PayloadRestrictions[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

PayloadRestrictions.dll
Size

690KB
MD5

274a728bd670a91584f09987202078a3
SHA1

cb1917033999b8fe10ffac47a5e8036e7941286d
SHA256

7a74d0e73e009e98843daf645cb3eb0b9744bea11a134d22d1f8604cf05eeaca
SHA512

d1657e058158ea94acc82cd4ce789981f413d5867b6630b68d6e137004b6ba2d2e47b674494dd42b7c2d01ab6f4cd341a8085620cb39e94365014ea3060d4188
SSDEEP

12288:XWqHvVL/oln3KLjhuyN+RNyT2melehLyZFi9Lji4dygO71EUr3HjsQG2k/8eq:Il3CTWleKFiZji4dyf71EUr3Hj6Tq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PayloadRestrictions.dll

Files

PayloadRestrictions.dll
.dll windows:10 windows x86 arch:x86

b290d23d3b45a027de0530985becaa2c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

PayloadRestrictions.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-private-l1-1-0

_o___std_type_info_destroy_list
_o___stdio_common_vswprintf
_o___stdio_common_vswprintf_s
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__itow_s
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
_o__ui64tow_s
_o__ultow_s
_o__wcsicmp
_o__wcsnicmp
_o_free
_o_iswdigit
_o_malloc
_o_realloc
_o_towlower
_o_wcscpy_s
_o_wcsncpy_s
_except_handler4_common
wcschr
memchr
__CxxFrameHandler3
__std_terminate
memcpy

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-rtlsupport-l1-2-0

RtlPcToFileHeader

ntdll

RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlAddVectoredExceptionHandler
NtQueryVirtualMemory
RtlInitUnicodeString
RtlAcquireSRWLockShared
RtlReleaseSRWLockShared
RtlImageNtHeaderEx
RtlCreateUnicodeString
LdrGetDllFullName
LdrGetProcedureAddress
RtlAcquirePebLock
NtProtectVirtualMemory
RtlFindClearBitsAndSet
RtlReleasePebLock
RtlEncodeSystemPointer
RtlRandomEx
RtlInitializeSRWLock
RtlDecodePointer
RtlEncodePointer
RtlRandom
NtAllocateVirtualMemory
LdrQueryImageFileKeyOption
RtlAllocateHeap
NtCreateThreadEx
NtClose
NtCreateEvent
NtSetEvent
RtlFreeHeap
EtwEventUnregister
EtwEventWrite
EtwEventRegister
NtWaitForSingleObject
NtFreeVirtualMemory
NtGetContextThread
NtSetContextThread
RtlNtStatusToDosError
RtlSetLastWin32Error
NtResumeThread
RtlUnhandledExceptionFilter
NtTerminateProcess
NtQueryInformationProcess
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlDecodeSystemPointer

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer

Exports

Exports

MitLibInitialize
MitLibQueryMitigations
MitLibUninitialize

Sections

.text
Size: 511KB - Virtual size: 510KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mrdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b290d23d3b45a027de0530985becaa2c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-rtlsupport-l1-2-0

ntdll

api-ms-win-eventing-provider-l1-1-0

Exports

Exports

Sections

.text Size: 511KB - Virtual size: 510KB

.data Size: 97KB - Virtual size: 97KB

.idata Size: 3KB - Virtual size: 3KB

.mrdata Size: 4KB - Virtual size: 3KB

.detourd Size: 512B - Virtual size: 12B

.detourc Size: 4KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 67KB - Virtual size: 67KB

.text
Size: 511KB - Virtual size: 510KB

.data
Size: 97KB - Virtual size: 97KB

.idata
Size: 3KB - Virtual size: 3KB

.mrdata
Size: 4KB - Virtual size: 3KB

.detourd
Size: 512B - Virtual size: 12B

.detourc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 67KB - Virtual size: 67KB