1

I was Running Yara, The pattern matching swiss knife for malware researchers on the Windows 10.

I ran a scan using rules from Yara Rules from YARA Rules Github and MalwareConfig rules.

I stumbled upon these DLL that had Signatures that matched escalate privileges, and Keyloggers.

  • avicap32.dll
  • mscorlib.dll
  • AcGenerl.dll
  • accessibilitycpl.dll
  • adalsql.dll
  • AtBroker.exe
  • etc

To me it makes sense AcGenerl.dll has a keylogger signatures because it handles keyboard but MsCorlib.dll? it doesn't make sense why it has these signatures.

Any Explanations of why some of these Windows DLL raise flags? (not Intrested why my rules picked up but specifically the programs and libraries)

[Edit] Virus Total also says that these files are not infected by malware or a rootkit.

Could some of these be backdoors? enter image description here

1
  • avicap32.dll is a system process, and uses Windows API to capture AVI formatted content.
  • mscorlib.dll is Multi-language (Microsoft) Standard Common Object Runtime Library.
  • AcGenral.dll is the Windows Compatibility DLL, might be logging information to see if everything went well. I'm not sure about this one.
  • accessibilitycpl.dll is the ease of access control panel. Possible that ease of access needs special permissions in order to work proper, logging of keys could be one.
  • adalsql.dll is Active Directory Authentication Library for SQL Server. An authentication service does handle keyboard stuff and has to log them.
  • AtBroker.exe appears to be Transitions Accessible technologies between desktops. According to fixoserror.com.

It appears to be almost all of these are handling keyboard actions. About, mscorlib.dll it also appears to be used during creation of keyloggers. On turkhackteam.org there's a keylogger thread and debug results provides a mscorlib file. Also about mscorlib this StackOverflow link may give you some great ideas.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.