Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
9acc1458288fd1eab7be7be61cac807438c731b225f6ea0c9574c47111381459.exe
Resource
win7-20221111-en
Target
9acc1458288fd1eab7be7be61cac807438c731b225f6ea0c9574c47111381459
Size
1.1MB
MD5
48fe26157ec95fe60b76324e13238eb5
SHA1
f4b4da151f027075c05ba00da8c43d1458567ab9
SHA256
9acc1458288fd1eab7be7be61cac807438c731b225f6ea0c9574c47111381459
SHA512
25fe5fb0c202798e2fed56988b773a38ccbf8ce89e23659e943de8214527da37d35e555132f10c4089e05840c92cd63562c84ab1868d1a44eebe88cb3a9cc4fd
SSDEEP
24576:QX2rADT1EGa8tB+3WKvyNhXCV4E8BXAfrnkcAqU0AnJtmc+ipU6DA:Q2rAX1ECQGKv+hyz8grnkQf6bN+z
resource | yara_rule |
---|---|
sample | vmprotect |
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
wsprintfW
GetSystemMetrics
CoInitializeSecurity
CLSIDFromString
StringFromCLSID
CoCreateGuid
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemFree
CoInitializeEx
CoSetProxyBlanket
VariantClear
SysAllocString
SysFreeString
GetLocaleInfoW
GetStringTypeW
FlushFileBuffers
ReadFile
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
IsProcessorFeaturePresent
IsValidCodePage
GetOEMCP
CreateDirectoryW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
MultiByteToWideChar
IsDebuggerPresent
GetCurrentProcess
SetLastError
GetLastError
GetFileAttributesW
Sleep
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
ExitProcess
GetVersionExW
SetFileAttributesW
DeleteFileW
GetSystemInfo
CreateMutexW
CloseHandle
WideCharToMultiByte
lstrlenW
GetPrivateProfileStringW
GlobalMemoryStatus
SetFilePointer
GetUserDefaultLCID
SystemTimeToFileTime
InterlockedDecrement
GetComputerNameW
WriteFile
FileTimeToSystemTime
CreateFileW
GetVolumeInformationW
GetLocalTime
CopyFileW
LocalFree
InterlockedIncrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
SetEnvironmentVariableA
RaiseException
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
LoadLibraryW
CreateFileA
SetStdHandle
WriteConsoleW
SetEndOfFile
CompareStringW
GetACP
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
GetCurrentThreadId
TlsFree
TlsSetValue
TlsGetValue
FreeResource
GetProcessHeap
GetCommandLineW
HeapSetInformation
GetStartupInfoW
DeleteFileA
GetSystemTimeAsFileTime
MoveFileW
RtlUnwind
LCMapStringW
GetCPInfo
SetUnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
GetUserNameW
RegQueryValueExW
SHGetSpecialFolderPathW
SHFileOperationW
ShellExecuteW
SHGetFolderPathW
PathAppendW
InternetOpenW
InternetCloseHandle
InternetOpenUrlW
InternetQueryOptionW
GetAdaptersInfo
��)`۬��/�&w�<�4nI1Ȅ�0U�=F�Z0'D�w<煲qa�����#��ߙ�y,��h�Cݱ�q���#<[�7�hv���=��f�K��|p�֝�r�I��{�iLA�P�v����[��|��8 T��S1�Pǵ���ưD�T��ϙ����:�`�k|���zˢG�ҩ�����t$�Ķ��Nmu0�xO'���e;zo!Si)T�n<1���y�|��j���Z�ݬ�ȗ� G�tOhIy����#�Y1�H�ށM|!���湝� + �W�E���|\�E�+%ڊg�d�C�d^su��b]�@K�tY_#^�Q��ew\-�-�E�E������e0���K�@�a���ib�EN�]3m]��Ɍ���%�M��*Rx^w6������>��b鮐��������5�#T����2-�)�(\}����n#ho��q%sʌvɏ�Xs%�x�I:�}��>����Qk�����ƷA��yiq�6&������ڤ��A ��A�+���~�}�)^W@�,G��d7W_L&�8��n�! Y����Ys�_��̂���~nz6�0�z%*'P�}���/����#<$��i7���a:���f��բ��45���w�D�b QL�GS���N|��G P]9��T/��o��ៈ�ԑQ�py_�<����}{�wsR�!�q4�'k�qZ��ӱ�W�DT��>+�<���9/P\NYM%JJ�~�>�To X�������공dh�s�$5�ڻk掿��M��gld����s���[�l�ug�������0��!�)���yj����q-��������VY�#yp~JI��6s�znU�U�T�szݿ%���gG4���[E��h���.��gC������e����|^�S�������vm�%=�ϖ�}��$��#��d�6�(�8k�"���X!�]�D�;���Iz9��;�cu���ⴿw��Qb`�U�w��2e���bw��f��/�����es��S �}�{�^���z�9��6�.I>�ߟ��WR�=ZCai2?�'��9��}���暴�+�8���0�968�(��#sf�`��0d3�B�Ү�U([���IOW�5�a�0�I��8���d���a�=�q9_��vG��Մ�1&=��2�7���TL%ב��+E��@'��-@��G���&��>����M}����B8[�U����MyzY&���( �����a�$�c�:��EP�b�ju��SELƔ%�i+P�)v�����M%�3��x'Ն7z������G��9~CTc�,8DQFmm7�u[���d�O�5����w���4n�h3�7(��kǖ�uh�C젳�پ����[>�wqxE"I��+ӵ�ff؉�����@;F�Ɲ/�a%K0����)]-|���v��JHɌ0�������Hp輘��%��U��:�T���V�]����Rx�p�7t��v;S9��>�`�i ?��<T����˚c����#F��u�q͉|8� ���DZ�'�YڞY!YY⍂S'�ͬ��*r�7���J�xo�7&����yg@���z�+�q�a� e��y7჻�ʽY4��iۍ��1��W�(�X��Ϩ(@�*���X��6�Ə����� �Wp~!hϙ�F���Y�Z�X�3=�SqΈG/�D& *�jj��u^��O��`Z��g��a��HJ7P�g�f�߮�4]z�غ�i1��@�M݈{�G4��;k�1�?���uu����"Si�!��5���iP/\��|���B��D�M�=^c���Ha��\J �s;=��k&�*���P�I~g4~��y��U�h���-���|ۜN!�*�_i0d^�}�K��b�C��߫�@������Jr��F����R+�*[Rf��UK=����l����*�k���2�eࢫ��K ���l4f)��f4(��a�{�ז���X�/R�WK:Q�r��/G�;�����#Q���.��GO� 40��*��h�y�\������ZJ�b���a��[1���3���n�G�H�7�]�� �ܷE�E�O�J=D�ݗa�y��j ������P�Q/�Y��!�3�L�<��Dz�T������������[3 SQ��d�aX�n2��QQ��_��������mMZ� 09�T������W�];�Le�(�k�)71��@�E�~�|��iy�64����+`ض��K�g������V�,��� D�f��e� ���MR<88�Ե`�'d~$����b%�B���ȣ�h��tɜ()o k�B[Y���ǭߊ)�UI&�����C���ֱ����X��Q��� 7���G�����w�n��&��!��8��T���3��Ƅr�����9�����s@5V�,J��A��ӑ�eR7FcPB�ϑ�^�h���Ue�7�V�̤i�WPM�滓%�vv����ip��O�g��vh9�4:I*簜�)����2��i�E������Ŭ;WWf�tY�����(>����E����Qf�����S�-T��oX��;3��8 ������[���[�q�h��Z���e��8����#��ݻ���U�y%H���du�J��o�����<�{,�WF��t��({S������������;0�����֓�5��� ��ZZ������ʆ��%��h-��0ˋuTkI~%3�7�����m_tCz����P�?V�M���X ����:��O��O*9���ARNk�ͬ>�4�ѽ���:h�F�*��:ؘ���Q����~�B���9������ù� ��O�tA�=X�X��ݓ�h�"Z��8��e���v����B2@������j�/ټAl��od����|���5K���^�1���$�������Fc�$� <��u�A��w���71?/!B���d)z=��<sjr^�s���Mt{�I��. %ޯ���C3K�l�c���n.�o��<Br���]�L�4�#�:�� "B�������-Ҁ�%�Ό�)��ZQM�*%vm�aš7Ů9� ��Ǚ�?\aW�C�|�x
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ