Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
6e4ff974c258619c66aba8cd048c4bb2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6e4ff974c258619c66aba8cd048c4bb2.exe
Resource
win10v2004-20220812-en
Target
6e4ff974c258619c66aba8cd048c4bb2
Size
114KB
MD5
6e4ff974c258619c66aba8cd048c4bb2
SHA1
01000a2ee732bc8284fd1704a60fcd3086a957b3
SHA256
cc1952ae11b76aaef6158e4a9bc75cdd90f365e47a5388766bb4ccba70f6a8f3
SHA512
affee57f94b0f6a793212e0a09279c3ac1482611693b35a08770e227ee1eb87fae49e9a61f8e2633d6c6eb41f8718f96e75dffb570806d310d098fcffbe8ef85
SSDEEP
1536:HFkQITufwkfWJurilmw9BgjKu1sPPxaS4jqY:HWQITufwkeJxlPwV16PkS4jqY
Processes:
resource | yara_rule |
---|---|
sample | family_hermeticwiper |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
StrStrW
StrRChrW
StrChrW
StrToIntW
PathAddExtensionW
PathFindExtensionW
PathFileExistsW
StrCatBuffW
PathAddBackslashW
PathAppendW
StrStrIW
StrCmpNW
wnsprintfW
StrStrA
LZClose
LZCopy
LZOpenFileW
towupper
wcsncpy
memcpy
_except_handler3
memset
HeapAlloc
GetProcessHeap
DeviceIoControl
GetLastError
HeapReAlloc
HeapFree
lstrcmpA
GetSystemTimeAsFileTime
CreateFileW
CloseHandle
SetFilePointerEx
ReadFile
GetDiskFreeSpaceW
lstrlenW
WriteFile
FlushFileBuffers
CreateThread
WaitForMultipleObjects
GetModuleHandleW
GetProcAddress
GetCurrentProcess
VerSetConditionMask
VerifyVersionInfoW
FindResourceW
LoadResource
LockResource
SizeofResource
GetSystemDirectoryW
Sleep
WaitForSingleObject
SetThreadPriority
FindFirstFileW
FindNextFileW
FindClose
GetLogicalDriveStringsW
SetLastError
GetCommandLineW
GetModuleFileNameW
CreateEventW
SetEvent
ExitProcess
GetCurrentProcessId
GetFileInformationByHandle
DeleteFileW
wsprintfW
CharLowerW
InitiateSystemShutdownExW
ControlService
CloseServiceHandle
DeleteService
StartServiceW
ChangeServiceConfigW
QueryServiceStatus
CreateServiceW
OpenServiceW
OpenSCManagerW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegDeleteKeyW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyW
RegCloseKey
RegSetValueExW
CommandLineToArgvW
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ