E:\DkS3AnticheatBypass\x64\Release\dinput8.pdb
Behavioral task
behavioral1
Sample
dinput8.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dinput8.dll
Resource
win10v2004-20240226-en
General
-
Target
dinput8.dll
-
Size
35KB
-
MD5
3b37d8bbbce586a6f71dff687a25eb9c
-
SHA1
d4da927f4959d468002f3b8286525faadab9f300
-
SHA256
11ac2fb7031c790026fe6c9e962a9d8d65f5a39c851a6c4163b5fd57585ca6c3
-
SHA512
1f50059f4f966fd58bb3980266410e8327b1f7c6cfc9f1fb5a67f0a79b3a2004df72e381c63fb3c100e9ca88f0ab055fc6ebbdd31606a4f142e0e9b477c30be2
-
SSDEEP
768:C7wgx0iIpg3h9Fd9fQq5WL8VtOFyEB4R95eIujL1:C7wgSiwSNbOFZy6jL
Malware Config
Signatures
-
R77 family
-
r77 rootkit payload 1 IoCs
Detects the payload of the r77 rootkit.
resource yara_rule sample r77_payload -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dinput8.dll
Files
-
dinput8.dll.dll windows:6 windows x64 arch:x64
3e1a30afddbae3b96e5fc96a609a2d12
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetPrivateProfileIntW
GetSystemDirectoryW
GetPrivateProfileStringW
DisableThreadLibraryCalls
lstrcatW
FreeConsole
LoadLibraryW
GetCurrentDirectoryW
GetProcAddress
GetModuleHandleW
AllocConsole
VirtualProtect
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
HeapFree
GetCurrentProcess
Thread32Next
lstrlenW
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
GetThreadContext
GetCurrentProcessId
FlushInstructionCache
SetThreadContext
OpenThread
lstrcpynW
GetFileAttributesW
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
Thread32First
GetModuleFileNameA
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
msvcp140
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?_Xlength_error@std@@YAXPEBD@Z
concrt140
?_Byte_reverse_table@details@Concurrency@@3QBEB
vcruntime140
__C_specific_handler
__CxxFrameHandler3
__std_exception_copy
memcpy
memset
wcsstr
__std_type_info_destroy_list
__std_exception_destroy
_CxxThrowException
memmove
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
fseek
__stdio_common_vfwprintf
fclose
__acrt_iob_func
fopen
ftell
freopen_s
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_cexit
_initterm
_initterm_e
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_seh_filter_dll
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
Exports
Exports
DirectInput8Create
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 76B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ