
ord188
ord161
ord135
ord65
ord113
ord111
ord85
ord10
ord40
ord179
ord41
ord26
ord27
ord127
ord167
ord140
ord97
ord142
ord77
ord224
ord79
ord133
ord18
ord203
ord194
ord206
ord134
ord69
kernel32
CreateFileW
ReadFile
GetFileSize
CreateDirectoryW
GetModuleFileNameW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
GetTickCount
MultiByteToWideChar
FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
CompareStringOrdinal
GetCurrentThread
GetProcAddress
SetLastError
GetLastError
LoadLibraryW
GetSystemDirectoryW
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
LocalFree
LocalAlloc
GetCurrentProcessId
CloseHandle
GetCurrentProcess
DeleteFileW
ExpandEnvironmentStringsW
lstrlenW
CompareFileTime
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
ResolveDelayLoadedAPI
DelayLoadFailureHook
RaiseException
WriteFile
Exports
Exports
??0CLexer@@QAE@XZ
??1CLexer@@QAE@XZ
?GetNextToken@CLexer@@QAEJPAGPAK@Z
?InitializePath@CLexer@@QAEJPAG@Z
?SetAtDisabler@CLexer@@QAEXH@Z
?SetExclaimnationDisabler@CLexer@@QAEXH@Z
?SetFSlashDisabler@CLexer@@QAEXH@Z
ADSIAbandonSearch
ADSICloseDSObject
ADSICloseSearchHandle
ADSICreateDSObject
ADSIDeleteDSObject
ADSIExecuteSearch
ADSIFreeColumn
ADSIGetColumn
ADSIGetFirstRow
ADSIGetNextColumnName
ADSIGetNextRow
ADSIGetObjectAttributes
ADSIGetPreviousRow
ADSIModifyRdn
ADSIOpenDSObject
ADSIPrint
ADSISetObjectAttributes
ADSISetSearchPreference
ADsAbandonSearch
ADsCloseSearchHandle
ADsCreateAttributeDefinition
ADsCreateClassDefinition
ADsCreateDSObject
ADsCreateDSObjectExt
ADsDecodeBinaryData
ADsDeleteAttributeDefinition
ADsDeleteClassDefinition
ADsDeleteDSObject
ADsEncodeBinaryData
ADsEnumAttributes
ADsEnumClasses
ADsExecuteSearch
ADsFreeColumn
ADsGetColumn
ADsGetFirstRow
ADsGetLastError
ADsGetNextColumnName
ADsGetNextRow
ADsGetObjectAttributes
ADsGetPreviousRow
ADsHelperGetCurrentRowMessage
ADsObject
ADsSetLastError
ADsSetObjectAttributes
ADsSetSearchPreference
ADsWriteAttributeDefinition
ADsWriteClassDefinition
AdsTypeFreeAdsObjects
AdsTypeToLdapTypeCopyConstruct
AdsTypeToLdapTypeCopyDNWithBinary
AdsTypeToLdapTypeCopyDNWithString
AdsTypeToLdapTypeCopyGeneralizedTime
AdsTypeToLdapTypeCopyTime
AllocADsMem
AllocADsStr
BerBvFree
BerEncodingQuotaControl
BuildADsParentPath
BuildADsParentPathFromObjectInfo
BuildADsParentPathFromObjectInfo2
BuildADsPathFromLDAPPath
BuildADsPathFromLDAPPath2
BuildADsPathFromParent
BuildLDAPPathFromADsPath
BuildLDAPPathFromADsPath2
ChangeSeparator
Component
ConvertSidToString
ConvertSidToU2Trustee
ConvertU2TrusteeToSid
FindEntryInSearchTable
FindSearchTableIndex
FreeADsMem
FreeADsStr
FreeObjectInfo
GetDefaultServer
GetDisplayName
GetDomainDNSNameForDomain
GetLDAPTypeName
GetServerAndPort
GetSyntaxOfAttribute
InitObjectInfo
IsGCNamespace
LdapAddExtS
LdapAddS
LdapAttributeFree
LdapCacheAddRef
LdapCloseObject
LdapCompareExt
LdapControlFree
LdapControlsFree
LdapCountEntries
LdapCrackUserDNtoNTLMUser2
LdapCreatePageControl
LdapDeleteExtS
LdapDeleteS
LdapFirstAttribute
LdapFirstEntry
LdapGetDn
LdapGetNextPageS
LdapGetSchemaObjectCount
LdapGetSubSchemaSubEntryPath
LdapGetSyntaxIdOfAttribute
LdapGetSyntaxOfAttributeOnServer
LdapGetValues
LdapGetValuesLen
LdapInitializeSearchPreferences
LdapIsClassNameValidOnServer
LdapMakeSchemaCacheObsolete
LdapMemFree
LdapModDnS
LdapModifyExtS
LdapModifyS
LdapMsgFree
LdapNextAttribute
LdapNextEntry
LdapOpenObject
LdapOpenObject2
LdapParsePageControl
LdapParseResult
LdapReadAttribute
LdapReadAttribute2
LdapReadAttributeFast
LdapRenameExtS
LdapResult
LdapSearch
LdapSearchAbandonPage
LdapSearchExtS
LdapSearchInitPage
LdapSearchS
LdapSearchST
LdapTypeBinaryToString
LdapTypeCopyConstruct
LdapTypeFreeLdapModList
LdapTypeFreeLdapModObject
LdapTypeFreeLdapObjects
LdapTypeToAdsTypeCopyConstruct
LdapTypeToAdsTypeDNWithBinary
LdapTypeToAdsTypeDNWithString
LdapTypeToAdsTypeGeneralizedTime
LdapTypeToAdsTypeUTCTime
LdapValueFree
LdapValueFreeLen
LdapcKeepHandleAround
LdapcSetStickyServer
MapADSTypeToLDAPType
MapLDAPTypeToADSType
PathName
ReadPagingSupportedAttr
ReadSecurityDescriptorControlType
ReadServerSupportsIsADAMControl
ReadServerSupportsIsADControl
ReallocADsMem
ReallocADsStr
SchemaAddRef
SchemaClose
SchemaGetClassInfo
SchemaGetClassInfoByIndex
SchemaGetObjectCount
SchemaGetPropertyInfo
SchemaGetPropertyInfoByIndex
SchemaGetStringsFromStringTable
SchemaGetSyntaxOfAttribute
SchemaIsClassAContainer
SchemaOpen
SortAndRemoveDuplicateOIDs
UnMarshallLDAPToLDAPSynID
intcmp
Sections
.text Size: 197KB - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ