Static | ZeroBOX

PE Compile Time

2022-09-06 04:37:06

PE Imphash

31c1dfad666d3014f181289ffa32ae76

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00004481 0x00004600 6.40293352537
.rdata 0x00006000 0x000024be 0x00002600 4.91108665158
.data 0x00009000 0x000005ac 0x00000400 2.88636553974
.rsrc 0x0000a000 0x0000b580 0x0000b600 3.8833158188
.reloc 0x00016000 0x000005cc 0x00000600 6.46143721774

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00014f08 0x00000468 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN GLS_BINARY_LSB_FIRST
RT_ICON 0x00014f08 0x00000468 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN GLS_BINARY_LSB_FIRST
RT_ICON 0x00014f08 0x00000468 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN GLS_BINARY_LSB_FIRST
RT_ICON 0x00014f08 0x00000468 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN GLS_BINARY_LSB_FIRST
RT_ICON 0x00014f08 0x00000468 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN GLS_BINARY_LSB_FIRST
RT_ICON 0x00014f08 0x00000468 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN GLS_BINARY_LSB_FIRST
RT_ICON 0x00014f08 0x00000468 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN GLS_BINARY_LSB_FIRST
RT_ICON 0x00014f08 0x00000468 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN GLS_BINARY_LSB_FIRST
RT_ICON 0x00014f08 0x00000468 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN GLS_BINARY_LSB_FIRST
RT_GROUP_ICON 0x00015370 0x00000084 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_MANIFEST 0x000153f8 0x00000188 LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x406014 CreateEventW
0x406018 GetLastError
0x40601c Process32NextW
0x406024 Process32FirstW
0x406028 CloseHandle
0x406030 OpenProcess
0x406034 VirtualAllocEx
0x40603c GetModuleHandleW
0x406044 GetSystemTime
0x406048 VirtualFreeEx
0x40604c GetProcessTimes
0x406054 WaitForSingleObject
0x406058 GetCurrentProcess
0x40605c GetProcAddress
0x406060 WriteProcessMemory
0x406064 TerminateProcess
0x40606c IsDebuggerPresent
0x406074 GetCurrentProcessId
0x406078 GetCurrentThreadId
0x406080 InitializeSListHead
Library ADVAPI32.dll:
0x406004 OpenProcessToken
Library MSVCP140.dll:
0x40608c _Query_perf_counter
0x406090 _Xtime_get_ticks
0x40611c _Thrd_sleep
Library ntdll.dll:
0x406218 NtCreateThreadEx
Library VCRUNTIME140.dll:
0x406128 memset
0x40612c memmove
0x406130 memcpy
0x406138 __CxxFrameHandler3
0x406140 __current_exception
0x40614c __std_terminate
0x406150 _CxxThrowException
Library api-ms-win-crt-stdio-l1-1-0.dll:
0x4061e0 __p__commode
0x4061e4 _set_fmode
0x4061e8 _fseeki64
0x4061ec fread
0x4061f0 fsetpos
0x4061f4 ungetc
0x4061f8 setvbuf
0x4061fc fgetpos
0x406200 fwrite
0x406204 fgetc
0x406208 fputc
0x40620c fflush
0x406210 fclose
Library api-ms-win-crt-filesystem-l1-1-0.dll:
0x406158 _unlock_file
0x40615c _lock_file
Library api-ms-win-crt-runtime-l1-1-0.dll:
0x406188 _cexit
0x40618c _seh_filter_exe
0x406190 _set_app_type
0x406198 _initterm
0x4061a0 exit
0x4061a4 _exit
0x4061ac __p___argc
0x4061b0 __p___argv
0x4061b4 _c_exit
0x4061c4 _crt_atexit
0x4061c8 terminate
0x4061d0 _controlfp_s
0x4061d4 _initterm_e
Library api-ms-win-crt-heap-l1-1-0.dll:
0x406164 _callnewh
0x406168 malloc
0x40616c free
0x406170 _set_new_mode
Library api-ms-win-crt-math-l1-1-0.dll:
0x406180 __setusermatherr
Library api-ms-win-crt-locale-l1-1-0.dll:
0x406178 _configthreadlocale

!This program cannot be run in DOS mode.
Jhc}Ni
Jhc}Ii
Jhc}Oi
Jhc}Ki
JhRich
`.rdata
@.data
@.reloc
L$D_^[3
bad allocation
Unknown exception
bad array new length
string too long
bad cast
[Evolut Injector] #
Failed to open League of legends process!
Evolut module could not be found. Contact the developer or reinstall the program.
Failed to alloc space in memory!
Failed to write in memory!
LoadLibraryW
Failed to create remote thread in process!
Welcome to Evolut - Skin Changer, loading module...
Looking for League of Legends Processes...
League of Legends.exe not found.
League found, skin module not injected, starting injection.
Skin module injected successfully.
Failed to inject Evolut, trying again...
vector too long
.text$di
.text$mn
.text$x
.text$yd
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCL
.CRT$XCU
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIZ
.CRT$XPA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$r
.rdata$sxdata
.rdata$voltmd
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.data$rs
.rsrc$01
.rsrc$02
WriteProcessMemory
GetCurrentProcess
WaitForSingleObject
OpenProcess
CreateToolhelp32Snapshot
CreateEventW
GetLastError
Process32NextW
K32GetModuleBaseNameW
Process32FirstW
CloseHandle
GetCurrentDirectoryW
GetProcAddress
VirtualAllocEx
SystemTimeToFileTime
GetModuleHandleW
K32EnumProcessModules
GetSystemTime
VirtualFreeEx
GetProcessTimes
KERNEL32.dll
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
ADVAPI32.dll
_Query_perf_frequency
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Xlength_error@std@@YAXPBD@Z
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
MSVCP140.dll
NtCreateThreadEx
ntdll.dll
__CxxFrameHandler3
__std_exception_destroy
__std_exception_copy
__std_terminate
_CxxThrowException
__current_exception
__current_exception_context
memset
_except_handler4_common
VCRUNTIME140.dll
fflush
fclose
_unlock_file
_lock_file
fwrite
fgetpos
setvbuf
ungetc
fsetpos
_fseeki64
_invalid_parameter_noinfo_noreturn
_get_stream_buffer_pointers
_callnewh
malloc
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
__setusermatherr
_get_initial_narrow_environment
_initterm
_initterm_e
_set_fmode
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
terminate
_controlfp_s
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
memcpy
memmove
.?AVbad_alloc@std@@
.?AVbad_cast@std@@
.?AVexception@std@@
.?AVbad_array_new_length@std@@
.?AVtype_info@@
.?AV?$basic_filebuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ifstream@DU?$char_traits@D@std@@@std@@
.?AVios_base@std@@
.?AV?$_Iosb@H@std@@
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_istream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
IDATx^
sgNlnn&
baa!MLL
(Kv$7n
IDATx^
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
0/0@0T0k0r0
1 1)1O1`1i1
3g4 5:5
9&9:9d9p9
9":8:>:D:K:Q:^:j:r:y:
;;+;3;B;W;\;l;s;
<<&<,<9<E<M<\<c<n<t<z<
=6>?>E>V>\>b>i>o>|>
0"0(0/050B0N0V0B1f1
2&222:2G2L2R2\2d2n2w2
354Q4z4
4(5L5T5
0T0q0y0
22%2R2o2
343g3r3
3@4G4M4j4
6J6n6s6
<$=1=f=s=
Y1q1w1
3&353L3R3X3^3d3j3p3
3+484`4r4
6M6)727=7D7W7e7k7q7w7}7
8 80898Q8W8k8~8
8:9C9K9
:;:B:U:k:7;W;a;
;&<1<N<
<2=;=H=N=x=~=
>$>*>0>6><>B>H>N>T>Z>`>f>l>r>x>~>
B1o1x1
4"4,4W4a4k4s4x4
2,20242@2D2`2d2h2l2p2t2x2|2
6 6$6(6,6064686<6@6D6H6T6X6
808@8D8H8P8h8l8
9 9$9(9@9P9`9d9h9p9
:(:,:<:@:D:X:\:`:t:x:
?,?4?<?H?h?t?
0,080X0`0l0
1 1<1@1H1P1X1\1d1h1l1t1
40P0l0
1@1\1x1
Evolut.dll
\Evolut.dll
kernel32.dll
SeDebugPrivilege
Valak Client - Evolut.exe
ev_inj
League of Legends.exe
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Generic.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
Skyhigh BehavesLike.Win32.Generic.lm
ALYac Clean
Cylance Unsafe
Zillya Clean
Sangfor Trojan.Win32.Agent.Vtbt
K7AntiVirus Clean
Alibaba Clean
K7GW Clean
Cybereason Clean
huorong Clean
Baidu Clean
VirIT Clean
Paloalto Clean
Symantec ML.Attribute.HighConfidence
Elastic malicious (moderate confidence)
ESET-NOD32 Clean
APEX Malicious
Avast Clean
Cynet Clean
Kaspersky Clean
BitDefender Clean
NANO-Antivirus Clean
ViRobot Trojan.Win.Z.Possiblethreat.77824.A
MicroWorld-eScan Clean
Tencent Clean
TACHYON Clean
Sophos Generic ML PUA (PUA)
F-Secure Clean
DrWeb Clean
VIPRE Clean
TrendMicro Clean
McAfeeD ti!BBB81A7571C5
Trapmine Clean
FireEye Generic.mg.34563cc2fcd4e6e5
Emsisoft Clean
Ikarus Trojan.SPY.Xegumumune
GData Clean
Jiangmin Trojan.Shelma.mqd
Webroot
Varist Clean
Avira Clean
Antiy-AVL Trojan/Win32.Agent
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Clean
Google Detected
AhnLab-V3 Malware/Win.Generic.C5188365
Acronis Clean
McAfee RDN/Generic.dx
MAX Clean
VBA32 BScope.Trojan.Khalesi
Malwarebytes Generic.Malware/Suspicious
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Rising Clean
Yandex Clean
SentinelOne Clean
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/PossibleThreat
BitDefenderTheta Clean
AVG Clean
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_90% (D)
alibabacloud Clean
No IRMA results available.