Static task
static1
Behavioral task
behavioral1
Sample
eaanticheat.dll
Resource
win10v2004-20230703-en
General
-
Target
eaanticheat.sys
-
Size
20.8MB
-
MD5
c7473e6f5abb79556793f277bb216aea
-
SHA1
dd3500474f0418890e241ae08214a32fa372c283
-
SHA256
17e166f970ad37dfaedd62240b68ae8f52ab6a1796c05eab69d5e44e12966c65
-
SHA512
f442be11e270de005c24729549b7215c5d84589e7b361ef60d9f3b4262115acbcdb168de8c94df3c93391bab8cad6345e8dd193213dd61ef20cc130a421c289d
-
SSDEEP
196608:Y3gU/dvSeXfVU84mQRS5DOzd6V9UMJf39RFp2moXon/gbve0dx0LnkT3ssdQidBc:497tD4k5CyJVp/Q6kQs7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eaanticheat.sys
Files
-
eaanticheat.sys.dll windows x64
43cba6df0ca8e2975473092752d9f709
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntoskrnl.exe
ZwQuerySystemInformation
__C_specific_handler
ExFreePool
ExAllocatePool
MmGetSystemRoutineAddress
KeBugCheckEx
fltmgr.sys
FltGetRoutineAddress
hal
KeQueryPerformanceCounter
Sections
.text Size: 4.5MB - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 176KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 16.1MB - Virtual size: 16.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ