Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
2b33c66f91c7c4906a9f2b30b9e91a4d96fe79e49fdc69f9a4a68c0f4a4eb4b4.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
2b33c66f91c7c4906a9f2b30b9e91a4d96fe79e49fdc69f9a4a68c0f4a4eb4b4.exe
Resource
win10v2004-en-20220112
Target
2b33c66f91c7c4906a9f2b30b9e91a4d96fe79e49fdc69f9a4a68c0f4a4eb4b4
Size
129KB
MD5
e567caa2d14fea5c814428dcfbebe4c2
SHA1
74d6a5894887bf0c033c9fb11d6b022f203d8a1d
SHA256
2b33c66f91c7c4906a9f2b30b9e91a4d96fe79e49fdc69f9a4a68c0f4a4eb4b4
SHA512
dc7944682c5665a3c036f8c53681a6a4692642d06b1d35b29116b90be9e8b116eaf00c011038bafd328a4523ac535fc684cb30694633bdc2a159dac64d3d8f28
SSDEEP
1536:tv6BX1RkCqQ3newBN9cCWgSpOjMYDg112QJHVsW2bFcdDLCVa4v3ghsOxqjQ+P0:tCnewn6D3pOgYDu2wW0DLCVa4vRr85C
Processes:
resource | yara_rule |
---|---|
sample | family_neshta |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetCommandLineW
OutputDebugStringA
OutputDebugStringW
CloseHandle
GetLastError
ExitProcess
GetCurrentThreadId
CreateProcessW
GetStartupInfoW
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LocalAlloc
LocalReAlloc
LocalFree
lstrcmpiW
lstrcpynA
lstrcpynW
lstrcatW
lstrlenW
LoadLibraryW
CreateFileW
DecodePointer
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
GetProcessHeap
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
WriteFile
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetStdHandle
GetFileType
GetStringTypeW
RaiseException
DispatchMessageW
TranslateMessage
GetMessageW
wvsprintfW
wvsprintfA
WaitForInputIdle
CharPrevW
CommandLineToArgvW
PathIsRelativeW
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ