SDClient[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

SDClient.dll
Size

247KB
MD5

257b3d8a965965f1c1e3d2c1e6e29c51
SHA1

cc4f8dcfab218e5357c9d109ecf0e626f5283a73
SHA256

481034c5fcd3f9622ea11ed7df544347c8b3a564e51274226d850b21c05eab7f
SHA512

276bfe05a94142a8f068a75834164ee3144b5fee00829ef83acd38eb07aa99a07dee6d1b148e27e35f3077da6cff8da11e5f5279a5930c41a95b800b4ebc11a7
SSDEEP

6144:u7YmqRO29JheaOQJPvkwPTkoFoKI6OMOf7W+D3Or4y4C1vM:QYmQnLoQq7d3Of

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SDClient.dll

Files

SDClient.dll
.dll regsvr32 windows:10 windows x86 arch:x86

7e7f3ab358475868cd75dd1420157a52

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

SDClient.pdb

Imports

msvcrt

_vsnprintf
_XcptFilter
_amsg_exit
qsort
_initterm
wcscat_s
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_ultow
memmove_s
_resetstkoflw
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??3@YAXPAX@Z
wcscpy_s
memcpy_s
free
memcmp
??0exception@@QAE@ABV0@@Z
_wcsicmp
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
malloc
wcsncpy_s
_purecall
??_V@YAXPAX@Z
_vsnwprintf
_onexit
_except_handler4_common
??1type_info@@UAE@XZ
_errno
__CxxFrameHandler3
realloc
_callnewh
memmove
memset

ntdll

RtlAllocateAndInitializeSid
RtlAcquireResourceExclusive
NtDuplicateToken
RtlReleaseResource
RtlAcquireResourceShared
RtlEqualSid
RtlLengthSid
RtlNtStatusToDosError
EtwEventUnregister
RtlIpv4StringToAddressW
RtlIpv6StringToAddressW
RtlIpv6AddressToStringW
RtlInitializeResource
RtlDeleteResource
RtlFreeSid
RtlVerifyVersionInfo

oleaut32

SysAllocString
LoadTypeLi
SysFreeString
UnRegisterTypeLi
SysStringLen
RegisterTypeLi
SysAllocStringLen
VarUI4FromStr
VarBstrCmp
SysAllocStringByteLen
SysStringByteLen

rpcrt4

RpcMgmtStopServerListening
RpcImpersonateClient
RpcRevertToSelf
RpcStringBindingComposeW
RpcServerListen
RpcEpResolveBinding
RpcBindingSetAuthInfoExW
RpcBindingFree
RpcServerUnregisterIf
RpcServerRegisterIf
RpcServerUseProtseqEpW
NdrServerCall2
RpcBindingFromStringBindingW
NdrClientCall2
RpcStringFreeW
RpcBindingVectorFree

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-libraryloader-l1-2-0

FindResourceExW
GetModuleHandleW
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
SizeofResource
LoadResource
DisableThreadLibraryCalls
FreeLibrary

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
StringFromGUID2
CLSIDFromString
CoDisconnectObject
CoImpersonateClient
CoRevertToSelf
CoTaskMemRealloc

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegSetValueExW
RegGetValueW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
ReleaseSemaphore

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventActivityIdControl
EventUnregister
EventSetInformation

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
OpenThreadToken

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

kernelbase

lstrcmpiW
WTSGetServiceSessionId

regapi

RegGetMachinePolicyNew

user32

LoadStringW
UnregisterClassA

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW

winsta

WinStationQueryInformationW

kernel32

FormatMessageW
GetModuleHandleExA
GetVersionExW
GetSystemTime
SystemTimeToFileTime
AcquireSRWLockShared
CreateMutexExW
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
OpenSemaphoreW
WaitForSingleObjectEx
RegisterWaitForSingleObject
UnregisterWaitEx
AcquireSRWLockExclusive
CloseThreadpoolTimer
OutputDebugStringW
ReleaseSRWLockExclusive
TlsAlloc
TlsGetValue
DuplicateHandle
ReleaseMutex
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
GetModuleHandleExW
CreateSemaphoreExW
GetModuleFileNameA
OpenProcess
CreateTimerQueue
IsDebuggerPresent
DebugBreak
TlsFree
GetComputerNameW
VerSetConditionMask
GetCurrentThread
RtlCaptureStackBackTrace
DeleteTimerQueueEx

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW

api-ms-win-security-base-l1-1-0

DuplicateToken
CheckTokenMembership
RevertToSelf
DuplicateTokenEx
GetTokenInformation
ImpersonateLoggedOnUser
AllocateAndInitializeSid
CreateWellKnownSid

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

dsrole

DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation

samcli

NetUserGetInfo

crypt32

CryptBinaryToStringW

ws2_32

WSAStartup
WSACleanup
GetAddrInfoW
FreeAddrInfoW

iphlpapi

GetAdaptersAddresses

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-security-lsalookup-l1-1-0

LookupAccountSidLocalW

api-ms-win-security-lsapolicy-l1-1-0

LsaFreeMemory

cryptsp

CryptGenRandom
CryptReleaseContext
CryptAcquireContextW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 181KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7e7f3ab358475868cd75dd1420157a52

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

oleaut32

rpcrt4

api-ms-win-core-heap-l2-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-debug-l1-1-0

kernelbase

regapi

user32

wtsapi32

winsta

kernel32

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

dsrole

samcli

crypt32

ws2_32

iphlpapi

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-security-lsalookup-l1-1-0

api-ms-win-security-lsapolicy-l1-1-0

cryptsp

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 181KB - Virtual size: 180KB

.data Size: 1024B - Virtual size: 12KB

.idata Size: 8KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 45KB - Virtual size: 44KB

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 181KB - Virtual size: 180KB

.data
Size: 1024B - Virtual size: 12KB

.idata
Size: 8KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 45KB - Virtual size: 44KB

.reloc
Size: 10KB - Virtual size: 10KB