Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Static task
static1
Behavioral task
behavioral1
Sample
Release/driver.sys
Resource
win10v2004-20240704-en
Behavioral task
behavioral2
Sample
Release/evo.gj.exe
Resource
win7-20240705-en
Behavioral task
behavioral3
Sample
Release/evo.gj.exe
Resource
win10v2004-20240709-en
Target
Release.rar
Size
2.8MB
MD5
e1c6a115ed32bd2cc5a7c8d45a3ca8e2
SHA1
0f18bf849a617623c76baf32e3e3934e41dc7926
SHA256
ab39d95e561cb33d5b30acae83b6532df74c2e46c2291c85a6a3d55bdb09fe85
SHA512
bcc7f22449755f4f81f963154298f05179e1e63ad3c3ed4d90ac983a3e8d15cb65f79a78f6f43a19c3942abbdb40fea4c089d57e6e67bef9285cf3ad339a50c6
SSDEEP
49152:ToahtCVzF2cZl+yZzpC1oS+jLa+hEva8INqcfbtojspcr+dizAtT8QCv0DhiTjPS:kc4VzRP+yZzpC1oS+La+hEvzmdf+jsQK
Checks for missing Authenticode signature.
resource |
---|
unpack001/Release/evo.gj.exe |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
C:\Users\asin\Desktop\project\driver\x64\Release\driver.pdb
RtlInitUnicodeString
RtlGetVersion
MmUnmapIoSpace
MmMapIoSpaceEx
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoGetCurrentProcess
ObfDereferenceObject
MmCopyMemory
PsLookupProcessByProcessId
MmCopyVirtualMemory
IoCreateDriver
PsGetProcessSectionBaseAddress
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
C:\Users\gg\Downloads\fortnite-external-evo.gj-master\fortnite-external-evo.gj-master\x64\Release\evo.gj.pdb
SystemTimeToFileTime
GetEnvironmentVariableW
WideCharToMultiByte
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
FindClose
FindFirstFileW
FindNextFileW
MultiByteToWideChar
GetModuleHandleExW
FormatMessageW
GetFileSizeEx
GetModuleHandleW
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlVirtualUnwind
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryW
ReadFile
GetFileType
GetStdHandle
ExpandEnvironmentStringsA
WaitForSingleObjectEx
VerifyVersionInfoA
LoadLibraryA
GetSystemTime
CreateFileA
WaitForMultipleObjects
FormatMessageA
GetProcAddress
GetModuleHandleA
FreeLibrary
GetSystemDirectoryA
VerSetConditionMask
SleepEx
Sleep
PeekNamedPipe
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
DeleteCriticalSection
InitializeCriticalSectionEx
DeviceIoControl
LeaveCriticalSection
EnterCriticalSection
GetTickCount
GetLastError
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
lstrcmpiW
CloseHandle
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
CreateFileW
WriteFile
DestroyWindow
GetWindow
GetSystemMetrics
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
SetWindowPos
ShowWindow
GetAsyncKeyState
DispatchMessageW
PeekMessageW
GetForegroundWindow
DefWindowProcA
CreateWindowExA
SetLayeredWindowAttributes
GetWindowRect
LoadIconW
SetWindowLongW
GetDesktopWindow
RegisterClassExA
UpdateWindow
GetKeyState
ScreenToClient
GetActiveWindow
ClientToScreen
LoadCursorW
SetCursor
GetClientRect
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
TranslateMessage
mouse_event
SetClipboardData
GetClipboardData
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
CryptAcquireContextW
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptSignHashW
CryptEnumProvidersW
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
_Query_perf_counter
_Query_perf_frequency
?_Xbad_function_call@std@@YAXXZ
?good@ios_base@std@@QEBA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
Direct3DCreate9Ex
DwmExtendFrameIntoClientArea
ord22
ord26
ord46
ord41
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord50
ord143
ord27
ord211
ord60
ord45
ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext
BCryptGenRandom
__CxxFrameHandler4
wcsstr
memcpy
memset
strrchr
memmove
memcmp
memchr
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
strstr
__std_terminate
__std_exception_copy
__std_exception_destroy
strchr
strerror
_errno
__sys_nerr
exit
system
signal
strerror_s
_exit
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
raise
__p___argc
_configure_narrow_argv
_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_onexit_table
_register_onexit_function
_set_app_type
_seh_filter_exe
terminate
_cexit
_crt_atexit
_beginthreadex
fwrite
ftell
__stdio_common_vfprintf
_set_fmode
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vswprintf
fseek
fread
fclose
fflush
__stdio_common_vsscanf
setbuf
clearerr
_setmode
_fileno
ferror
feof
_wfopen
_open
puts
_close
_write
fputs
_lseeki64
setvbuf
_read
__p__commode
fopen
fgets
fputc
__acrt_iob_func
strcmp
tolower
isspace
strcspn
strpbrk
isupper
_stricmp
isprint
_strnicmp
strncmp
strspn
strncpy
_strdup
qsort
calloc
realloc
_callnewh
malloc
_set_new_mode
free
atof
strtod
strtol
atoi
strtoll
strtoull
strtoul
localeconv
_configthreadlocale
_gmtime64_s
_time64
_gmtime64
_fstat64i32
_fstat64
_stat64i32
_stat64
_access
getenv
floorf
_dclass
__setusermatherr
ceilf
powf
sinf
sqrt
atan2
cosf
sqrtf
pow
asin
tanf
fmodf
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertAddCertificateContextToStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
getsockopt
WSAGetLastError
inet_pton
getsockname
getpeername
htons
__WSAFDIsSet
select
connect
bind
ntohs
ioctlsocket
setsockopt
WSAIoctl
WSASetLastError
getnameinfo
shutdown
gethostname
sendto
recvfrom
ntohl
freeaddrinfo
WSAStartup
getaddrinfo
WSACleanup
accept
closesocket
listen
htonl
socket
send
recv
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ