Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
Behavioral task
behavioral1
Sample
870ab6400658c9ef8aa8325a8be8ff587f8247a01b67688472339e740bb573c2.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
870ab6400658c9ef8aa8325a8be8ff587f8247a01b67688472339e740bb573c2.exe
Resource
win10v2004-20221111-en
Target
870ab6400658c9ef8aa8325a8be8ff587f8247a01b67688472339e740bb573c2
Size
454KB
MD5
7eefbe212d1f135a204e26cfc495d18c
SHA1
b665820d8a76b8169731b3fe6389449b588aa0b1
SHA256
870ab6400658c9ef8aa8325a8be8ff587f8247a01b67688472339e740bb573c2
SHA512
67db6b873afc905da0238106554b40fd6864c98742e748183c7c7c4587ce0f691c516772cf46b90e5a3a850688798ca23af929502d820b06a02e72ad34babd18
SSDEEP
12288:drW7K/NgDEG+y1uM9L5wpSB1bN52qrT68actBvfwx:d+DF+yHvwpMN52qrWWBnwx
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaAryMove
__vbaLenBstr
__vbaStrVarMove
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
ord517
_adj_fprem1
__vbaRecAnsiToUni
__vbaCopyBytes
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryVar
__vbaAryDestruct
__vbaOnError
_adj_fdiv_m16i
ord303
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaStrFixstr
ord309
_CIsin
__vbaErase
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaPutOwner3
__vbaVarTstEq
__vbaI2I4
__vbaObjVar
DllFunctionCall
__vbaRedimPreserve
__vbaLbound
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord608
ord716
__vbaFPException
ord717
__vbaInStrVar
__vbaStrVarVal
__vbaUbound
ord644
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaInStr
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord681
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord100
__vbaI4Var
__vbaVarCmpEq
__vbaLateMemCall
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaFpI4
ord617
_CIatan
__vbaAryCopy
__vbaStrMove
ord619
_allmul
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
MessageBoxA
���s�c2^�L_�{�K�M������/D���(�V�.��� �eʎf�[ �=){��,��^�Ŏn*Ξ �6��Y8�1�DQQ��l/Q<�/�$��Lw����ؐ�U�Lz>P͉uH�2eV�ƴ+�:�U|f�Y1bZ�u�J���B�� �t��� e��x�b�V���hW0�f����ʾ!Ӛz���D���b�)U�m:=�b��,m/��c%c������"tۼ�k�1�\��!W������V&��k[�C�{ �ACt%5���9�e۬����,��� ���y��ݍ��-�R� f I4�fT�qy0d�-��}���g�NS��\�,݆��L����~�����<���M��7�/&�'L��%��Cz�[�~e.��)To.{x�s���7*�5nw����I���3�Q1������p*-} 7 X����F�=wHT.�<��U�������.퇮��u�q�� !F�UEF��F#�Z�n��X��� ���C�L'�o�M?d�53'�σERk$)��2�1=��s~ߔa)/��K�]#��6Y]�<-þ���Z3I�_���=~*bx�ɚ嗒o��-����"3�>qٵYz�W�Q�&���&��˂���ߺa�t�I��0�(� �-��uq��� 9u�/�yG�H���/��e#����6�В��!�g�JE��˹S&BG,�,?�n�Iewӽ��sW��ʵ���d%���W��+�z7�q|��֥i��FE�Q��� ���b�l��$+�f�wd&�����jt S:w�'��@L�%�Yـ������AhŢuU�~`�#�E.|U\�W{#p��� ]7Q]|�?�C��Oy�G~�с�Y��IrN�a�����>K���#r�^� ��V����4��902W��{e�F�(���x�.�lXZ�Qyk @h���$ ��7��@�� ���}4H���A/�}����پ<�Kk}<5�X\�k�~�:����h�r�R x��1+�!����ƀ�����s���ԭ�Q|e��AF���/_�� ���M$�rr�y�s^������e��� o�n����#<:���-�����oپ��O(�M���u�q=���@G��o�v��<P�$�F&�N#�v ɶy0_�XAܬ�-RU��=�CCp��dU�1�� ���4YC��<+5��f]��6(@(G,$��S|���g�+'�#�y~���bK��rk=V�o *���+�l»���[!�j�.���$G-+M���*��D�5;�A�<�˝ 9?4����ɺ5�, �y�)E�\�?o�͂��?��-9�Y�����G?�=4��L?����;��.̢���:+ʑ2�_�L����WXk <�;�&6��h�@�P}�� � V�0�����agg5���4�Fh_�̪� ���[SFI0K��7!e��v]��3���h��!M����� ��tx��9��6��4o�ӑS�9N�����M���2à�7ݩ��H�\���� wUI]�^E ,\8>Fq�C�1-��}͏P9����C�����u���u������4��6g1�N��b������ٰ<@[���<Ŏ+� �4`���*n��µ�랱s~_x�3�K��=v����rB[a�M��LL[�QUZf\O�i�QV&�Z��]���!L4������22���<4W��#uK6�m4����e�_����x�N�q����8�����:j�Ȓ�eT'����+��p�+2�|����3a���$�+v���H��6d�=�'�S_��^�!;��:j"����Vw�j�زA��W}��=��8����/d^0<�����*5��aۿr҄����I��8��"w�x�d ��ۆ���w䩞��(���h�~�Wo�sެ���SzT�_��&��=�D�ˠ'V�� ?N�O&w���Ƶ�>1�x^�N��Zmi�����>���zop��V��yBT�.w���/bFȟ��u(JMQ�5���)�6�}��:]ʻ|H '���+��u�f�d�V.����Wb����$���KaJ�I�.7�����Z��\��8:�.���<q՝}���l�lex���B?&>�� >����0$��5ǎ&��mW�u2U�UqF�E`A����J �3�Q/k-6:�bq�ǽ���=g4q�O�!*< c-4�ײ�"�۫�d<Z+��Rn�ٴJ+�W��@��3�߉�ڢfE���I�>`o u� �k�x�cY�l��VV�� ��p �����l&^Q����wH6��\��7��������x��|�g�@�s��=�9l$;xDlȨ�T��<���u�1�*̀a�ݏ4��9O��ʌ+��,u��/��~̗���"L�G#�xT�:6�Ҹv�[� �Ge���#z�'�!�j{%i@(f�n��S�V^���vW�$�ݿVtT��'\]���H��QW���Ȕ���i�11�$?����Us��'��H�{�b�n��֯��0�9�����9���9�,ت �^�� ��\��zۏ]xWi�AMj�G�`��3�O1oK��1�\aD��!�.*�ß��n�]�B�K]S��u���nC�������[�|Ѵ)��� 3����5�`�1%<{E6�g/�j�ă�� 8��U�=�_�\mQ{�{��P1 ��}gQ��z�m���s�n�;��Qj��K��O�ɝ`�;�'�*�!��$y9`>����D��Ǖ��&ͻ��0|�T!<!��Ti�7M�ZD�O}�?�)&R-���8D�C���p�*���̟+',���fd�ޣ�a2�~K�M/�~r��e4yUܲ�ł�'�(D� w%F�Hr��%Ε[�V�?Mg ̿iK�������0������y�|��q�(DCb�� �̄1�?-Jކ2-b[.}�(/k��cpֈA��x�?��,���`3'mszٓ�LN"�{��" �� ��Ar���up ޣl���׆�M�/n�2sF�� d5z�ԍ�>��$�_��<d����� ԍo�ȹ>6�PS>���w�`o�N�R�P#*qDy����2�7QH ����:r�;���q��\:�u
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ