Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
0835437ab88f8a6d60e4053373b6c3d3932e5684cd07cce6772ebd349948fd48.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0835437ab88f8a6d60e4053373b6c3d3932e5684cd07cce6772ebd349948fd48.exe
Resource
win10v2004-20220812-en
Target
0835437ab88f8a6d60e4053373b6c3d3932e5684cd07cce6772ebd349948fd48
Size
854KB
MD5
8e71fd3dfacccd0f651df44e2d836c1d
SHA1
8820903f366e0d8647732934412217be00f86d14
SHA256
0835437ab88f8a6d60e4053373b6c3d3932e5684cd07cce6772ebd349948fd48
SHA512
7930c668d6c3d35a2596af0f4d85b9a38494bab4d81727c634cbb78e8f6d095b76d4b58182038f6447d54711253bcc7f0987b31a55e6e004bb2f9141f454212c
SSDEEP
12288:E/aT++N0Dg0LxQ/muW13rw2nrAN/oF4ZEdWFUmrNR:shDg0LxQ/m513r9rAN/4JWGmrNR
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
CN=Beijing Kingsoft Security software Co.\,Ltd,O=Beijing Kingsoft Security software Co.\,Ltd,ST=Beijing,C=CN
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetCurrentThreadId
InitializeCriticalSection
FindFirstFileW
FindClose
CreateMutexW
Sleep
InterlockedIncrement
InterlockedDecrement
FreeLibrary
lstrcmpiW
LoadLibraryExW
RaiseException
SetEvent
DeleteFileW
MoveFileExW
OpenEventW
GetDiskFreeSpaceExW
FindNextFileW
RemoveDirectoryW
WriteFile
GetFileAttributesW
CreateDirectoryW
SystemTimeToFileTime
GetFileSize
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
TerminateProcess
SetFilePointer
GetProcAddress
GetCurrentDirectoryW
LocalFileTimeToFileTime
UnhandledExceptionFilter
GetCurrentProcess
GetStartupInfoW
GetLocalTime
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetProcessHeap
LoadLibraryW
GetModuleHandleW
GetPrivateProfileIntW
CloseHandle
ReadFile
CreateFileW
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
GetLastError
SetLastError
GetModuleFileNameW
FindResourceExW
LoadResource
LockResource
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
GetVersion
GetFileType
GetStdHandle
GlobalMemoryStatus
LoadLibraryA
FlushConsoleInputBuffer
SleepEx
ExpandEnvironmentStringsA
FormatMessageA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
CreateEventW
GetTickCount
InterlockedCompareExchange
LocalFree
SizeofResource
SetFileTime
FindResourceW
SetUnhandledExceptionFilter
CharNextW
DestroyWindow
DefWindowProcW
UnregisterClassA
GetUserObjectInformationW
MessageBoxA
GetProcessWindowStation
RegisterEventSourceA
DeregisterEventSource
RegDeleteValueW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegOpenKeyW
RegCreateKeyExW
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
ReportEventA
SHCreateDirectoryExW
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoUninitialize
CoInitialize
VarUI4FromStr
PathAddBackslashW
PathIsDirectoryW
PathFileExistsW
PathAppendW
PathRemoveFileSpecW
PathRemoveBackslashW
PathFindExtensionW
PathFindFileNameW
SHGetValueW
InitCommonControlsEx
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
vswprintf_s
memmove_s
memcpy_s
wcslen
wcscspn
wcsspn
_invalid_parameter_noinfo
??2@YAPAXI@Z
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABV01@@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
_wtoi
_time32
calloc
free
_recalloc
_wfopen
fread
fwrite
feof
fclose
??_V@YAXPAX@Z
memset
srand
_time64
fwprintf
fflush
_purecall
_wcsicmp
_beginthreadex
malloc
wcsncpy_s
_endthreadex
wcscmp
wcschr
wcscat_s
wcscat
rand
_vswprintf
iswspace
strlen
_vscwprintf
strncmp
memcpy
wcsncpy
strcmp
fputc
sscanf_s
_vsnprintf_s
atoi
fopen_s
fprintf
ferror
ftell
fseek
isspace
strchr
isalnum
tolower
isalpha
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
strncpy
wcsrchr
wcsstr
_wcslwr_s
??3@YAXPAX@Z
strerror
__iob_func
strtoul
sscanf
getenv
_vsnprintf
raise
realloc
qsort
isdigit
fopen
_setmode
_fileno
fgets
_errno
_strnicmp
isxdigit
_gmtime64
isupper
memchr
_stricmp
strtol
fputs
signal
_getch
strrchr
sprintf
strstr
_strtoi64
__sys_nerr
_stat64
_strdup
__CxxFrameHandler3
memmove
_CxxThrowException
__WSAFDIsSet
htons
WSACleanup
getpeername
setsockopt
select
ioctlsocket
WSAStartup
closesocket
WSAGetLastError
recv
send
getsockname
ntohs
connect
socket
WSASetLastError
freeaddrinfo
getsockopt
bind
getaddrinfo
GetModuleFileNameExW
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ