adsldpc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a37b9763d9cf5f94dd771ad7fc792210N.dll
Resource
win10v2004-20240802-en
General
-
Target
a37b9763d9cf5f94dd771ad7fc792210N.exe
-
Size
252KB
-
MD5
a37b9763d9cf5f94dd771ad7fc792210
-
SHA1
f778a5a3bced9236dce9d5ff4cb04e022059f271
-
SHA256
a31615d7f559479a392b02cdefdc9cf999eec663dd5205d80f8ea31a22bc0611
-
SHA512
28a6f218ceef3de44b963115c9e612eacdbb191a49f8dd0a47a9b83ad89c90b5c78381e723fe3134af7c8861d20316ca54da46fbc6fbcb88b2a4417c72b87030
-
SSDEEP
3072:byW8KRrNaT4j2Kl+VXVbdaF+zzMnwsjJXRvGYeORp5PfTKyNQe6NQVh+jIKlpF0a:bs8rAT4KKl+VFb6YAwsjJXRvB5kgcO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a37b9763d9cf5f94dd771ad7fc792210N.exe
Files
-
a37b9763d9cf5f94dd771ad7fc792210N.exe.dll windows:10 windows x64 arch:x64
7179ba3c109cddec2eca5df68bf7dc63
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_wtoi
_wtol
_vsnwprintf
wcsrchr
wcscat_s
swprintf_s
_wcsicmp
wcsncpy_s
iswdigit
_amsg_exit
free
malloc
_initterm
swscanf_s
wcsncat_s
memset
__C_specific_handler
wcschr
memcpy
memcpy_s
wcscpy_s
memcmp
qsort
bsearch
wcsstr
_wcsnicmp
wcstoul
_XcptFilter
_itow_s
wcscmp
wldap32
ord69
ord309
ord310
ord304
ord301
ord311
ord300
ord146
ord53
ord54
ord91
ord94
ord321
ord319
ord173
ord100
ord116
ord191
ord138
ord135
ord134
ord206
ord194
ord203
ord18
ord133
ord147
ord79
ord224
ord77
ord142
ord97
ord140
ord120
ord167
ord127
ord27
ord26
ord41
ord179
ord40
ord10
ord85
ord111
ord113
ord65
ord161
ord188
ord12
ord165
ord155
ord157
ord190
ord36
ord210
ord13
ord16
ord73
ord216
ord88
ord14
ord145
ord219
ord29
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetCurrentThread
OpenThreadToken
OpenProcessToken
TerminateProcess
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegSetValueExW
RegGetValueW
RegCreateKeyExW
ntdll
EtwEventUnregister
EtwEventRegister
EtwEventWrite
RtlIdentifierAuthoritySid
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
api-ms-win-core-file-l1-1-0
GetFileSize
WriteFile
CreateDirectoryW
DeleteFileW
ReadFile
CompareFileTime
CreateFileW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringOrdinal
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Exports
Exports
??0CLexer@@QEAA@XZ
??1CLexer@@QEAA@XZ
?GetNextToken@CLexer@@QEAAJPEAGPEAK@Z
?InitializePath@CLexer@@QEAAJPEAG@Z
?SetAtDisabler@CLexer@@QEAAXH@Z
?SetExclaimnationDisabler@CLexer@@QEAAXH@Z
?SetFSlashDisabler@CLexer@@QEAAXH@Z
ADSIAbandonSearch
ADSICloseDSObject
ADSICloseSearchHandle
ADSICreateDSObject
ADSIDeleteDSObject
ADSIExecuteSearch
ADSIFreeColumn
ADSIGetColumn
ADSIGetFirstRow
ADSIGetNextColumnName
ADSIGetNextRow
ADSIGetObjectAttributes
ADSIGetPreviousRow
ADSIModifyRdn
ADSIOpenDSObject
ADSIPrint
ADSISetObjectAttributes
ADSISetSearchPreference
ADsAbandonSearch
ADsCloseSearchHandle
ADsCreateAttributeDefinition
ADsCreateClassDefinition
ADsCreateDSObject
ADsCreateDSObjectExt
ADsDecodeBinaryData
ADsDeleteAttributeDefinition
ADsDeleteClassDefinition
ADsDeleteDSObject
ADsEncodeBinaryData
ADsEnumAttributes
ADsEnumClasses
ADsExecuteSearch
ADsFreeColumn
ADsGetColumn
ADsGetFirstRow
ADsGetLastError
ADsGetNextColumnName
ADsGetNextRow
ADsGetObjectAttributes
ADsGetPreviousRow
ADsHelperGetCurrentRowMessage
ADsObject
ADsSetLastError
ADsSetObjectAttributes
ADsSetSearchPreference
ADsWriteAttributeDefinition
ADsWriteClassDefinition
AdsTypeFreeAdsObjects
AdsTypeToLdapTypeCopyConstruct
AdsTypeToLdapTypeCopyDNWithBinary
AdsTypeToLdapTypeCopyDNWithString
AdsTypeToLdapTypeCopyGeneralizedTime
AdsTypeToLdapTypeCopyTime
AllocADsMem
AllocADsStr
BerBvFree
BerEncodingQuotaControl
BuildADsParentPath
BuildADsParentPathFromObjectInfo
BuildADsParentPathFromObjectInfo2
BuildADsPathFromLDAPPath
BuildADsPathFromLDAPPath2
BuildADsPathFromParent
BuildLDAPPathFromADsPath
BuildLDAPPathFromADsPath2
ChangeSeparator
Component
ConvertSidToString
ConvertSidToU2Trustee
ConvertU2TrusteeToSid
FindEntryInSearchTable
FindSearchTableIndex
FreeADsMem
FreeADsStr
FreeObjectInfo
GetDefaultServer
GetDisplayName
GetDomainDNSNameForDomain
GetLDAPTypeName
GetServerAndPort
GetSyntaxOfAttribute
InitObjectInfo
IsGCNamespace
LdapAddExtS
LdapAddS
LdapAttributeFree
LdapCacheAddRef
LdapCloseObject
LdapCompareExt
LdapControlFree
LdapControlsFree
LdapCountEntries
LdapCrackUserDNtoNTLMUser2
LdapCreatePageControl
LdapDeleteExtS
LdapDeleteS
LdapFirstAttribute
LdapFirstEntry
LdapGetDn
LdapGetNextPageS
LdapGetSchemaObjectCount
LdapGetSubSchemaSubEntryPath
LdapGetSyntaxIdOfAttribute
LdapGetSyntaxOfAttributeOnServer
LdapGetValues
LdapGetValuesLen
LdapInitializeSearchPreferences
LdapIsClassNameValidOnServer
LdapMakeSchemaCacheObsolete
LdapMemFree
LdapModDnS
LdapModifyExtS
LdapModifyS
LdapMsgFree
LdapNextAttribute
LdapNextEntry
LdapOpenObject
LdapOpenObject2
LdapParsePageControl
LdapParseResult
LdapReadAttribute
LdapReadAttribute2
LdapReadAttributeFast
LdapRenameExtS
LdapResult
LdapSearch
LdapSearchAbandonPage
LdapSearchExtS
LdapSearchInitPage
LdapSearchS
LdapSearchST
LdapTypeBinaryToString
LdapTypeCopyConstruct
LdapTypeFreeLdapModList
LdapTypeFreeLdapModObject
LdapTypeFreeLdapObjects
LdapTypeToAdsTypeCopyConstruct
LdapTypeToAdsTypeDNWithBinary
LdapTypeToAdsTypeDNWithString
LdapTypeToAdsTypeGeneralizedTime
LdapTypeToAdsTypeUTCTime
LdapValueFree
LdapValueFreeLen
LdapcKeepHandleAround
LdapcSetStickyServer
MapADSTypeToLDAPType
MapLDAPTypeToADSType
PathName
ReadPagingSupportedAttr
ReadSecurityDescriptorControlType
ReadServerSupportsIsADAMControl
ReadServerSupportsIsADControl
ReallocADsMem
ReallocADsStr
SchemaAddRef
SchemaClose
SchemaGetClassInfo
SchemaGetClassInfoByIndex
SchemaGetObjectCount
SchemaGetPropertyInfo
SchemaGetPropertyInfoByIndex
SchemaGetStringsFromStringTable
SchemaGetSyntaxOfAttribute
SchemaIsClassAContainer
SchemaOpen
SortAndRemoveDuplicateOIDs
UnMarshallLDAPToLDAPSynID
intcmp
Sections
.text Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 328B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ