Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
881ecae6e1d75a8d9b4b2a33ed0c9eb9bbdd0a4a4e5efd28ed9d4bb75bc3dd89.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
881ecae6e1d75a8d9b4b2a33ed0c9eb9bbdd0a4a4e5efd28ed9d4bb75bc3dd89.exe
Resource
win10v2004-en-20220113
Target
881ecae6e1d75a8d9b4b2a33ed0c9eb9bbdd0a4a4e5efd28ed9d4bb75bc3dd89
Size
1.9MB
MD5
5284725757caecb744665f5bf9875ee2
SHA1
4e0a1115d4013796b44d952fce4fdc5d15c988e4
SHA256
881ecae6e1d75a8d9b4b2a33ed0c9eb9bbdd0a4a4e5efd28ed9d4bb75bc3dd89
SHA512
a0fe991673fba03b45ada2f04601f24bd8e921526ef911836d57c78fd2a2780d98ac7a1b6ce7056a3bdcc27b30d6aea1e081ffae6c4b8f0f9909abbaa375b6af
resource | yara_rule |
---|---|
sample | family_pandastealer |
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
CN=Piriform Software Ltd,OU=RE 901,O=Piriform Software Ltd,L=London,C=GB
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Piriform Software Ltd,OU=RE 901,O=Piriform Software Ltd,L=London,C=GB
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetVersionExA
QueryPerformanceFrequency
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
GetSystemMetrics
DeleteObject
PathFindExtensionA
GdipGetImageEncoders
InternetCloseHandle
����ܧ܈{Ǽ=B�{�R�Y�(��M������Wsư�${�:ux��d�x��K��V�W��_M�D�{*AX���6��Ir=TG �n飄hNZ��/�F��O&��C��Tn�9(�c8�>��yrd��[d�F������o)-���[NA'>4غ`Q� ���mG�,��U#�^�i�� Gݱ�/ϧ#��~+,�OU�����籾��GoF LV��:{��+[F�<��MVy��$P �j�ww�0!u:.�I�O����~[T�Z�� �ϡC����z P)��*G�A�"F�ڳ��@��l��Ӽ����⯇�oE���j�mtwk�i]���]w]^:Z��P�5G��AH��S��՞��C��5�{�y@���tE��x�[k�a��1������KM��B�P��ȆX���}]k6bsj��s���I���.�� ���x!�o\����� B�X���ا��wr����G`� <�7~[�ᮌv�a=`m-���a� ��$�v�����Pv�����桌!� �I��v�����������������������d���XC�=L%1�����i9���8�:����Q��SU�|��AA����wީW�Fj?����隴=�L$wv灔��鍷����|����#K�<�����;���ΞQ �è������zi'�bR����ٱ��9�_�;vc�aC���ɜ�`Xso��䞖� ��1������ �C8G�Y܉ֻ�w��Uc`V�����Ja�'mDI���+�euJ�E����ґ�$L*�+���˧2��seӻ�Ua �f(51(h3��w�X��SV��W�+��Z�U�E�Q�����'=:��"�5F� �Tsfi"d!`+��Г�����u��h�)����:�$��m]2�@`�H9��ڧ�ֹ7�#~�"V1'��`L���09���?������[|ڒ,xM�L�6��&���>�wڧ�vO��NЁ~���G�b|���6Z3r��(�g<�����\}����S@dmDފ���='!K�n��eC��'4&@�+̞\e��#)�/L�����|͐�~�i^ݞڷ�����C�5q�zq���waq&�d�.����N�ֆ�N��L�W?���ݜ#��Ag��&)qsi��$��y$���4G�R�� ���@P��]�$�$Oi9e�a����_���� m��e�Ũ���� bk;��& �U{�AX1������ɿ�8|ާ��iQ�%���n�n�e�ZLK���g�����!��3��j��`Hdq\7A����6�0�0y�6���^+��v���V��ϊ�&�:ל��8A��8rz�N%bA�������nO�\J����� �밴��wg�EHvF��' ��S���������f�3��!�ɯ��S��j �,ɼ�Z�Ni����*-�m�R>�Y.O���+�������_C=��( �GE�YD\|�M���ȿ����8L��,Riv�}E/�l��m����!RD���X���݊�� ǭ^.�@�v�g�p��H�����6$�ˣxO�>cfz��'��b�n��3����͕U��0)���[�҉���oo>CyF�^�X�K]#0�ߪ�չV��jz���i�&6��3_����9{]t���? ��F�ʹe1�n:��Pκ��"�O&䧖���J���V�/ ���Ƚ}��)1��Φ�z�*b��_�nbOD���?V��x{��hj{V�0=��O���� DP� "O����:7��J.q �-��@���� 2���ƽ$C��n�;]�VQ� O���E�{�z���ޑ�V�2�f :����Uq A�d���NK$�oぼ����}�5�Ms �.�X�W��S�Ef�_z#����ѺV�^~�k>�%�uݓ�֪�"���upj�)}2N �䭙�^o��Y���p�����n*�E��.ῤ<epV�3-1��7��OrufQ�{`��������bxð� 7f�s����G�-���PGr'c�wr��*��j�Z�ج]�O�O|�k�'0�D%k�zkIW�,�o^$҉�v�Y�� ��1�tOt���Ж��Kj�ɕ>=w����А���®����1�����n`]рl}o4p����ʽ�Tb:�Z4uԊ���`��k*��ΖF�f,v|�v�o����@C>_�Y����e�zS�����c�~In�n�+�k5Ů5a��,��Q~� )u��I����߃�%���?k����<V��z���z`�C������2,�D=(u� lja � IR�����`d5� ���U����ĭ�ڒ�[�>$���[Âxs�Ο�gn����k7��}�/������f$f�a�"����W!�gJ�x`�Ϙ���ٙ�t%��-��r�$#J8���d5��^Q6/5B���椈�MH42"g��p(�9��9ry)멬Z�����S�1��48j�u`'���1o�yy�Z���8�3�5���sO��BS�[}T�e��.m��c �)���2AY�r��Znתv�S(#�O�����T�����Bt�q�B���[��9�S�����\1X��R�䦤�[$G^�Z��"t�@�%���-��u���f\��E�́0~�l%��x֬P�&9��>�3\���#0s�!W�>��L��b�A+���#����G.�C��%���K���.YL2UG'n�A>���������;Ac����^nت�g�x�WY�{���D�B~˩��'y�RH�Z�i������k >r�7��'�̺��>�4��HZ۲�\b�O+Yg1�^�O#dD�j�h��(C�͞_��AD�l=����5<���Y ��rbN�=Oޯ�C�,NJ�5�f3@*�^���;���$��o63W|�;k��L�������"j�E. �� �Һ0'���Ox�M���o��ē���2JtKa�X��*s��6 �N�M�'��^Es��j 8g�q0\�?~8F�7U��$u��!��R""X��y��6>%�6�C>Ƭ�}y��NrOn���^��@��T ,6q�4j�=Т���^�/j�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ