ResourcePolicyClient[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

ResourcePolicyClient.dll
Size

48KB
MD5

ac25092e9d3c517ec20805ee1694b5c5
SHA1

906cf237391439d0d2e6e5b063e5848880a65a6f
SHA256

cef13e220d8a617cb37f0b6e497a45451c21fe33a0a68e8d9ea037a54e498b4c
SHA512

45e2f2e17758c8621970014167261ddd0d5b728ddb0d2e5e330c3c0edaabb889c5869bbb73bbb24c00dbaaac6a584e8c61a084590d10d54ab2d689a989e1d82c
SSDEEP

768:42nYM1yZ5IdvCSLSwoGJ6js6elbpGdFsZdZPS46LXj1PORM:42nTymDuwoGq/elbpBZvPpepP6M

Score

1^/10

Malware Config

Signatures

Files

ResourcePolicyClient.dll
.dll windows:10 windows x86 arch:x86

081ac3ccb8dcc12fb99b05cc7bae5162

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/07/2018, 20:45

Not After

26/07/2019, 20:45

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:f5:d9:f8:cb:33:c2:ee:b4:cf:cd:0c:b3:55:5d:7b:16:7a:00:72:5d:69:e1:d4:94:2e:aa:79:5e:ca:84:b4
Signer

Actual PE Digest

29:f5:d9:f8:cb:33:c2:ee:b4:cf:cd:0c:b3:55:5d:7b:16:7a:00:72:5d:69:e1:d4:94:2e:aa:79:5e:ca:84:b4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ResourcePolicyClient.pdb

Imports

msvcrt

_onexit
memcpy
__dllonexit
_unlock
_lock
_except_handler4_common
_vsnwprintf
memcpy_s
_callnewh
__CxxFrameHandler3
_initterm
_amsg_exit
_XcptFilter
malloc
free
memset

api-ms-win-security-accesshlpr-l1-1-0

QueryTransientObjectSecurityDescriptor
FreeTransientObjectSecurityDescriptor

api-ms-win-core-psm-key-l1-1-0

PsmGetApplicationNameFromKey
PsmGetPackageFullNameFromKey

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-synch-l1-1-0

ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
WaitForSingleObjectEx
LeaveCriticalSection
EnterCriticalSection
OpenSemaphoreW
CreateMutexExW
InitializeCriticalSectionEx
CreateSemaphoreExW
DeleteCriticalSection

rpcrt4

NdrClientCall4
I_RpcExceptionFilter
RpcBindingCreateW
RpcBindingBind
RpcBindingFree

api-ms-win-security-base-l1-1-0

CreateWellKnownSid

ntdll

TpAllocWork
NtQueryWnfStateData
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
TpPostWork
TpWaitForWork
TpReleaseWork
RtlFreeHeap
NtCreateWnfStateName
RtlSetDaclSecurityDescriptor
RtlAddAccessAllowedAceEx
RtlInitializeSRWLock
RtlCreateAcl
RtlCreateSecurityDescriptor
RtlAllocateHeap
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlDeleteCriticalSection
NtDeleteWnfStateName
NtClose
RtlCopySid
NtQueryInformationToken
NtOpenProcessToken
RtlSubscribeWnfStateChangeNotification

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CreateGameConfigStoreClient
CreateResourcePolicyEngineClient
CreateResourcePolicyStoreClient
FreeGameConfigStoreClient
FreeResourcePolicyStoreClient
InterruptiveUIStateChanged_Subscribe
InterruptiveUIStateChanged_Unsubscribe
QueryApplicationInterruptiveUIState
QueryApplicationInterruptiveUIStateByPsmKey
QueryPackageInterruptiveUIState
ResourcePolicy_GetGlobalProcessAffinityMask
ResourcePolicy_GetProcessAffinityMask
ResourcePolicy_RevertProcessAffinityMask
ResourcePolicy_SetGlobalProcessAffinityMask
ResourcePolicy_SetProcessAffinityMask

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

081ac3ccb8dcc12fb99b05cc7bae5162

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

29:f5:d9:f8:cb:33:c2:ee:b4:cf:cd:0c:b3:55:5d:7b:16:7a:00:72:5d:69:e1:d4:94:2e:aa:79:5e:ca:84:b4Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-security-accesshlpr-l1-1-0

api-ms-win-core-psm-key-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

rpcrt4

api-ms-win-security-base-l1-1-0

ntdll

api-ms-win-core-debug-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 30KB - Virtual size: 29KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 36B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

29:f5:d9:f8:cb:33:c2:ee:b4:cf:cd:0c:b3:55:5d:7b:16:7a:00:72:5d:69:e1:d4:94:2e:aa:79:5e:ca:84:b4
Signer

.text
Size: 30KB - Virtual size: 29KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 36B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB