Among Us.rar
- SHA256 7fa8c293310f458d6aaf13ee5f88cd5078618c95d661bbe0d1f843dac7a4785f
Static task
static1
Detects file using ACProtect software.
| resource | yara_rule |
|---|---|
| static1/unpack001/Among Us/Among Us_Data/Plugins/x86/steam_api.dll | acprotect |
File was altered after it was signed.
| resource |
|---|
| unpack001/Among Us/Among Us_Data/Plugins/x86/steam_api.dll |
| unpack001/Among Us/Among Us_Data/Plugins/x86/steam_api64.dll |
File was codesigned using an insecure algorithm.
| resource |
|---|
| unpack001/Among Us/Among Us_Data/Plugins/x86/discord_game_sdk.dll |
| unpack001/Among Us/Among Us_Data/Plugins/x86/steam_api64_o.dll |
| unpack001/Among Us/Among Us_Data/Plugins/x86/steam_api_o.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Among Us/Among Us.exe |
| unpack001/Among Us/GameAssembly.dll |
| unpack001/Among Us/UnityCrashHandler32.exe |
| unpack001/Among Us/UnityPlayer.dll |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| unpack001/Among Us/Redist/dxwebsetup.exe |
| unpack001/Among Us/Redist/vcredist_x64.exe |
| unpack001/Among Us/Redist/vcredist_x86.exe |
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=25711,
count=144, id=261, version=25711,
count=18, id=260, version=25711,
count=2, id=257, version=25711,
count=36, id=261, version=26706,
count=17, id=260, version=26706,
count=18, id=259, version=26706,
count=3, id=257, version=27012,
count=78, id=1, productName=Unmarked objects,
count=2, id=261, version=27012,
count=1, id=256, version=27012,
count=1, id=255, version=27012,
count=1, id=258, version=27012,
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Sep 16, 2020
SERIALNUMBER=5128862,CN=Discord Inc.,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=25, id=259, version=26213,
count=136, id=261, version=26213,
count=31, id=260, version=26213,
count=30, id=261, version=26706,
count=15, id=260, version=26706,
count=21, id=259, version=26706,
count=15, id=257, version=26213,
count=185, id=1, productName=Unmarked objects,
count=12, id=260, version=27032,
count=513, productName=Unmarked objects (old),
count=1, id=256, version=27032,
count=1, id=258, version=27032,
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
Codesign digest Mismatch
File was altered after it was signed.
Dec 15, 2017
CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Codesign digest Mismatch
File was altered after it was signed.
Dec 15, 2017
CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Dec 15, 2017
CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Dec 15, 2017
CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Unsigned PE
Checks for missing Authenticode signature.
count=51, id=259, version=27412,
count=177, id=261, version=27412,
count=32, id=260, version=27412,
count=76, id=261, version=29118,
count=17, id=260, version=29118,
count=27, id=259, version=29118,
count=1, id=262, version=27412,
count=21, id=257, version=27412,
count=242, id=1, productName=Unmarked objects,
count=78, id=260, productName=VS2019 v16.8.2 build 29334, version=29334,
count=240, id=261, productName=VS2019 v16.8.2 build 29334, version=29334,
count=1, id=256, productName=VS2019 v16.8.2 build 29334, version=29334,
count=1, id=258, productName=VS2019 v16.8.2 build 29334, version=29334,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Mar 30, 2011
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=13, id=25, version=9210,
count=126, id=1, productName=Unmarked objects,
count=1, id=69, version=9111,
count=24, id=28, version=9178,
count=1, id=61, version=9210,
Jan 8, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jan 8, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=9, id=241, version=40116,
count=124, id=243, version=40116,
count=24, id=242, version=40116,
count=19, id=259, version=24123,
count=19, id=260, version=24123,
count=38, id=261, version=24123,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=337, id=1, productName=Unmarked objects,
count=75, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=2, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Jan 8, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jan 8, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=9, id=241, version=40116,
count=124, id=243, version=40116,
count=24, id=242, version=40116,
count=19, id=259, version=24123,
count=19, id=260, version=24123,
count=38, id=261, version=24123,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=337, id=1, productName=Unmarked objects,
count=75, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=2, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Mar 19, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=1, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=125, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=32, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=94, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=90, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Mar 19, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=1, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=125, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=32, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=94, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=90, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
Unsigned PE
Checks for missing Authenticode signature.
count=21, id=259, version=25711,
count=178, id=261, version=25711,
count=23, id=260, version=25711,
count=1, id=199, version=41118,
count=120, id=261, version=26706,
count=40, id=260, version=26706,
count=28, id=259, version=26706,
count=1, id=262, version=25711,
count=23, id=257, version=25711,
count=244, id=1, productName=Unmarked objects,
count=9, id=260, version=27012,
count=28, id=261, version=27012,
count=1, id=255, version=27012,
count=1, id=258, version=27012,
Unsigned PE
Checks for missing Authenticode signature.
count=58, id=259, version=25711,
count=51, id=259, version=26706,
count=40, id=260, version=26706,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=111, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=536, id=260, productName=VS2015 UPD2 build 23918, version=23918,
count=123, id=261, productName=VS2015 UPD2 build 23918, version=23918,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=171, productName=VS2010 build 30319, version=30319,
count=9, id=261, productName=VS2015 [14.0] build 23026, version=23026,
count=219, id=261, version=25711,
count=2, id=262, version=25711,
count=61, id=260, version=25711,
count=39, id=257, version=25711,
count=544, id=1, productName=Unmarked objects,
count=6, id=199, version=41118,
count=118, id=261, version=26706,
count=265, id=260, version=27012,
count=56, productName=Unmarked objects (old),
count=778, id=261, version=27012,
count=1, id=256, version=27012,
count=1, id=255, version=27012,
count=1, id=258, version=27012,