Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
633dc1aac7fa6b61805d8cf2092171e0779aa9a47657537570375b70fec92930.exe
Resource
win7-20220901-en
Target
633dc1aac7fa6b61805d8cf2092171e0779aa9a47657537570375b70fec92930
Size
1.4MB
MD5
f7577a6fc9c05c81dc2576c932453742
SHA1
30f1189f61008f6bff2878e23732aeac0151a84e
SHA256
633dc1aac7fa6b61805d8cf2092171e0779aa9a47657537570375b70fec92930
SHA512
fedc847fd044058ee6306831f05889e78722ea5a7b6cc9519133c920080b16d1822f47690ad3a4f4e07bf0b6dc3957f5641dd769883a6b92ddff22e1e1e1c4df
SSDEEP
24576:xIfXENOIcLm+dJ690iSmX0mgV9U6Sq53PHnpb0Es5zUsXkS9S7spu:xIf0NOIcLddZzrmwUK53Pnpb0H5pRAsg
Processes:
resource | yara_rule |
---|---|
sample | vmprotect |
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
CharUpperBuffW
CoSetProxyBlanket
SysFreeString
GetVersionExW
DeleteCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
RegQueryValueExA
SHFileOperationW
PathAppendW
}�t��C|���{��Z;j@ ؍�\��O�CG:oysd�h��s0]tݖe�&� � ���$9t=�'�)z2����KO��6L$�G���\�B�^�<m��� ��O��mBE�Ww����p��,5.��ElE��1�&�9Nju=T�]0��?`�U�H��4�۱�-hx�64��{ܔ�� ˦;�ޝ��9��>l^&j���(˩�LE� ,���9;�Zх���yj���+�ѲS:26�����tB� �4��2TX+6/<,��3C��d��\����ٲ�P���r�����'rh�&���+��vr�ȴFZj~8�n[�H��1�ڱjE)�(�$BqU�\7�a|��kP�-隱|��K?䄥D���~��Y0�8l����I,�})4��䥆���Xn/��5�� �]�(�/��d��,%e0Fg���ܧ��Z�Ć��B�_��S�/byȕ^1�`��������ٚMc�F~k%��w8���U���ڏ��%!��I�B.+�_��;��hz�㕌�����}��+������ #�.n��E*B���ZO*$ �<u����M؇��3��{�5`5ꅻ&�����pYI�?���MdjǴk��g�ɮ���V�k��E���ͼ�d8�e���'R�uP�ӄ��3�4~n�%#2{S�$U�ٛJ��.u:m7��u��Gy��F E��>!�� ���R��-Y�9��Bs�_x��揜5���M�ڦ3�0�|�8&�H4x~;�z��[q-���� ��M���%�f3�|6y-�5�"˽�f��%+}qH�1�r�3��� �+N���.`f�k�d�!��%�1*��(<�i�Ti��� �BLˁ>7�t��9�� >=����[~A�Yg��jն�:����F�6(��Ð �8[q���Q�8�mKa��g�fY��\ί�G_x PK�|w�wAg�H^��u&��;K�܆��`게���a���)��3�9c�W���k�N�<�t�:����r̸M<��z�3��ߤ:Y���l�.;�sD����Y��{����!Z���ǥ��i_}�d��`�?:A>&*Wa������o�)%�G�jw����)q_�q�z�#��xQm�vX�>4C*��wlۉ�i��tpw~���9��졤�.�����riɰ2%�1?n���g�fJȣ��S� ����Ǽ.$�'T!�����pX�04�m.��/�|�E����s1����.I�'eQ�4Y} lA�xp��pP�O;�92z���.]�����L�8H^� ���?�'��X����A�+���E�؈���pFjkORo�O0yq�V��_^�m�|-�G�r��^��)g���J��#IBc����%̍VMFk����m����}�[4N7�Z����cHmLo�V�)me�p?��?QJyt-�Uo��ܚV>8��ͼ�kG�v<�}H[�W���4�@�}NEX���ś���w��/CR��M#I3B0y��-J}o �2�(������2�����Sq�X_4�eI'a Y�o�e����yJ���c"[��#�J���cz� s�d�#!���0�fe$��{:U6�Q��i���������:*��ʧ��wͅ7K��;���h� �L���gbQ�������/�U|C~-��>)�su�{%�.�u���Czڲv�=ٻU����yzɪ��Z�0_�.����L\.�;>�c�p�R����'�{d�&���羧�ڇ��&���g��q2W~p:٠�L� � U~�g��^��}l�~$��ˢJ�� �:i$关+(���)L_?ҹR#����!N�w.�䉆"�FW_|�ފ��X�OH1g��Fj���ϥ$�M�s?��=`�zlFן����WOJFt�D�Ki[P\W����W��+���h(��Z�-偡���2_aKD�2&����8?���&P^�aVo�4�X.6E�i�#��g�'��J���4p�� �;�7������$� z���>W5��m�'o�P � 3�.�3�h�c�Ytl��֎r� ��v�1�%�.���|���0�[_ jwA�*B���kӼ�{9��h�F��3_��l$�P ?-�$r���K�C�������-�N<�z�2@L"��s���!El,e�q`z5��OF�3Nez�j[uͲ>j {ΑvV ��x̯Nr����S��%-x��7_=��O������a��[F��B[m2����eZ%���:�W|�%?�=�p��=|"�~��*���#��)������d�H>Gy TU��T�)��{i�Ѷ���&lBg�V�����v]�� K����%ʩ�@�p��r���`�#93�$NC<x�`s4O�H��v=��Xk���+�Y�Y٦W�x��E!��Y.�8<� y��<@����_Ά}�!|�8dG~��獶�lB�~�CYXxO<� �&"��o�+���<��ͷ�-��f=��{˄*�Y�B_���~�JU�gTΚ��G��A 9n�,�\$��������A4�U�B9�s���=��,�9у+0�7^eqM�T��`�,B��q,EzDp�q7� JL2%���Tx��e��e�:5� ���O=��B�K�'i�=��v�~��a$r�p��/�md : ��5]M3f����X�Q8���Sq��3p�|���(y�G��L��6B�/� �l�U��O,Q6��d�����1�Z�%� PH�+{�ɞK,D�ϩ�(�@>>�B'�e�^?���d����v,�\(!��.�<J�C��d��w���j�{,����I�)��e_Ή,A�'u��=�O���oFڅSt��������9l1�2���_����hOr 1*Ѿ���&]�k�.|��@R�p���\������I�PXU��o���}~�� ��`{��\��I �K.�^j��_���9�}H��� |>��� �=�-�k�t]o��� �*�ܢeqa�J i]1�G1���N�D�ZubLR?}��z<b�#����G��;��wW�J�qJ�������MJ-$ܭ�B/�*�5De�����61nS�\��'S|3W||p$
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ