entryPoint
Static task
static1
Behavioral task
behavioral1
Sample
RInput.dll
Resource
win10v2004-20240611-en
General
-
Target
RInput.dll
-
Size
21KB
-
MD5
a6727a081bf7f5361a653e8c30440557
-
SHA1
65baec9edb24ac427f6b3bca30eeaafcf16d61ca
-
SHA256
86ac6e926b6b1c517e1a74ecdfd4eeb2fd2457e20cae708858898f2888b59499
-
SHA512
25b6890155f3d83cbc1029e0cb1d9b5f89009bc1f6d22713dcd19672bc0d3a531a4b70b5c7d3e991d99715fbd7f729cdd14f4604fdff3cfd2cf9fa54b1ea462e
-
SSDEEP
384:duOAsr9ll++zrDWCu8uI2Uygg6EdSsHMt2n8Sq3UM8aom7EvUe:3r9ll++zra+2U9g6Shg2nBqEVfvUe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RInput.dll
Files
-
RInput.dll.dll windows:5 windows x86 arch:x86
ea7c45d2327482e090c2cb28f86f6e9b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
shlwapi
PathStripPathW
PathRemoveFileSpecW
comctl32
ord412
ord410
ord413
kernel32
UnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
FreeLibrary
SetEvent
TerminateThread
DisableThreadLibraryCalls
OpenEventA
CloseHandle
GetVersion
InitializeCriticalSection
Sleep
LeaveCriticalSection
GetModuleFileNameW
EnterCriticalSection
GetModuleHandleA
VirtualProtect
DeleteCriticalSection
GetCurrentProcessId
lstrcpyW
CreateThread
SetLastError
FlushInstructionCache
GetCurrentProcess
SetUnhandledExceptionFilter
user32
GetMessageA
DestroyWindow
ClientToScreen
RegisterClassExA
PostQuitMessage
GetRawInputData
GetClientRect
EnumWindows
GetForegroundWindow
SetCursorPos
UnregisterClassA
CreateWindowExA
DefWindowProcA
BlockInput
GetCursorPos
ShowWindow
DispatchMessageA
GetSystemMetrics
IsWindowVisible
GetWindowThreadProcessId
GetWindow
MessageBoxW
RegisterRawInputDevices
msvcp90
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
msvcr90
memcpy
_crt_debugger_hook
memset
wcscpy_s
Exports
Exports
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ