Recently, I’ve been reversing this first-stage that dynamically loads a copy of ntdll.dll in order to hide malicious behavior from Sandboxes and EDRs. This technique has been widely documented in open-source research already, [1][2][3][4][5].

Luckily, ntdll.dll is quite recognizable! I vibe-coded (:D) this small detection to be used by a potential tool for intercepting (in userland) malicious code implementing one of the following behaviors:

1. dynamically loading side-copies of ntdll.dll, or

2. restoring hooked APIs from a clean copy of ntdll.dll

It is called “is_ntdll” and here is the code to it. Enjoy!