PayloadRestrictions[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

PayloadRestrictions.dll
Size

714KB
MD5

98acab4d6362c6895834f8a90dae7c3d
SHA1

5ed1a341c6d00ec4401498082ceec55be123ebb3
SHA256

2acbc6624d60799b67534dc243c93263fe3a6650a69168b4816a31262111eb3b
SHA512

05a54e25d70fb90fb15ce44e097f6ad3d21ce15064e7d8ffc84ce4c338fffa89a4ef5f23cbd865fda222357e96fe6c763022e25e0083761f2cfd7b74d5e8dbf0
SSDEEP

12288:oWkHvVL/olmlCLjhuyN+RNqTGMzbdSofcgsKm4dygO71EUr3HjsQG2k/80p:97TGMvdxf3sKm4dyf71EUr3Hj6x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PayloadRestrictions.dll

Files

PayloadRestrictions.dll
.dll windows:10 windows x86 arch:x86

f7b5ce18fb98489ab038b3d18b119c47

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

PayloadRestrictions.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-string-l1-1-0

memset
memmove_s

api-ms-win-crt-private-l1-1-0

_o___std_type_info_destroy_list
_o___stdio_common_vswprintf
_o___stdio_common_vswprintf_s
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__itow_s
_o__purecall
_o__register_onexit_function
memcmp
_o__stricmp
_o__ui64tow_s
_o__ultow_s
_o__wcsicmp
_o__wcsnicmp
_o_free
_o_iswdigit
_o_malloc
_o_memcpy_s
_o_realloc
_o_towlower
_o_wcscpy_s
_o_wcsncpy_s
_except_handler4_common
memchr
wcschr
_o__seh_filter_dll
__CxxFrameHandler3
__std_terminate
memcpy

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-rtlsupport-l1-2-0

RtlPcToFileHeader

ntdll

RtlAddVectoredExceptionHandler
NtQueryVirtualMemory
RtlInitUnicodeString
RtlAcquireSRWLockShared
RtlReleaseSRWLockShared
RtlImageNtHeaderEx
RtlCreateUnicodeString
LdrGetDllFullName
LdrGetProcedureAddress
RtlAcquirePebLock
NtProtectVirtualMemory
RtlFindClearBitsAndSet
RtlReleasePebLock
RtlEncodeSystemPointer
RtlRandomEx
RtlDecodeSystemPointer
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
RtlRandom
NtAllocateVirtualMemory
LdrQueryImageFileKeyOption
RtlAllocateHeap
NtCreateThreadEx
NtClose
NtCreateEvent
NtSetEvent
RtlFreeHeap
EtwEventUnregister
EtwEventWrite
EtwEventRegister
NtWaitForSingleObject
NtFreeVirtualMemory
NtGetContextThread
NtSetContextThread
RtlNtStatusToDosError
RtlSetLastWin32Error
NtResumeThread
NtQueryInformationProcess
RtlInitAnsiString
RtlInitializeSRWLock
RtlUnhandledExceptionFilter
NtTerminateProcess
RtlAnsiStringToUnicodeString
RtlEncodePointer
RtlDecodePointer

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
CreateSemaphoreExW
AcquireSRWLockShared

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-handle-l1-1-0

CloseHandle

Exports

Exports

MitLibInitialize
MitLibQueryMitigations
MitLibUninitialize

Sections

.text
Size: 532KB - Virtual size: 532KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mrdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f7b5ce18fb98489ab038b3d18b119c47

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-rtlsupport-l1-2-0

ntdll

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-handle-l1-1-0

Exports

Exports

Sections

.text Size: 532KB - Virtual size: 532KB

.data Size: 97KB - Virtual size: 97KB

.idata Size: 5KB - Virtual size: 4KB

.mrdata Size: 4KB - Virtual size: 3KB

.detourd Size: 512B - Virtual size: 12B

.detourc Size: 4KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 68KB - Virtual size: 68KB

.text
Size: 532KB - Virtual size: 532KB

.data
Size: 97KB - Virtual size: 97KB

.idata
Size: 5KB - Virtual size: 4KB

.mrdata
Size: 4KB - Virtual size: 3KB

.detourd
Size: 512B - Virtual size: 12B

.detourc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 68KB - Virtual size: 68KB