EasyAntiCheat[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

EasyAntiCheat.dll
Size

1.7MB
MD5

b474d9748a97a9df9b36ebd98e5727dd
SHA1

fccd9d14f071a8d993228d3475f4cbb54b3ba63a
SHA256

f8452b8ae555b66005c4ebd1d6b42f63059d9c43da25e8c4ec3e01567387e6d2
SHA512

559276d0a787abefd27dc2336cf0268471e9d079c4f068d212f711dee798659a74b1da998e43250ea485203d9ac22c5118dff6a2b377dd924c876fec000ae8c3
SSDEEP

49152:CDYSpjRMA+zyUnVzNov7pYyAVxhQY2M7e4C1ed:mpSzav7pYLxhQY2M7y1ed

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EasyAntiCheat.dll

Files

EasyAntiCheat.dll
.dll windows:6 windows x64

66feec1db3378d42fc630fb664bc6eb6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualAlloc
VirtualQuery
VirtualProtect

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleA
GetModuleFileNameW
DisableThreadLibraryCalls
GetModuleHandleW

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-heap-l2-1-0

GlobalAlloc
GlobalFree

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock
GlobalUnlock

d3dcompiler_47

D3DCompile

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapCreate
HeapAlloc
HeapFree

api-ms-win-core-processthreads-l1-1-0

OpenThread
GetCurrentProcessId
SuspendThread
GetCurrentThreadId
GetCurrentProcess
ResumeThread

api-ms-win-core-toolhelp-l1-1-0

Thread32Next
Thread32First
CreateToolhelp32Snapshot

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-1

FlushInstructionCache
GetThreadContext
SetThreadContext

msvcp140

_Xtime_get_ticks
_Query_perf_counter
_Thrd_sleep
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Query_perf_frequency
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

d3d11

D3D11CreateDeviceAndSwapChain

winmm

PlaySoundA

user32

EmptyClipboard
GetClipboardData
SetClipboardData
CallWindowProcW
GetKeyState
CloseClipboard
GetAsyncKeyState
FindWindowA
ScreenToClient
GetCapture
ClientToScreen
GetCursorPos
IsChild
SetWindowLongPtrW
SetCursorPos
ReleaseCapture
GetClientRect
SetCursor
SetCapture
LoadCursorW
GetForegroundWindow
OpenClipboard

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

kernel32

EnterCriticalSection
SetEvent
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
CreateEventW
RtlLookupFunctionEntry
RtlVirtualUnwind
DeleteCriticalSection
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
ResetEvent
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext

vcruntime140

__std_type_info_destroy_list
memmove
memset
memcpy
__C_specific_handler
memchr
_CxxThrowException
strstr
__std_exception_destroy
memcmp
__std_exception_copy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf
__stdio_common_vsprintf
fread
_wfopen
fflush
fclose
fseek
ftell
fwrite
__stdio_common_vswprintf
__stdio_common_vfprintf
__acrt_iob_func

api-ms-win-crt-string-l1-1-0

strncpy
strcmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-utility-l1-1-0

qsort
srand
rand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
free

api-ms-win-crt-convert-l1-1-0

atof

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

acosf
fmodf
atan2f
powf

Sections

.text
Size: 387KB - Virtual size: 386KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 218KB - Virtual size: 217KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

66feec1db3378d42fc630fb664bc6eb6

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-memory-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

d3dcompiler_47

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-1

msvcp140

d3d11

winmm

user32

imm32

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

vcruntime140_1

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 387KB - Virtual size: 386KB

.rdata Size: 218KB - Virtual size: 217KB

.data Size: 1.1MB - Virtual size: 1.1MB

.pdata Size: 14KB - Virtual size: 13KB

_RDATA Size: 9KB - Virtual size: 8KB

.reloc Size: 512B - Virtual size: 376B

.text
Size: 387KB - Virtual size: 386KB

.rdata
Size: 218KB - Virtual size: 217KB

.data
Size: 1.1MB - Virtual size: 1.1MB

.pdata
Size: 14KB - Virtual size: 13KB

_RDATA
Size: 9KB - Virtual size: 8KB

.reloc
Size: 512B - Virtual size: 376B