Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
0ae6b721ccb5683b889cfdb25f393acd7cddaa1d36953ec25504ec542e083dd1.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
0ae6b721ccb5683b889cfdb25f393acd7cddaa1d36953ec25504ec542e083dd1.exe
Resource
win10v2004-20220812-en
Target
0ae6b721ccb5683b889cfdb25f393acd7cddaa1d36953ec25504ec542e083dd1
Size
1.1MB
MD5
08b0b865b760f02067fa8a30b2fd303f
SHA1
64de29871fb4e63628c2ce1bf3a79a18021ad183
SHA256
0ae6b721ccb5683b889cfdb25f393acd7cddaa1d36953ec25504ec542e083dd1
SHA512
575062f04d3587dbd3dfcceb145fed54a8a1939b407a3da13d3c4705c4e0b5b58f6daf389dbf2dfbb4cce933bb56c1654e8604bbe5d2f254571113ad724d560c
SSDEEP
3072:a1h7JpmJdthgBLehOzOHsK8qPnGvGp1jEwqusivmo3QrwuL9C:a1fpmJl0NGtFPGOjETXcQ8g
Processes:
resource | yara_rule |
---|---|
sample | BazarLoaderVar2 |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
CN=Google LLC,O=Google LLC,L=Mountain View,ST=ca,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
GetModuleHandleA
CloseHandle
WideCharToMultiByte
GetTickCount
lstrlenA
lstrcmpA
GetLastError
HeapReAlloc
GetModuleFileNameW
lstrcpyW
lstrcmpW
GetCurrentProcess
FlushInstructionCache
ReadProcessMemory
TerminateProcess
WaitForSingleObject
ResumeThread
GetThreadContext
CreateProcessA
SetThreadContext
GetStartupInfoW
CreateProcessW
MultiByteToWideChar
GetModuleFileNameA
GetCommandLineW
OpenProcess
Sleep
GlobalAddAtomA
FindAtomA
ExitProcess
SetEnvironmentVariableA
GetCurrentProcessId
WriteConsoleW
CreateFileW
FindClose
WriteFile
FindNextFileW
GetFileSizeEx
FindFirstFileW
GetDateFormatA
GetSystemTime
GetProcessHeap
GetProcAddress
HeapAlloc
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapSize
SetFilePointerEx
LCMapStringW
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetFileType
GetModuleHandleExW
GetStdHandle
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
LocalFree
GetModuleHandleW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
HeapFree
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
CommandLineToArgvW
SHGetFolderPathW
CoCreateInstance
wnsprintfA
wnsprintfW
PathCombineW
PathAppendW
StrRChrA
UrlUnescapeA
StrToIntW
InternetCloseHandle
InternetOpenA
HttpAddRequestHeadersA
InternetSetOptionA
InternetCrackUrlA
HttpSendRequestA
InternetConnectA
HttpQueryInfoA
HttpOpenRequestA
ObtainUserAgentString
select
__WSAFDIsSet
sendto
htons
recvfrom
ntohs
socket
inet_pton
shutdown
closesocket
CryptStringToBinaryA
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ