Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
2cb24a16aa018d818b2773083cba4ea26c4896b35b884feb53e85eb3a2f13dea.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2cb24a16aa018d818b2773083cba4ea26c4896b35b884feb53e85eb3a2f13dea.exe
Resource
win10v2004-20220812-en
Target
2cb24a16aa018d818b2773083cba4ea26c4896b35b884feb53e85eb3a2f13dea
Size
1.1MB
MD5
711f69ae7f2909b4a5d6e26bd8b13ecb
SHA1
6f59eec9db48049ea43cabeed117d76864817295
SHA256
2cb24a16aa018d818b2773083cba4ea26c4896b35b884feb53e85eb3a2f13dea
SHA512
d87ad773afc5d6a9f634a0fa2caccc01fda64a10534620773d701895222955df751e9ae3e2a12b6e1a143e08230773256695d5492d60ba1daf9c81f38eee763f
SSDEEP
24576:fz2rAD3FP3DgKvyNhXCV4E8BXAfrnkcAqU0AmWIoIwIJ/:L2rAjFPEKv+hyz8grnkQfwIodw
resource | yara_rule |
---|---|
sample | vmprotect |
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
wsprintfW
GetSystemMetrics
CoInitializeSecurity
CLSIDFromString
StringFromCLSID
CoCreateGuid
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemFree
CoInitializeEx
CoSetProxyBlanket
VariantClear
SysAllocString
SysFreeString
GetLocaleInfoW
GetStringTypeW
FlushFileBuffers
ReadFile
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
IsProcessorFeaturePresent
IsValidCodePage
GetOEMCP
CreateDirectoryW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
MultiByteToWideChar
IsDebuggerPresent
GetCurrentProcess
SetLastError
GetLastError
GetFileAttributesW
Sleep
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
ExitProcess
GetVersionExW
SetFileAttributesW
DeleteFileW
GetSystemInfo
CreateMutexW
CloseHandle
WideCharToMultiByte
lstrlenW
GetPrivateProfileStringW
GlobalMemoryStatus
SetFilePointer
GetUserDefaultLCID
SystemTimeToFileTime
InterlockedDecrement
GetComputerNameW
WriteFile
FileTimeToSystemTime
CreateFileW
GetVolumeInformationW
GetLocalTime
CopyFileW
LocalFree
InterlockedIncrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
SetEnvironmentVariableA
RaiseException
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
LoadLibraryW
CreateFileA
SetStdHandle
WriteConsoleW
SetEndOfFile
CompareStringW
GetACP
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
GetCurrentThreadId
TlsFree
TlsSetValue
TlsGetValue
FreeResource
GetProcessHeap
GetCommandLineW
HeapSetInformation
GetStartupInfoW
DeleteFileA
GetSystemTimeAsFileTime
MoveFileW
RtlUnwind
LCMapStringW
GetCPInfo
SetUnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
GetUserNameW
RegQueryValueExW
SHGetSpecialFolderPathW
SHFileOperationW
ShellExecuteW
SHGetFolderPathW
PathAppendW
InternetOpenW
InternetCloseHandle
InternetOpenUrlW
InternetQueryOptionW
GetAdaptersInfo
*���R�TL7�a��$��3��`�]��5�qo�#��˓?[f-ZOc"IfU��^��#ڽĆ+H��ڡK�i��q;9�r*�ӂX����7����HI�]���ٛt�"���z�bY����u`�W�Z|�s%<���ޫA�50*mQ�e�$�H��:�Z�F��i8ޝK��fs�=��CtjN���E{0�&+�rΒ��I� �� ul-G�S�5&�A6�����W���i(E�:7��=2����=�k�zR�G��i��7��uObl���hQb ���ɞ��e*{X��Hg�x_�a�ڐP�n]5���#���<ZX�ׄ�6�@$B��of��h�� O�^��CE+�����k���~�iW:j]�l�p6���o:�߮Jn`���\,I=��|S���+g��evg����2�-n7G/��-���C�֜�9�UN^�� _tF�-��#tu��9���<Ԛg����%3b��@����R�6�k9�=$ �#Ih���Nw�z�b u� ��G� G�k�e� ,>N� �uM��L���j9~�6`j[����I]>J�FjSjG0��u���)�X]�Vv�����]���8�o���al��F?w-B<>�K��Sς�j��@^�����~�i=4I�[�˜�(�g����(3�y������X���g %u-��>u��L�3G/�d��M�xB.��'�5 �R#+�<C�٪�K�|8nr�� ���"2۵�>�� �*;e��|��w���V]/\�.�2�o}5:��a�9\T��z�g�(��";�Ёr����+z�����������kK�f<��<�뻄�D�ݶ�Ԗ�n����הE���\X!}��C/y��)l��j'�\Zp������#3kug.`; ��ˏ\S��vo�F(��Z#s�c�\������ћ"oVG'l1�l���e�=�GW���m��ޥ����`��yK3z���vI4��B�N����q��6_xm�C��՝?�����H�1CU ��J��������,֊�����&�ߧ{ ��&���I"`>���6�/����;J����j�1�I����d�{s�kց�#��t��� � `�d�)����Åb{�o��;��ۼ��t�PH��.M=�Ic되"�`(űt�(TJ3���9�c.�_�z!k6���AǬ|;e��d�X,4��Y���tf�M@�;R�� ���ir�+���o4�o�I��u<貖Y�~9�m�ܩBy�,;��^�W�w��!�\ԣ��N��ͿN3U��H��m#8?VWm�Xt�Ii��0�P!� ��jiY246*���A��x��e�ظo>�C�K�p��$ 67˩�6Ʈ��)z�����+�Hg@h��j�V��n�%�;:���H*�ҿ+���2Ǜ���$�6_k���~k>*���t�P�-�e#�����Z��憤;����R�y�#��/���~�B�Q>�T�6Zp!�����܊Kր��eH��w����ޖ��_oƲ���#=ʸ8u R�q5�����0���0�����p�=CQ�$' �-8$��?�L�kMJ��mҴhD~���뾳���]��&�vzqy�f���&��цA+6����q�����KO�כ��-p�z��봟d��oF��DžTQ(;Ւ��9���_i�K����DIFC�N��`p�$��p��|W��3�����1��%-1.�t�#{Ş6��ʠ����۾� ���S��Rl������_��W�2�lؚ��* �?:���i���j��q�(���I��XN>���n�J*k��R]�pX��G�"�Ӽ���M�����^�s vw�6!MK�#����B�E� lS�hrZ��$x�2��b�IW�eWQ9�t���O�0*/��DN9ʀfB� �f%�!g�@�e�fɃ~R��>��b1�L�i��&�H�����e7j��𰫦�g�Jl��E��x��z�:2��$�i�v5_˭���)�����%<j/!ԥ���� ��y��@�%[`�إN�3N��k�K�gz��ci�4�^O/Gi;M>#1~����D���Q���@k��k ��Pu3,��� �]�x��E���.s����>�����Ѧ\���=�) �l{A����T�G�gN�E�z��4�-�}'�EKt��W��#���a�QXF%l���)Vo�\*s��Y��؎E�MaO�|%w��������B�v�����3�ߛ ���Yv����T�� �?%Z)G�hEp7�0�s,�C�5��C�\��eD�~��g�2ŧ�B��9>���;�ʐ��բ<��شAʰ�EQ���U�Z�Q���řk�� Oev�0>o�!����/����$��F��-,F��&�d\������AHs������0��Ya�r������~��X�Ff�#S��}Ƈ��'J$�gܟ�KT�W6�6��ԑ�Uє��*/�rl�V�{��7z��/A_o�VZ��!6�v0*��"K@(�.���;�W����wҚ�D�DK��_� ��F���d���U�����g���W[�>�8��S���U=�����4+ݘ�CVm�\�W�q��F�� ��ZՕJ���2��5�l�z������ ��ouL��eP��q���y�L��I��,�q�s�O���$��~%C�*tO�]����f}�1����Ȳbj ��)���E�z����>���_�Γ$qd99 2���,�:��� �A�˳��@���Н��aG(��`��u �7�"�F�:�=p���z�k(�˶N��0��A��;���=���Uc{���10#���b�3���� ��ǐ!�q w��`�ץ!;G@]!@�A,k�YH�w�sh�����ѐk����m��A��H��<�&6h�T�-q[�7�G���q��]������~UuІӅ������q��Y��:c���'���w��pz���X+8�h����F�u�I@P�!Ox���We~�����[aUc܊�Y�}��]W� :�I�������W�[4���Eκ�����un���M��G�!X)]>d������.�ZۡI�A%g����
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ