PayloadRestrictions[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

PayloadRestrictions.dll
Size

693KB
MD5

237fe0d58fa3f118a35bb0a4aaa9ca3e
SHA1

8b7813f6b9cfb07277a62b93044f734ebaaa8c5b
SHA256

d9d4ea58feebab7366ec715aafbb9eaf6d41520ab39b39097440641449de46b7
SHA512

ae646c991536021feb6393ba2c2609ba392c0d9282958c0a0652c305b1b63fbb12376e9d14c55da12ffe9a921b8a619fa7136a361cbd8c85e8a398ceeb8e3de2
SSDEEP

12288:xKHmHvVL/ol0LjhuyN+RNST3ZG1lJcknJHwzmGf/u+2WlJ2O6CqyJAuMPCIqzhGU:6WTpG1jckJQB3u+2Wl8O6CqyJAuMPCIk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PayloadRestrictions.dll

Files

PayloadRestrictions.dll
.dll windows:10 windows x86 arch:x86

90b0e60284558849c93f12bcf0085517

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

PayloadRestrictions.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o___std_type_info_destroy_list
_o___stdio_common_vswprintf
_o___stdio_common_vswprintf_s
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__itow_s
_o__register_onexit_function
memchr
_o__seh_filter_dll
_o__stricmp
_o__ui64tow_s
_o__ultow_s
_o__wcsicmp
_o__wcsnicmp
_o_free
_o_iswdigit
_o_malloc
_o_realloc
_o_towlower
_o_wcscpy_s
_o_wcsncpy_s
__std_terminate
_except_handler4_common
__CxxFrameHandler3
wcschr
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-rtlsupport-l1-2-0

RtlPcToFileHeader

ntdll

RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlAddVectoredExceptionHandler
NtQueryVirtualMemory
RtlInitUnicodeString
RtlAcquireSRWLockShared
RtlReleaseSRWLockShared
RtlImageNtHeaderEx
RtlCreateUnicodeString
LdrGetDllFullName
LdrGetProcedureAddress
RtlAcquirePebLock
NtProtectVirtualMemory
RtlFindClearBitsAndSet
RtlReleasePebLock
RtlEncodeSystemPointer
RtlRandomEx
RtlInitializeSRWLock
RtlDecodePointer
RtlEncodePointer
RtlRandom
NtAllocateVirtualMemory
LdrQueryImageFileKeyOption
RtlAllocateHeap
NtCreateThreadEx
NtClose
NtCreateEvent
NtSetEvent
RtlFreeHeap
EtwEventUnregister
EtwEventWrite
EtwEventRegister
NtWaitForSingleObject
NtFreeVirtualMemory
NtGetContextThread
NtSetContextThread
RtlNtStatusToDosError
RtlSetLastWin32Error
NtResumeThread
RtlUnhandledExceptionFilter
NtTerminateProcess
NtQueryInformationProcess
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlDecodeSystemPointer

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer

Exports

Exports

MitLibInitialize
MitLibQueryMitigations
MitLibUninitialize

Sections

.text
Size: 514KB - Virtual size: 513KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mrdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90b0e60284558849c93f12bcf0085517

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-rtlsupport-l1-2-0

ntdll

api-ms-win-eventing-provider-l1-1-0

Exports

Exports

Sections

.text Size: 514KB - Virtual size: 513KB

.data Size: 97KB - Virtual size: 97KB

.idata Size: 3KB - Virtual size: 3KB

.mrdata Size: 4KB - Virtual size: 3KB

.detourd Size: 512B - Virtual size: 12B

.detourc Size: 4KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 67KB - Virtual size: 67KB

.text
Size: 514KB - Virtual size: 513KB

.data
Size: 97KB - Virtual size: 97KB

.idata
Size: 3KB - Virtual size: 3KB

.mrdata
Size: 4KB - Virtual size: 3KB

.detourd
Size: 512B - Virtual size: 12B

.detourc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 67KB - Virtual size: 67KB