C:\dvs\p4\build\sw\gcomp\rel\gs_04_50\src\Mjolnir\RemoteInput\rxinput\gamepadremapping\_out\win7_amd64_release\rxgamepadremapping.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ac7b2bd6b8a89088a22c4600f23f209d2d89ffe5b104f3cb8b5d692192e5689a.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ac7b2bd6b8a89088a22c4600f23f209d2d89ffe5b104f3cb8b5d692192e5689a.dll
Resource
win10v2004-20240802-en
General
-
Target
ac7b2bd6b8a89088a22c4600f23f209d2d89ffe5b104f3cb8b5d692192e5689a
-
Size
1.3MB
-
MD5
3fbdc7b90146cf125c333fa262f3ed28
-
SHA1
afa48fdad0b9bd4117c7b72e159314fc1a644c83
-
SHA256
ac7b2bd6b8a89088a22c4600f23f209d2d89ffe5b104f3cb8b5d692192e5689a
-
SHA512
fe426f11a1d15fc454507b0e7cfde853d2feca2f539a74943a205536466bd365762cc054fbf18236366258c8e31631b20b6740ba09f5007eaeb540f63a40a812
-
SSDEEP
24576:VFcPrytmi9f0gg530mhOg+9cIkS47rds:VFSyH98g6kmhOf9cIkSyS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ac7b2bd6b8a89088a22c4600f23f209d2d89ffe5b104f3cb8b5d692192e5689a
Files
-
ac7b2bd6b8a89088a22c4600f23f209d2d89ffe5b104f3cb8b5d692192e5689a.dll windows:6 windows x64 arch:x64
b12e441d638ca06c2244039231a36206
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetFullPathNameW
GetModuleFileNameW
LocalAlloc
CreateFileW
GetFileAttributesW
lstrcmpA
GetSystemDirectoryW
OutputDebugStringW
FileTimeToSystemTime
LocalFree
CreateProcessW
GetModuleHandleW
FreeLibrary
SetLastError
CreateProcessA
LoadLibraryExW
CreateEventA
GetModuleHandleA
WaitForSingleObject
Sleep
SetEvent
ResetEvent
RtlCaptureStackBackTrace
LoadLibraryW
WaitForMultipleObjectsEx
UnregisterWaitEx
QueryDepthSList
GetModuleFileNameA
UnmapViewOfFile
VerSetConditionMask
GetProcAddress
VerifyVersionInfoA
MapViewOfFile
OpenFileMappingA
GetCurrentProcessId
DeleteCriticalSection
CreateFileMappingA
CloseHandle
GetLastError
GetCurrentThreadId
InitializeCriticalSection
LeaveCriticalSection
GetCurrentProcess
VerifyVersionInfoW
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
EncodePointer
DecodePointer
RaiseException
TryEnterCriticalSection
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceFrequency
SwitchToThread
GetExitCodeThread
GetNativeSystemInfo
FormatMessageW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
HeapFree
HeapAlloc
GetCurrentThread
GetStdHandle
GetFileType
GetTimeZoneInformation
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadFile
ReadConsoleW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetConsoleCtrlHandler
HeapReAlloc
SetStdHandle
HeapSize
WriteConsoleW
SetEndOfFile
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
SetProcessAffinityMask
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
RtlUnwind
ole32
CoTaskMemFree
shell32
SHGetKnownFolderPath
advapi32
SetSecurityDescriptorDacl
AdjustTokenPrivileges
LookupPrivilegeValueA
InitializeSecurityDescriptor
RegNotifyChangeKeyValue
RegCloseKey
RegGetValueA
RegQueryValueExA
RegCreateKeyExA
RegDeleteKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegEnumKeyExA
OpenProcessToken
Exports
Exports
RxDetourRxInput
RxDetourRxInput2
RxDetourRxInput3
RxInitGamepadRemappingDllResources
RxInstallGamepadRemappingBridge
RxReleaseGamepadRemappingDllResources
Sections
.text Size: 993KB - Virtual size: 993KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 294KB - Virtual size: 293KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 912B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ