Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
Schwab_Desktop_v2.7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Schwab_Desktop_v2.7.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
langs/Hungarian.ps1
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
langs/Hungarian.ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
langs/Korean.ps1
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
langs/Korean.ps1
Resource
win10v2004-20220812-en
Target
Schwab_Desktop_v2.7.zip
Size
4.8MB
MD5
e8781fc5a7fd6d557cf4f32e45175978
SHA1
de349d75bbe414bf67ee7dec3492217bbf83ea00
SHA256
c0bd2850fc1fdafa2cf0768b94076a87f32fc11babfcb034c0f7563a4541ec28
SHA512
bdff1b815e53d4e3415791e6a87d8ca5b6a942f2ed9553ec3e730dc71bded9a6b7ad22ff1eba2c4bf8895170fac3ec4e74782c9241cd9cf181d73ea3741228af
SSDEEP
98304:d+tEBqKEUGyN7Y/UaxmZqUChZjcne1/r64p2JLoZ01eS:dUKJzN7YsaxmZHCInepr64UJACeS
Processes:
resource | yara_rule |
---|---|
static1/unpack001/Schwab_Desktop_v2.7.exe | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
CN=AVG Technologies USA\, LLC,OU=RE stapler cistodc,O=AVG Technologies USA\, LLC,L=Newton,ST=North Carolina,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ