adsnds.pdb
Static task
static1
Behavioral task
behavioral1
Sample
adsnds.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
adsnds.dll
Resource
win10v2004-20240802-en
General
-
Target
ecaa54d849ebf5e48b40ee679b44fdbd8c06cba9eee462bc0baf3e27d75ae696N
-
Size
58KB
-
MD5
edf325c21eb764545dfca8960119bd30
-
SHA1
c3267fb1358f341b01f68ca4bc133b55b6cbaf8c
-
SHA256
ecaa54d849ebf5e48b40ee679b44fdbd8c06cba9eee462bc0baf3e27d75ae696
-
SHA512
3d59a823b866b2a505eb66825f61ebba6dc2ffdf4ba2d8562423264b95bc21f535612b7553366d4f9b79587b36fa8494256ce417e14f49d218ef9d5ce0c3d1fc
-
SSDEEP
1536:Q9KOxdtjY4EToJmldjDYPw+HKW459T9GOEHw2qQR:QokIcsdjcUW0EOqw2qi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/adsnds.dll
Files
-
ecaa54d849ebf5e48b40ee679b44fdbd8c06cba9eee462bc0baf3e27d75ae696N.cab
-
adsnds.dll.dll windows:5 windows x86 arch:x86
d7c41631721848b270a565e8a1875f98
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
iswspace
wcscat
wcscpy
_wcsicmp
wcscmp
_purecall
_strupr
malloc
_adjust_fdiv
_initterm
free
wcsncpy
wcslen
_wtoi
_wtol
_except_handler3
wcschr
wcstok
_wcsupr
sprintf
ntdll
RtlInitUnicodeString
RtlTimeToSecondsSince1970
RtlSecondsSince1970ToTime
nwapi32
NwNdsOpenObject
NwNdsCreateQueryNode
NwNdsDeleteQueryTree
NwNdsSearch
NwNdsObjectHandleToConnHandle
NwNdsConnHandleFree
NwNdsChangeUserPassword
NWPGetChallengeKey
NWPChangeObjectPasswordEncrypted
NwNdsGetSyntaxID
NwNdsGetAttrListFromBuffer
NwNdsGetAttrDefListFromBuffer
NwNdsReadClassDef
NwNdsGetClassDefListFromBuffer
NwNdsRenameObject
NwNdsMoveObject
NwNdsPutInBuffer
NwNdsListSubObjects
NwNdsGetObjectListFromBuffer
NwNdsReadObject
NwNdsRemoveObject
NwNdsAddObject
NwNdsCreateBuffer
NwNdsModifyObject
NwNdsFreeBuffer
NwNdsCloseObject
NWCAttachToFileServerW
NWCDetachFromFileServer
NWCScanObject
NwNdsReadAttrDef
advapi32
SystemFunction041
SystemFunction040
nwprovau
NPOpenEnum
activeds
ord23
ord24
ord12
ord14
ord15
ord18
ord17
ord16
ord21
ord22
ord9
ole32
CoCreateInstance
StringFromGUID2
CreatePointerMoniker
winspool.drv
ClosePrinter
OpenPrinterW
SetPrinterW
kernel32
FormatMessageW
LocalFree
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
LocalAlloc
GetTickCount
DeleteCriticalSection
InitializeCriticalSection
WideCharToMultiByte
FileTimeToSystemTime
SystemTimeToFileTime
GetModuleHandleW
LocalFileTimeToFileTime
FileTimeToLocalFileTime
MultiByteToWideChar
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
GetSystemTime
DisableThreadLibraryCalls
QueryPerformanceCounter
GetLastError
InterlockedDecrement
GetCurrentThreadId
user32
LoadStringW
wsprintfW
oleaut32
VariantCopyInd
SysFreeString
VariantClear
VariantInit
VariantCopy
SafeArrayDestroy
SysAllocString
SafeArrayCreate
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
CreateErrorInfo
SetErrorInfo
SafeArrayPutElement
DispGetIDsOfNames
LoadRegTypeLi
DispInvoke
VariantTimeToSystemTime
SystemTimeToVariantTime
Exports
Exports
DllCanUnloadNow
DllGetClassObject
Sections
.text Size: 143KB - Virtual size: 143KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ