Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
641b225c6954c05482069a7b808b24ab8c9dc8c95790d8cf8f4c63d9ebbd6fec.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
641b225c6954c05482069a7b808b24ab8c9dc8c95790d8cf8f4c63d9ebbd6fec.exe
Resource
win10-en-20211208
Target
641b225c6954c05482069a7b808b24ab8c9dc8c95790d8cf8f4c63d9ebbd6fec
Size
290KB
MD5
4f545dff49f81d08736a782751450f71
SHA1
ad82ab937e28a6ddba4a837684185255b26d35ab
SHA256
641b225c6954c05482069a7b808b24ab8c9dc8c95790d8cf8f4c63d9ebbd6fec
SHA512
b62d97e2c8e189020d2d736e449bf1d148b4f97e4f0f16141fcc78a37f5148d75cf5929e1da43492660f9c10261f180dd6af1dfd407470c171ef7faced7d1fb2
SSDEEP
6144:0kBF+kLM9c6IMIzrKpKPNmE0pP7FFECykLFDbNEQ:0kT+Yz6e3PcE0pPHECykLFHH
Processes:
resource | yara_rule |
---|---|
sample | family_sakula |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetModuleHandleA
VirtualAlloc
Sleep
GetCurrentProcess
lstrlenA
GetFileSize
ReadFile
SetFilePointer
CloseHandle
CreateFileA
HeapAlloc
GetProcessHeap
GetModuleFileNameExA
memcpy
memset
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ