Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
7de1620f5ff872208f2b1f541f1e1014443e97d8510ed1fd757cc37162211782.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7de1620f5ff872208f2b1f541f1e1014443e97d8510ed1fd757cc37162211782.exe
Resource
win10v2004-20220812-en
Target
7de1620f5ff872208f2b1f541f1e1014443e97d8510ed1fd757cc37162211782
Size
80KB
MD5
410ab0b9d5e81714c709236a20b60af0
SHA1
f7b1d9e8452bd6deab097b3a39f81aa478d69b87
SHA256
7de1620f5ff872208f2b1f541f1e1014443e97d8510ed1fd757cc37162211782
SHA512
069dfc7c39a0e7510cd7b2d5f631870b547ff3a1f8b9a7de5c37b00785981e655ad9b99ce401c5076197430ddb8fa1b8370d35f11d1382b693d73431a6db2b8a
SSDEEP
1536:e3ZGdYREvQpnLpJ+nwWMPFR7cq9jCmqcSLUI3400eV+gacCSsQDSSP67:G7e03t9+YwUIP0FgaYRuSK
resource | yara_rule |
---|---|
sample | upx |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
?AddLongPathPrefixI@@YA_NPA_WI@Z
?CheckDotNetVersionI@@YA_NMM@Z
?CreateLowIntegritySecurityAttributesI@@YA_NPAPAU_SECURITY_ATTRIBUTES@@H@Z
?CreateMapFileWithSDI@@YAPAXPAXKKKPB_W@Z
?CreateMapWithLowIntegrityI@@YAPAXPAXKKKPB_W@Z
?CreateProcessWithLowIntegrityI@@YAXPB_W0@Z
?DownloadFileAsynchI@@YAXPB_W0PAX1@Z
?DownloadFileSynchI@@YA_NPB_W0@Z
?EnumThreadsInMyProcI@@YAIPAKI@Z
?FreeLowIntegritySecurityAttributesI@@YAXPAU_SECURITY_ATTRIBUTES@@@Z
?GetAllDotNetVersionsI@@YAIQAUUT_FLOAT@@I@Z
?GetDotNetVersionI@@YA_NAAUUT_FLOAT@@0@Z
?GetFileNameFromUrlI@@YA_NPB_W0PA_WK@Z
?GetMainThIdByPId32I@@YAKK@Z
?GetMainThIdByPIdI@@YAKK@Z
?GetMainThreadHandleI@@YAPAXKK@Z
?GetPIDByNameExI@@YAKPB_WQAK@Z
?GetPIDByNameI@@YAKPB_W@Z
?GetProcessByPIDI@@YAKKPA_WK@Z
?GetWindowByThreadIdI@@YAPAUHWND__@@K@Z
?HandleFromPtrI@@YAKPAX@Z
?InitSecurityAttributesI@@YAHPAU_SECURITY_ATTRIBUTES@@H@Z
?IsFileExistsI@@YA_NPB_W@Z
?IsFolderExistsI@@YA_NPB_W@Z
?OpenAllThreadsInMyProcI@@YAIPAUTHREAD_DATA@@I@Z
?OperatorMinusSysTime@@YA?AU_SYSTEMTIME@@ABU1@0@Z
?ParseUpdateJSonToParamsI@@YAIPBDPAU_UPDATER_PARAMS@@AAI@Z
?ProcessHttpGetI@@YA_NPB_WAAVUT_STRINGA@@@Z
?ProcessHttpPostI@@YA_NPB_WAAVUT_STRINGA@@@Z
?ProcessHttpPostWithParamsI@@YA_NPB_WPAPB_WAAVUT_STRINGA@@@Z
?RunAsAdminExI@@YAPAXPB_W0H@Z
?RunAsAdminI@@YA_NPB_W0H@Z
?SetCurrentWorkDirectoryI@@YAXXZ
?SuspResumeThreadsInMyProcI@@YAXHK@Z
?SuspendResumeThreadI@@YAXKH@Z
?UT_CreateProcessAsUserFromServiceI@@YAKPB_W0_NHPAK@Z
?UT_CreateProcessAsUserFromServiceUsingProcessTokenI@@YAKKPB_W0HPAK@Z
?UT_CreateProcessAsUserFromServiceUsingProcessTokenI@@YAKPB_W00HPAK@Z
?UT_CreateProcessAsUserFromServiceUsingWinlogonTokenI@@YAKPB_W0HPAK@Z
?UT_DuplicateProcessTokenI@@YA_NKPAPAX@Z
?UT_DuplicateProcessTokenI@@YA_NPB_WPAPAX@Z
?UT_GetUsernameFromProcessTokenI@@YAIPAXPA_WI@Z
?UT_LoadUserProfileI@@YA_NPB_WPAPAUHKEY__@@@Z
?UT_UnloadUserProfileI@@YAXPB_WPAUHKEY__@@@Z
?kd_strcatI@KDStringsApi@@YAPA_WPA_WIPB_W@Z
?kd_strcpyI@KDStringsApi@@YAPA_WPA_WPB_WI@Z
?kd_strlenI@KDStringsApi@@YAIPB_W@Z
?kd_strncpyI@KDStringsApi@@YAPA_WPA_WPB_WI@Z
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ