ntdsapi.dll

  • File Path: C:\Windows\system32\ntdsapi.dll
  • Description: Active Directory Domain Services API

Hashes

Type Hash
MD5 BC568753179FE7812FE36638457C6F3E
SHA1 A8D2BC2C795FDCF42796260E9727762446BFBBB9
SHA256 3C24C9EEB2BB4CA8B870910BE6EA77891099E26DD12A8B07D0204E6277610974
SHA384 26B609AD554BF5B02FEAE56AB463B3C6E11315D8EAAFF14105F140CEB8850F17E49D563001763AE92EC96FF23EAD08EA
SHA512 6DFC70057C22C474ABB2A0385D4D0941FF56534399EA938FF858ACA7C69862D3BD27D2CFE0174455293D466E42AC50DFB6BE179F6B020827004C9E661EDF2EB7
SSDEEP 3072:C1zntk1MHQ2VVMIVLKXz6+YaFH8NwZaWc52oJe8jOkt8CO:CdtkWTV/2OraFH8NwZaWc52os6Okt8
IMP 964A9AB9A13527FC9BFA5A7D1D1103B8
PESHA1 8570A8C4720A48E268FC9E4997677A6FB81ECA5F
PE256 C560461EE577704615370B29C4153CE1352EFE738EAFB8854BEA4B63229D506D

DLL Exports:

Function Name Ordinal Type
DsMapSchemaGuidsW 82 Exported Function
DsMapSchemaGuidsA 81 Exported Function
DsQuerySitesByCostW 84 Exported Function
DsQuerySitesByCostA 83 Exported Function
DsMakePasswordCredentialsWWorker 78 Exported Function
DsMakePasswordCredentialsW 77 Exported Function
DsMakeSpnW 80 Exported Function
DsMakeSpnA 79 Exported Function
DsReadNgcKeyWWorker 90 Exported Function
DsReadNgcKeyW 89 Exported Function
DsRemoveDsDomainW 92 Exported Function
DsRemoveDsDomainA 91 Exported Function
DsQuoteRdnValueA 86 Exported Function
DsQuerySitesFree 85 Exported Function
DsReadNgcKeyA 88 Exported Function
DsQuoteRdnValueW 87 Exported Function
DsListInfoForServerW 66 Exported Function
DsListInfoForServerA 65 Exported Function
DsListRolesW 68 Exported Function
DsListRolesA 67 Exported Function
DsIsMangledRdnValueW 62 Exported Function
DsIsMangledRdnValueA 61 Exported Function
DsListDomainsInSiteW 64 Exported Function
DsListDomainsInSiteA 63 Exported Function
DsListSitesW 74 Exported Function
DsListSitesA 73 Exported Function
DsMakePasswordCredentialsA 76 Exported Function
DsLogEntry 75 Exported Function
DsListServersForDomainInSiteW 70 Exported Function
DsListServersForDomainInSiteA 69 Exported Function
DsListServersInSiteW 72 Exported Function
DsListServersInSiteA 71 Exported Function
DsRemoveDsServerA 93 Exported Function
DsServerRegisterSpnW 115 Exported Function
DsServerRegisterSpnA 114 Exported Function
DsUnBindW 117 Exported Function
DsUnBindA 116 Exported Function
DsReplicaUpdateRefsW 111 Exported Function
DsReplicaUpdateRefsA 110 Exported Function
DsReplicaVerifyObjectsW 113 Exported Function
DsReplicaVerifyObjectsA 112 Exported Function
DsWriteNgcKeyA 123 Exported Function
DsWriteAccountSpnW 122 Exported Function
DsWriteNgcKeyWWorker 125 Exported Function
DsWriteNgcKeyW 124 Exported Function
DsUnquoteRdnValueA 119 Exported Function
DsUnBindWWorker 118 Exported Function
DsWriteAccountSpnA 121 Exported Function
DsUnquoteRdnValueW 120 Exported Function
DsReplicaDelW 99 Exported Function
DsReplicaDelA 98 Exported Function
DsReplicaFreeInfo 101 Exported Function
DsReplicaDemotionW 100 Exported Function
DsReplicaAddA 95 Exported Function
DsRemoveDsServerW 94 Exported Function
DsReplicaConsistencyCheck 97 Exported Function
DsReplicaAddW 96 Exported Function
DsReplicaSyncAllA 107 Exported Function
DsReplicaSyncA 106 Exported Function
DsReplicaSyncW 109 Exported Function
DsReplicaSyncAllW 108 Exported Function
DsReplicaGetInfoW 103 Exported Function
DsReplicaGetInfo2W 102 Exported Function
DsReplicaModifyW 105 Exported Function
DsReplicaModifyA 104 Exported Function
DsIsMangledDnW 60 Exported Function
DsBindWithSpnExWWorker 15 Exported Function
DsBindWithSpnExW 14 Exported Function
DsClientMakeSpnForTargetServerA 18 Exported Function
DsBindWithSpnW 16 Exported Function
DsBindWithCredW 11 Exported Function
DsBindWithCredA 10 Exported Function
DsBindWithSpnExA 13 Exported Function
DsBindWithSpnA 12 Exported Function
DsCrackSpn2W 24 Exported Function
DsCrackSpn2A 23 Exported Function
DsCrackSpn4W 26 Exported Function
DsCrackSpn3W 25 Exported Function
DsCrackNamesA 20 Exported Function
DsClientMakeSpnForTargetServerW 19 Exported Function
DsCrackNamesWWorker 22 Exported Function
DsCrackNamesW 21 Exported Function
DsaopBindWithSpn 128 Exported Function
DsaopBindWithCred 127 Exported Function
DsaopPrepareScript 130 Exported Function
DsaopExecuteScript 129 Exported Function
DsAddSidHistoryA 2 Exported Function
DsAddCloneDCW 1 Exported Function
DsaopBind 126 Exported Function
DsAddSidHistoryW 3 Exported Function
DsBindToISTGA 7 Exported Function
DsBindingSetTimeout 17 Exported Function
DsBindW 9 Exported Function
DsBindToISTGW 8 Exported Function
DsBindA 4 Exported Function
DsaopUnBind 131 Exported Function
DsBindByInstanceW 6 Exported Function
DsBindByInstanceA 5 Exported Function
DsCrackSpnA 27 Exported Function
DsGetBindInstGuid 49 Exported Function
DsGetBindAnnotW 48 Exported Function
DsGetDomainControllerInfoW 51 Exported Function
DsGetDomainControllerInfoA 50 Exported Function
DsFreeSpnArrayA 45 Exported Function
DsFreeSchemaGuidMapW 44 Exported Function
DsGetBindAddrW 47 Exported Function
DsFreeSpnArrayW 46 Exported Function
DsInheritSecurityIdentityW 57 Exported Function
DsInheritSecurityIdentityA 56 Exported Function
DsIsMangledDnA 59 Exported Function
DsInitDemotionW 58 Exported Function
DsGetRdnW 53 Exported Function
DsGetDomainControllerInfoWWorker 52 Exported Function
DsGetSpnW 55 Exported Function
DsGetSpnA 54 Exported Function
DsFreeDomainControllerInfoA 33 Exported Function
DsFreeCloneDcResult 32 Exported Function
DsFreeDomainControllerInfoWWorker 35 Exported Function
DsFreeDomainControllerInfoW 34 Exported Function
DsCrackUnquotedMangledRdnA 29 Exported Function
DsCrackSpnW 28 Exported Function
DsFinishDemotionW 31 Exported Function
DsCrackUnquotedMangledRdnW 30 Exported Function
DsFreePasswordCredentials 41 Exported Function
DsFreeNgcKeyWorker 40 Exported Function
DsFreeSchemaGuidMapA 43 Exported Function
DsFreePasswordCredentialsWorker 42 Exported Function
DsFreeNameResultW 37 Exported Function
DsFreeNameResultA 36 Exported Function
DsFreeNgcKey 39 Exported Function
DsFreeNameResultWWorker 38 Exported Function

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: ntdsapi.dll
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/67
  • VirusTotal Link: https://www.virustotal.com/gui/file/3c24c9eeb2bb4ca8b870910be6ea77891099e26dd12a8b07d0204e6277610974/detection/

File Similarity (ssdeep match)

File Score
C:\Windows\system32\dcdiag.exe 33
C:\Windows\system32\dsmgmt.exe 38
C:\Windows\system32\repadmin.exe 47

Possible Misuse

The following table contains possible examples of ntdsapi.dll being misused. While ntdsapi.dll is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma image_load_mimikatz_inmemory_detection.yml - 'ntdsapi.dll' DRL 1.0

MIT License. Copyright (c) 2020-2021 Strontic.