EasyAntiCheat[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

EasyAntiCheat.dll
Size

1.7MB
MD5

2df19602979b4110b6c05a996eef80a3
SHA1

15c8a404242c00c7f964f54d10bb399f0f7bbc3b
SHA256

e1dd7fd074cdcc8d2b1cc6e63889b575df13694823b50cb83e9bf1cce7cfa8a1
SHA512

d05269c34a18e2cfa866d66c0fd3a89bdc57b6f1aa2e6680f0299989138fa22b67936835acb5389ce2a97bb86a4762f7b739ee2886055ef84a1729301fdf79cd
SSDEEP

24576:VTeQNoXq5d5pD0bSmn9Ua0v7pL0yAVeahQdiH2M7wjHYC1eVu1:VTeQ19g/nh0v7p4yAVxhQY2M7e4C1e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EasyAntiCheat.dll

Files

EasyAntiCheat.dll
.dll windows:6 windows x64

136147a4b501bb58044fa78cbe7f8b4c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualProtect
VirtualAlloc
VirtualQuery

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetProcAddress
GetModuleHandleA
DisableThreadLibraryCalls

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-heap-l2-1-0

GlobalFree
GlobalAlloc

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

d3dcompiler_47

D3DCompile

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo

api-ms-win-core-heap-l1-1-0

HeapCreate
HeapFree
HeapReAlloc
HeapAlloc

api-ms-win-core-processthreads-l1-1-0

OpenThread
SuspendThread
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
ResumeThread

api-ms-win-core-toolhelp-l1-1-0

Thread32Next
CreateToolhelp32Snapshot
Thread32First

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-1

GetThreadContext
SetThreadContext
FlushInstructionCache

msvcp140

_Xtime_get_ticks
_Query_perf_counter
_Thrd_sleep
?uncaught_exception@std@@YA_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Query_perf_frequency
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

d3d11

D3D11CreateDeviceAndSwapChain

winmm

PlaySoundA

user32

CallWindowProcW
GetKeyState
SetWindowLongPtrW
GetAsyncKeyState
GetCapture
FindWindowA
GetClipboardData
ScreenToClient
ClientToScreen
IsChild
EmptyClipboard
GetForegroundWindow
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
ReleaseCapture
GetClientRect
SetCursor
SetCapture
LoadCursorW
SetClipboardData

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow

kernel32

WakeAllConditionVariable
ReleaseSRWLockExclusive
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SleepConditionVariableSRW
AcquireSRWLockExclusive
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext

vcruntime140

memchr
__std_type_info_destroy_list
memset
memcmp
__C_specific_handler
memmove
_CxxThrowException
strstr
memcpy
__std_exception_destroy
__std_exception_copy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf
__stdio_common_vsprintf
_wfopen
fclose
fread
fseek
fflush
ftell
__stdio_common_vswprintf
__stdio_common_vfprintf
fwrite
__acrt_iob_func

api-ms-win-crt-string-l1-1-0

strncpy
strcmp

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_configure_narrow_argv
_seh_filter_dll

api-ms-win-crt-utility-l1-1-0

srand
rand
qsort

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free

api-ms-win-crt-convert-l1-1-0

atof

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

powf
acosf
atan2f
fmodf

Sections

.text
Size: 374KB - Virtual size: 373KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 217KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 364B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

136147a4b501bb58044fa78cbe7f8b4c

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-memory-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

d3dcompiler_47

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-1

msvcp140

d3d11

winmm

user32

imm32

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

vcruntime140_1

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 374KB - Virtual size: 373KB

.rdata Size: 217KB - Virtual size: 216KB

.data Size: 1.1MB - Virtual size: 1.1MB

.pdata Size: 13KB - Virtual size: 13KB

_RDATA Size: 9KB - Virtual size: 8KB

.reloc Size: 512B - Virtual size: 364B

.text
Size: 374KB - Virtual size: 373KB

.rdata
Size: 217KB - Virtual size: 216KB

.data
Size: 1.1MB - Virtual size: 1.1MB

.pdata
Size: 13KB - Virtual size: 13KB

_RDATA
Size: 9KB - Virtual size: 8KB

.reloc
Size: 512B - Virtual size: 364B