Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
d63f3eef01937162c8588a4095c067af8a1599e1ef3e1afec809403ba88b5ca4.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d63f3eef01937162c8588a4095c067af8a1599e1ef3e1afec809403ba88b5ca4.exe
Resource
win10v2004-20221111-en
Target
d63f3eef01937162c8588a4095c067af8a1599e1ef3e1afec809403ba88b5ca4
Size
1.7MB
MD5
430c674bcc6818f354c046016deb5fb4
SHA1
934546367e6af3871a26c84162f4f09b121e6e74
SHA256
d63f3eef01937162c8588a4095c067af8a1599e1ef3e1afec809403ba88b5ca4
SHA512
5d61c91890d43e88f739e397a3f6cb594ada7c5ce51b5f24b15cc76707361739d55d4a3dc36838acaa39083d11dcd2fdd1a5f2e9aea0f334d964720ec6890298
SSDEEP
49152:QtNWnUZRTNebddvHSX1EXtUZoFTZOWI+WYBSMNsX:xUnNebLSqXtUZoFsWAoSMg
resource | yara_rule |
---|---|
sample | vmprotect |
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
CharUpperBuffW
CLSIDFromString
VariantClear
GetVersionExW
LeaveCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
RegEnumKeyExW
SHGetSpecialFolderPathW
PathAppendW
�t�=�����[q1yqކ�R7��3#�ϋ��(Y�Vt�u�f�0��kp��3�'���k��}�K7�ʞ2�& ���{����U�m�'�M-E��ZcC4`�F�HE,�rû�E.�0c�v&W�Ft�g�+�(Z���۫4|���s�ui��,`[1x�B��/2_�O|,�@#qפV$"�5|h��ȳB�n�@`-翤�9~ۗJ�byk �:x��i���iAp(�-尲ܕ�Uҩ��I�)�#[ r³È>��擢��I��:8f[�@�I�X���r��a' 9�ؠ*a���Җ�r��'��C�7щ��8����%G���%H|4�4u=��G�s�ه�bq��L��Q|0��b-��3�h\�R.LX��P���P�hP`����m��$X���kF@^P�.�נ*P�gb���!@DZ*f�"k�/ޑ��oh{ >\+*<�K��R�Î:��Ĺ/�]��c���[���X|f�3�n�b(��_�n�����S�aY+�N~�&���7���_�4���>J�-RC���9:�x�mY� ��� ,F�ܫ��sp)��;$¨p�o3`�8�J��N���hA�r��i-(��o�_Ee�����E�!��$����|I�6���Xڪ_ �^�,��p�a�5#4��$���#�\8��| ����A�0����R�K�Fڌ�w��Axy�������m\n�c��گ�,����c�A7�2BS yTE>�Zi�O���qr���WD�ךv�����4���Z_f��u�J%��~(�4�����2��g����J?Cm��a��I��p ��,����=������]@LESvf7��6x7�R�`'������OWU��I�Bs9�?��D�ɮ�g.�%U\���� xP!^�J�����2���A��t�sܮ�/@��>� �A��O���b� t�7��B�2k� �L1N:�'4���`�.�yre�k��RX}���#|;22��R����'�x��P��Ը ;]�1{�����n��{���g_c������^-L"J��Q]�q�Q<�R���(_�I&�$�*�o(GP�=��1��x� IԘ�6���%H���Ut�}#?��B��ӡ�PE��y��oX y�-��P�M! ��e�iDٳ��!bH��ᡲ;���uɛ��@���"˺-ZU�o��p����%M�?�� �e�(��)%7����)~Rt��}��&���j"�h��a�R� �v�&F9�n�+�Xx�-��ntB�LZ���S\Gf�F���^�+*ٲ��?Pa��i����˽t.�� )�����4�l�Kd��=^Y���AQ��*ߢ�����YM8�۵�(=9vK��qf@@U33�2�I�?FDe�j�S7+��l���1^e"����%0��>��*_�l�FP(R6��ݾ,�O4����r�F�U���j�t-ؙ�HA��r�_M6HȈ{٨6�!|�$<���~�]��#�nK˟+���~8E"��j�g#�56�w�>XLJ8�OY�.��� u��#�D��r�4>����a A�1վ��Ʀ�>8E��p��1��P�!�L���$%|�O��µhl3 ���`;�h�J9B����3!ق��*�`��T}�� _���oX�;bJ�����L����HCuT� ���wvǮc�t&��3���%RI�e�~�VN�Ծ�b�;ߋK��"<l�������Տ�_���X�W� G)�re���yi"���[�)홇���'z�I�T�Ό��Z�BT�b���p�v-@���E�}�C|��|�d��X�E�M�w "�����,��uQ�*KP[Ś�R�aZçqNX2��*z��+% h����٪�L}�F,?\!Ut%X��'����*��lC�E3��w#�3���Ut�ч�N��~��̈<�h˙D.>��A��@p���ށǽ���nIđ�.����8�v��=����Q��1ޗ��,��ih���܄-�OH�M#��-�g�%�k�&�����s���b��mq��:hF{R�������7w�� �v/�M�QSi�t�Z>�}���~�Oq�q�����[.����b��?Q 5��[��d��!"ܠ���gs5�u�����5����y�IX����u$A��6f�M�!A^l>�Fj��h���K$"vM� ٖi������{�1|���UU?^�+�,>����������x\��^���'?�6>����R]�6 `[\�}����'�kU�ܞ)ͩ��9nQ�>�{�f<_k�7�b~�f)���T�dG����_��G���v7!M��*0aC�s��7YPL���_s`Cb�;wP��������jr߾m�/]~"����}�ʸw�o������ɟ�i��7�{ے=�4%"�&��R�u{�8y�����e���z��*���"����Ž�@�͍� ��{���{��+Ԃ-iݱ�� ���j��l��x!��J�?�I�wx��1�!S�22Zec��֙7���S���������(kW�ص)�-�`��.&�� Jh�:[��c�T�&^k��uE"�v�I�5L� |�5�to�VV·=�����+����T �" �r7ջ I�x[zΜr��DPN�p����*|�s���-p�#2�'8�XD��}%ߕ�a���ż����6q0w�����#rX���hd8:f#�=���u��#{ԕ�ޅ���S���x,M(\�%j�q"��]�Ư-D엠�#;v�3�a�<��T��QF�k�wkv5�V-��c���}M,��H��HnJ������ȉ)���g;]�U��-����T=8`b鲹�Z���at����O��-#j�l��b=�ͷ��+tS��]y��!�h��2�H�X��U!]D������$Z���Z^� �����^�@��;J ����Wb;��ݹ�_ ��u(�$�:H�;���p8���>:V �GZ+"_��_ӣyp�Y�C��V?����wpX��@��3lguQ5ڶ�q��(\.�d�V~�-�i�L����PXg�Ho�u�2��o���������|�r��@J�G}���n�j
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ