Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
Behavioral task
behavioral1
Sample
ae4f4477bca3a1af2e4f01ea151406921e61f4a49078c0f9e702ebd8c7a526bf.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ae4f4477bca3a1af2e4f01ea151406921e61f4a49078c0f9e702ebd8c7a526bf.exe
Resource
win10v2004-20220812-en
Target
ae4f4477bca3a1af2e4f01ea151406921e61f4a49078c0f9e702ebd8c7a526bf
Size
441KB
MD5
21312bca26bfc09a10d790680d967d83
SHA1
c8738730a50559794aaf4e0bbc4520e99080f08e
SHA256
ae4f4477bca3a1af2e4f01ea151406921e61f4a49078c0f9e702ebd8c7a526bf
SHA512
dbec7bd4cf7dd235940308f1d312045f8c130655cb18a8f27ed5a0954f0a7cd4d9af1a60fee4f0270c774b76e1391637d6eba80687f0aede1fabdc32dd120949
SSDEEP
12288:1hoWL9TYW5QActtIQSuQGd5SYylr7IeWvcFsgA8JidXy3CefSY5K+Z:gnW5Q/WQfdAXZ/7FsxD2
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
TlsSetValue
lstrcpyA
Sleep
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
GetKeyboardType
CreateWindowExA
MessageBoxA
RegQueryValueExA
ReportEventA
StartServiceA
QueryServiceConfig2A
SysFreeString
SafeArrayPtrOfIndex
VerQueryValueA
UnrealizeObject
ImageList_SetIconSize
ShellExecuteA
SHGetSpecialFolderLocation
InternetReadFile
gethostname
waveInUnprepareHeader
Netbios
WSACleanup
capCreateCaptureWindowA
DrawDibDraw
���2�vꔪ2��[����s�3j�����y�St��UXʹxGo��� n�1b�U��K�D��n�c ��AbN����Y��a���,]���X���9�f�ʾ�>��K|!���A��n1c�XS����ɵ\���8�9v�����z��1G���/��O6��9�N�������t��7�zGJҝӲ7h�� 6��&F����Ud���p�e!C��9�h��:�u��ODK�uX��������y/���]Mgo<�����Zer8�P�Y0�p�ZyGV|/��pV�6��Pkc%.U�_�,�-?��R����pJ !u�L������3��|8��l�)d��82 �݉�櫢non�3$$�+��X�rzgh0,P`�E=s�2��W���� w��@Cٍ=K,nt�����?�_Ҧ{����S��t�$����v���ͪ��c��u�9ȇ�"��9idOaM8��g�1#;ޡ`R�)���б��ju�*Xh50N�wn,̘%Qg���-pF�G�h�Qav���K䏨�X��Tv�F0YT���N�d˕�k:�TtL{��)����WJZ�Ϥ��8����U"U�7�>)r�)�� �3W&�Qr�(=�E-W4r9gߖ������^�@��,Q����D�P�yC�3��aAͼ?�1յ���i�NA.��4O@-�q���^��XE���|K&�{}ٗ��ʓ�!�o�J�x�oC����svhP&����Λ$�^�A�I�Z��C�@�C u�T�^=��X��7�9'� �m;�b���� -mغ/>�G�@����Ѥ>����o��Di��@X0���(���Y����H;U��L��$�s��8�Gj�æ"�*�E�~(O����[IeX�I�J#�L��<��n!�^x�(����1�$��Ia�#w֦m��E��5�C?vj�na�('������#�`#nv��H1�B��c��쌁��e��W�o�>���`|��n���q$>M([����ɢ�������D���-��J�6������y�u��UeK���M zI�0��ٓ�� �t�����b16%�=������?��n��ݹW/�8����M�/� O��HK��!���kU�� �-�/ˀ��'�T�#���6g��h����z�AV�r���#�j;p�/M��<��Ozj�W�(&i5�**|�\^���ش���w�� �|���D;8Fko�dv�@�o�9���n������&C��b�ePvU"�����n��k!|�Z���eY� ���Ot&&��)g�����t��1Ͱ���c���5z)q;�����NMFs��Ow�:T���^�X�+�A�U�sZU�m�0�F��R����8�@*X �S��"�����;� �d��6�"� ��|�YX3�V�'8�8�8w�ӿj�UmJ�O�ʏ�T�iX�����;�0���9(~�l0]�YD��`<m'�l,s����7,.��qhlH�`!8i��j@WA�ʕ�Po!��% �u#K� *ɬ,`o}]/�Vը��Q�~�$I�؟�������;k�4Ū�$�r��1cN^�r�yS�E�g@�V&�5b��-��2%K]ӤI�j�h�d����F�z�>�Z�҉w�>_X]LQ�_��~C����w��&�WZ)�`v�e6;G�3n<�!\]���B\���t�K/�*y�o4<����̑��cX��5[�8��"ɵo �1�1����j6m�RSu!C0���+�H]�H������>�ݨ�,��8E�9��@�\ʉ����Cr8�qA�vNH�J�!�Uك�Msn!�#�8�?�Cө�PI��$���`LP�������:E������ʚ˙�_�vS��}���gw`gv)[���W�"j"m�G�Nݣ8f�$ ��d�bp��_�S��_+� � j�k ��Po�F]r��V(��l�6��u�hWa��Y��<�[$�>���?��<���6�E����Ə�@�� I\���eL���p���j���tc����B6v���#�J~PU�چ�#X]bx�o�x�)iO� �����0����Jhz+#"��<{��q�UF�N�\3!���e�j-$�>����Y�»��y9�=F1{�d��&7��ޕВ��ѐ��)v�.'R.B�x�F34%���j;n�*(Q?I� 8��`j;AP�*+V�x�JQ���J�F�6��ۯ��X ?1�S�*�lx)�[��p&O�? d�Dž��]5E���}�A�u�,�m�%��1䏆X P0�Y���/�>�6�FaІw�^�5��ɷ+����X�r��ER*N.�G���G�����2^��f��˩x���E�n�x�%@h@�]~���e�6�y����Y��s �y��?x�����%_F�����3`���v�CC,Q�0_QJ|��4mg�d���[mJ ���O�:���@�Z�^0�>��CZ�u��Ɲ� g ��[�d(�d�%��na�^�z��X[p0e|>� ��&v~(0�:j暙��)�G��u����_Jl���)�,W��{���U�<�<<���_ �Q ��a���7\$��(�f�r��vr�����U-�`hs\tr�����7�7K�F�nӷ�{B_��u(n2��ӫa-Q~`;��� 缾=�1� ��7�ľN;2�)�d&��R���Z5].�b���� ���b�Ώꡰ4���'�a˵�c�/q���[�a2��O��]�ϛy\u�缡WC����.�V!E��(�����7�B}`��&f��x�# �v5���3uR z�j�Hg�u��#��,6����j�����-PR3T�u� �-X>�LPOX��7�i�@�ٻ��m����'`d��<�M�P6v�E������7����4oJ䡾�r�qh�z�Zc � VU_0��N��%~g���B��2l)Mi��� #����P3���!����հ .HA9�t���V"��b�}'�����;}�հ�&��_���32��2.F�j����f'�W��)�#Ǻi����כ���d��v�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ