Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
Evolut.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Evolut.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
League_Injector.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
League_Injector.exe
Resource
win10v2004-20240419-en
Target
lol_script_14.8.rar
Size
2.6MB
MD5
956d2d5278b72fd1cdbc93ff56d74cfb
SHA1
2c25c8d7ca9c9f30be5a659dcea1a6b6d5e90b15
SHA256
f81a8e34aa90ae946cd21ac247b4bfccecaceff6cd36aa48241d184b9a3f9e53
SHA512
f84b016e2810dc45980fae44e1cb6e87693aeee5950ba5421a51e19a6ab63c182ccf7597fe11536c679ddeac513b8c9f2584f92e01e779567a91008f7832c283
SSDEEP
49152:NS+gNyvqs+7w3WGk8SkyZ1QZJspgFlExnlBnprnVPvOwln:Ng/sN3WGkTn1QqnnhnwIn
Checks for missing Authenticode signature.
resource |
---|
unpack001/Evolut.dll |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
QueryPerformanceCounter
GetModuleHandleW
VirtualQuery
GetCurrentThread
CloseHandle
ExitProcess
FormatMessageA
QueryPerformanceFrequency
GetLastError
LoadLibraryA
GlobalUnlock
WideCharToMultiByte
InitOnceBeginInitialize
InitOnceComplete
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GlobalLock
GlobalFree
GetProcAddress
GlobalAlloc
AreFileApisANSI
MultiByteToWideChar
LocalFree
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetClipboardData
ReleaseCapture
GetClientRect
SetCursor
SetCapture
LoadCursorW
GetClipboardData
SetCursorPos
GetForegroundWindow
CallWindowProcW
GetAsyncKeyState
SetWindowLongW
TrackMouseEvent
ScreenToClient
GetCapture
ClientToScreen
IsChild
SHGetKnownFolderPath
CoTaskMemFree
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
_Query_perf_frequency
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPBDH@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
??1_Lockit@std@@QAE@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??0_Lockit@std@@QAE@H@Z
?uncaught_exceptions@std@@YAHXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Xlength_error@std@@YAXPBD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
D3DCompile
memmove
memcpy
memchr
__CxxFrameHandler3
__std_exception_copy
__std_terminate
strstr
__current_exception
__current_exception_context
_except_handler4_common
_CxxThrowException
memset
__std_type_info_destroy_list
__std_exception_destroy
fgetpos
ungetc
__stdio_common_vsprintf
fsetpos
fwrite
fread
_fseeki64
ftell
fgetc
setvbuf
fclose
fseek
fflush
__stdio_common_vsscanf
_get_stream_buffer_pointers
fputc
_wfopen
free
_callnewh
malloc
ceil
_dsign
_libm_sse2_sqrt_precise
_dclass
_libm_sse2_sin_precise
_libm_sse2_acos_precise
_libm_sse2_cos_precise
strtod
strtoll
strtoul
strtoull
_unlock_file
_lock_file
___lc_codepage_func
setlocale
localeconv
_beginthreadex
_initialize_onexit_table
terminate
_register_onexit_function
abort
_initialize_narrow_environment
_seh_filter_dll
_initterm_e
_initterm
_cexit
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_crt_atexit
_errno
_configure_narrow_argv
qsort
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
q�l}�o~S���gtA��J �*w%��vDW�H���笧����������)����S��#'�lS����S�M��n���i�����~�:�S��r�|���G�&�%9r~������&N ��J50��"�D.�4�h�c��(�SrC���zeZ��+�_��nO�>�@����pg��z��� ���~��6v���A�'�|������Pm����2O*�@T���I�$�AX`�Li$4��l��Z��a 6�vK`�V��[��)[�Y'ؓ���3P�j9a��h�Nu�l.T�Ū�R�1�QA�~���|ȥ��&�6���!�0��֪������X�ı�;�ͩv���EOx!&���(��&�G8��[rP/����YY�\�6U�EN�a6[��vg�C��x��HAU}I��"���^CnBo�&;�y���ɾ��n}�ο@�Ԝ�e��)�2Q3���-Vrt��;B�,A6�H}(a�#����I�%��������U���H�6*4N_֎�K�M���<���ƞ9����-�S��R�:��.-Df�b�E6�����C�Z�<��1�u�7�6}o�S�X��R�]��_ >�%,�N�2�[��H�����TӼgޚh�A���O�'2ڽ�m�Y�=q�c�iD��p�l�RC]��+OG9ɕ�Z���-գI�ԝ) ��BG'�F�ܪ\ �k�]��D�_�N��L�����N��^��`�O�mĦs���ԑ��`�}l��!֮�ע���_x�]���{qG& ��Swv6��;`�(r9Eݚ9�mMiu����,��qI���4��ܮ�g��je�E����H~����]�'P-j�2OhH�ZL�ʂ ��x�z%aA�3�@0D*CH�hqUl����c:����^��|���!'g*e9;��}��J�Ÿc��T��B���£����Õ�M葮�r�K~u}t���VS�:��:&�56 As�! Ǣ")O��G�\NU���tu�l���&ۮs�j����go�>�Y���M�K�� 9}��D�v2��7�CTWҘ�3K8�Ɨo���@��$����κ��ɘ'�;��aJm�aW�!���(��}v���Q���M�w�L{q\M7% \���g�ˮ����8k�3L�_����A�p+��=��*��r��. � ���h�lB����w�x�P � ��g�Z����6��5����G>����NT教��r�����O�b�<����L����@~k���RG��H��d��� ʨ���\�~���b���Z����}���7�Cا��H�(��O�o�p栝�;6�|�3�{L��5�����K�'��?1�y�إ�@��}���Moݸ���/�4[���c��Ðv۪� \�/����I�O1����迫>'~���!B,�� l�Vk�����8���{Y���($O�8���6ptQ�n8��A�-�L�N�,Mnc�Gï^"f]��Z}f�0���${N{]àt����c���X8�Z����;}D\�?Cg?��LI7��>{�D��Xm��|a�(��_�c��S:"�� �R�;���ų���&uAYe_RF$�6M8��]�ۛ�z�2#<��o���,�yF��q��L�F+�����QY��� .{�(`^��m3dq���0�u'̑؝� �y���@Z��jE\Бl'�/�KD��8�#�A�)���$Z�7�<=���^������#�]0�_b>��C��7�K�n�P����P����T��Իo��j��Q�KP�3�뗌f���=+L�7 �� ���� �l� �>� ���i�=�2�P����v^2�-�T�+�$X�l�xƥse�E�����(���aE{�'"h.�f��}��u� ��|2?"�K��`T��+�������P�s$���1Q�?��hj�� 0=0CJ\��_P���ȇ�m�:��`ٹ������Բv��D����?�LW�@�y *b6����<��x�bKP��(UL����+y�"י��4���J���}���(� �fB�� ���dYx���^W��en��v���T3PO��>�5/��40�,ʕ\�~]d�|����8,�e�cU�/Su&19�w�3�TÕ^��'5*���;���]�����O�/G��5�J��î�9��y��~�������lݤ����p�z)Z�h����&�u�{L��1 h��,�o͟Sӊ�BJ\g� `�*�5�CFݱ�C3e���_֟T�NO���^^���vz=L���n![��Et�G���.թ�ed�A(��g�s����T落uxD fK���I��ۥ�k-��.?'�Rk�~T�g�Mm���pҵ�>П�h'���MnUgv[�����D)q���л[78G*I�O�>�g�}y�Y��He=�HQ��U���7l�jb�I�&�sr=��!�5��Mw������倅�P�jZ8I0���u���m��r�t���,t�г^��Yn���'��F �y��8��q��|b�������K�]2��1 PՔ���$@�B��bA�]����iz(>~H�<K�#��v�JPu��� 4(�4��\�hdv,y�o������v�{��L"|xE.�Z3��N�k�mVlj��5mx1ۑU�Ѹ��T ����$;����#��1�Gt .���z[���qe֓ !a/^O��=b�vs�[�tB�y�|�]�,���3d�~�`~���W8�����Eᒓ`5BE���t�]D#,:�����1{��ZF�8��ت���(�A'���Һ�tW�=�?jm��j�0����i(�+Q���fe����b�-�#�B%�&����S�^@�+b{@>'|�,�K K�'���i���Q<���͓����۞d��S �TO�P.�p���g>�}O[F�E�O2҈n�S;_�)u?Q��1W-�����D�hF�o����0����Tq������ͧ\��s{���"��!�r-�� 6�� 2Q��=�WiV�O�Eg���l>�0��/K�Ն�"�]ݩ�s��5�m�6&]̥�.ыO�x,�4~!�^.�����+�."[.��4+{j|ZX5\0^��x��N,]@o�ᑇ����>�� ����N�z���g�1��K�g`Jk�؊��Ѣ�g�w��P\��3��s&�$ht����!�:����Q[���R$�L:�-)\i�r�@���m��=��@�Yp!M�Fl�)�0�c�k�������V�����9E7�4��'~�ݤzxf��� � ������n��U�>-X��wJ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE