D3D11CoreCreateDevice
D3D11CoreCreateLayeredDevice
D3D11CoreGetLayeredDeviceSize
D3D11CoreRegisterLayers
D3D11CreateDevice
D3D11CreateDeviceAndSwapChain
D3D11On12CreateDevice
EnableFeatureLevelUpgrade
FW1CreateFactory
Behavioral task
behavioral1
Sample
23959954af5f41d4f6ce084e0a2a6f60eb54a9f53665c7fe6002e58a467694de.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
23959954af5f41d4f6ce084e0a2a6f60eb54a9f53665c7fe6002e58a467694de.dll
Resource
win10v2004-20231215-en
Target
23959954af5f41d4f6ce084e0a2a6f60eb54a9f53665c7fe6002e58a467694de
Size
104KB
MD5
865ce075cce792e78ff5e291d9d04ef3
SHA1
fd693a5ca7fdff54698132e0e96e25d724c7b2cb
SHA256
23959954af5f41d4f6ce084e0a2a6f60eb54a9f53665c7fe6002e58a467694de
SHA512
4c520e8345fa6f16e8baec442a0bb7f3f99155d70362cc8bab62cb2bd9ab80cb37d435e8a0b76c2be24171c729dd06cc008a7a80c4297bc177754eaf0190872f
SSDEEP
3072:xPJV4GGcvsOr8H8WZwm1W1k1ahrczJkq1uM:CGt1wclZNyiq1u
Detects the payload of the r77 rootkit.
resource | yara_rule |
---|---|
sample | r77_payload |
Checks for missing Authenticode signature.
resource |
---|
23959954af5f41d4f6ce084e0a2a6f60eb54a9f53665c7fe6002e58a467694de |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
LoadLibraryA
CreateThread
GetProcAddress
FreeLibrary
FreeConsole
AllocConsole
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetLastError
DeleteCriticalSection
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetSystemDirectoryA
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
HeapReAlloc
CloseHandle
HeapAlloc
GetThreadContext
GetCurrentProcessId
FlushInstructionCache
SetThreadContext
OpenThread
RtlLookupFunctionEntry
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
DisableThreadLibraryCalls
Sleep
GetModuleHandleA
GetCurrentThreadId
VirtualProtect
RtlVirtualUnwind
RtlCaptureContext
MessageBoxA
SetRect
GetWindowLongPtrA
FillRect
DefWindowProcA
CreateWindowExA
RegisterClassExA
CreateSolidBrush
GetCurrentObject
GetObjectA
DeleteObject
?_Xlength_error@std@@YAXPEBD@Z
D3D11CreateDeviceAndSwapChain
__std_type_info_destroy_list
_CxxThrowException
__std_exception_destroy
memmove
memcpy
__CxxFrameHandler3
__std_exception_copy
__C_specific_handler
_purecall
__std_terminate
memset
strcat_s
_cexit
exit
_invalid_parameter_noinfo_noreturn
_initterm
_initterm_e
_seh_filter_dll
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
__acrt_iob_func
__stdio_common_vfwprintf_s
freopen_s
_callnewh
malloc
free
floorf
ceilf
D3D11CoreCreateDevice
D3D11CoreCreateLayeredDevice
D3D11CoreGetLayeredDeviceSize
D3D11CoreRegisterLayers
D3D11CreateDevice
D3D11CreateDeviceAndSwapChain
D3D11On12CreateDevice
EnableFeatureLevelUpgrade
FW1CreateFactory
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ