PayloadRestrictions[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

PayloadRestrictions.dll
Size

690KB
MD5

b7cd036894ce8e64fe622eea8502ff0c
SHA1

8411c1175c8469326d89eff984b0ea5f132e7a19
SHA256

f69b85cacb2ded4593dafec2f5787adb04c7aed187cd179217fecb1eda10706f
SHA512

2d243a01260df3100cf28afaf08771c92b50b0e634448eb15a7ee37d73a7626600e5e8f313f9a1dd1e5c744dba91cfa396cb8ae08ae39e0f87617fe41cd586da
SSDEEP

12288:VWqHvVL/oln3KLjhuyN+RNyThmelehLyZFiKLjo4dygO71EUr3HjsQG2k/8e1:ql3CTbleKFigjo4dyf71EUr3Hj6T1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PayloadRestrictions.dll

Files

PayloadRestrictions.dll
.dll windows:10 windows x86 arch:x86

b290d23d3b45a027de0530985becaa2c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

PayloadRestrictions.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-private-l1-1-0

_o___std_type_info_destroy_list
_o___stdio_common_vswprintf
_o___stdio_common_vswprintf_s
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__itow_s
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
_o__ui64tow_s
_o__ultow_s
_o__wcsicmp
_o__wcsnicmp
_o_free
_o_iswdigit
_o_malloc
_o_realloc
_o_towlower
_o_wcscpy_s
_o_wcsncpy_s
_except_handler4_common
wcschr
memchr
__CxxFrameHandler3
__std_terminate
memcpy

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-rtlsupport-l1-2-0

RtlPcToFileHeader

ntdll

RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlAddVectoredExceptionHandler
NtQueryVirtualMemory
RtlInitUnicodeString
RtlAcquireSRWLockShared
RtlReleaseSRWLockShared
RtlImageNtHeaderEx
RtlCreateUnicodeString
LdrGetDllFullName
LdrGetProcedureAddress
RtlAcquirePebLock
NtProtectVirtualMemory
RtlFindClearBitsAndSet
RtlReleasePebLock
RtlEncodeSystemPointer
RtlRandomEx
RtlInitializeSRWLock
RtlDecodePointer
RtlEncodePointer
RtlRandom
NtAllocateVirtualMemory
LdrQueryImageFileKeyOption
RtlAllocateHeap
NtCreateThreadEx
NtClose
NtCreateEvent
NtSetEvent
RtlFreeHeap
EtwEventUnregister
EtwEventWrite
EtwEventRegister
NtWaitForSingleObject
NtFreeVirtualMemory
NtGetContextThread
NtSetContextThread
RtlNtStatusToDosError
RtlSetLastWin32Error
NtResumeThread
RtlUnhandledExceptionFilter
NtTerminateProcess
NtQueryInformationProcess
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlDecodeSystemPointer

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer

Exports

Exports

MitLibInitialize
MitLibQueryMitigations
MitLibUninitialize

Sections

.text
Size: 511KB - Virtual size: 510KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mrdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b290d23d3b45a027de0530985becaa2c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-rtlsupport-l1-2-0

ntdll

api-ms-win-eventing-provider-l1-1-0

Exports

Exports

Sections

.text Size: 511KB - Virtual size: 510KB

.data Size: 97KB - Virtual size: 97KB

.idata Size: 3KB - Virtual size: 3KB

.mrdata Size: 4KB - Virtual size: 3KB

.detourd Size: 512B - Virtual size: 12B

.detourc Size: 4KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 67KB - Virtual size: 67KB

.text
Size: 511KB - Virtual size: 510KB

.data
Size: 97KB - Virtual size: 97KB

.idata
Size: 3KB - Virtual size: 3KB

.mrdata
Size: 4KB - Virtual size: 3KB

.detourd
Size: 512B - Virtual size: 12B

.detourc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 67KB - Virtual size: 67KB