Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
Behavioral task
behavioral1
Sample
926f2683f4eac51dfe15e7a6cde527ad8daf7accc36c8fd85c8d2f37a29f77c6.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
926f2683f4eac51dfe15e7a6cde527ad8daf7accc36c8fd85c8d2f37a29f77c6.exe
Resource
win10v2004-20221111-en
Target
926f2683f4eac51dfe15e7a6cde527ad8daf7accc36c8fd85c8d2f37a29f77c6
Size
446KB
MD5
ac540289866b76a494df9509731753e7
SHA1
98521e795dd918b24ef1d193b4bf92294b517f6a
SHA256
926f2683f4eac51dfe15e7a6cde527ad8daf7accc36c8fd85c8d2f37a29f77c6
SHA512
68a06c449cfa489bbec8fe8e99af21d25a32be9c39ad4be1710cbc01ea45b5ffb49fd047f6826557c724d377bf9cb810fc2a8f78d7281fc8b4a8998fe6dfcd19
SSDEEP
12288:lau8eG0CzVvJfW5+TmTKufpPZXO/YUpE/1Z:lafCCTW5+CTKkpPZXOAnL
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaAryMove
__vbaLenBstr
__vbaStrVarMove
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
ord517
_adj_fprem1
__vbaRecAnsiToUni
__vbaCopyBytes
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryVar
__vbaAryDestruct
__vbaOnError
_adj_fdiv_m16i
ord303
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaStrFixstr
ord309
_CIsin
__vbaErase
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaPutOwner3
__vbaVarTstEq
__vbaI2I4
__vbaObjVar
DllFunctionCall
__vbaRedimPreserve
__vbaLbound
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord608
ord716
__vbaFPException
ord717
__vbaInStrVar
__vbaStrVarVal
__vbaUbound
ord644
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaInStr
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord681
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord100
__vbaI4Var
__vbaVarCmpEq
__vbaLateMemCall
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaFpI4
ord617
_CIatan
__vbaAryCopy
__vbaStrMove
ord619
_allmul
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
MessageBoxA
?��Ϋ��([�!��\/c����$�������SY�8*@QK4����_�&����Y��<8b�!�Ja�A!���z�G} �;eo�Ozj_)'B�$,q�"�7����=m�X(sN�Ծn�Y2��c�����o�Eï~3�ɨD���^�=9������E�4G���8��y�#H�jf�-�"S2���4V�N"��g������E���_���$�z{����{�$�w�7����s3�x��٭��Hk�(�x1���;Έ���ݞ�^���"�+�� �T�����q#j��V>Y��w'�ʱ��ά_���`�bw��)�XmXV�TP�y>���d�� bG]���~�>�������J{�Aw]�H�R��M5��ڋ�jC[�F#x ĉz��t��iF��m����:�eq���1ƃB�ͧMό�Ȣ�ϭ����X� ;o�Cpٻ�f��J8�ڧ4f�5�V��K̐��Wd�vP�»�f�f��H}��p��wo@� ��p,�?h��#Ub���ۈ����y4Q��B9�����K�A-���ɵiԺ��t(Ed��H ��)LsNܟl|�q(z4g\�w������&�Bme��M�&@E<���#K��|B�L�����s���;Λ�6�4i<���ڍ��o\���C�B2%@���T~�a�.�����T���g��}!0}�|�"U�9Y�D q�q|XFT�9)�cf�t\����Z�1�<U����F���Z�'H��@�?��%&�V�+��&;�ö̪B���E/V4�=ft�d��|uOnf\�z-F�5<�� Sz�!jLN,M��P�0ѓ��>�ͪ���e8����c �3�r��h|�~H��Ԋ�u�e5�l�5ll�64(�1��"g�磹�οF:7"�C1S�мu�@���0��9�쭧��#�|m���J_��x �e.Lk����#������fd��>&bـ�\���+�Qh��ÜQ��h$�i��`"��_H�W��G����M���'��`�q��t-���6m�0�_�T��{���t�q�� I�����r�VB]Z�镺���ھ�����0��ό��/���d�I�ͥi^���.K�Hj����o��(86&�#�-�� �@�r�ݽ*�W¸\]%zS7<Rl�nGI��ښ��~��������t��S;��"r��Kɲ����[7�R�Tܷ,3�,�����#��k��?��ߐ�f&Հ��gG��\]�����_�]����8�|�cE�g�^��^��K����]�p/�����0���\�˪�����BR�4��w��� �^�o32+�Ԏ�.�_Q�>HZ��������$��舒`�?�"b�N ����'#����Tö�ޅ�E@Y���{-8I&V�}`�0�� d6�d�y�J��V�D�0N܁« 5 �!��i��c>@[�"��뀕�YS��@�v�.�s���Wn�fHλF<�U�:>��\S��M,k�[����eV��� QG�8_Ɋ�z�1|'���0�\q#�-���0�椯��2�>�F(Z�q����C���S��U��<+y��n^��%���-Mc�U³�ELJ�Mk����,"]�c<��]��� ���B�]�O�R�P�ta�1Οs��ȣ)7���$C�:��I � (u %}���F>E}�0��4\�|]�f�a���Jz)lƀ�-X~ �!�^�U�����!��5�I�Fu�S ��l9�0��z,��`[��Z�u+�p�a����D̺�;q�}X��������K)�n2Ū�H�t�y|����('��%-L}r���L�Y+֏u�&B���0h�_�U}8���! !=�z�� j�����x�����V�!���e��ϗ�<ض��I�I��Qi ғ�)"��^%����+�O�����f�G�^�/���t�I���^9t�ӿ��ŭ�&nI�m�H�9�;��ď�ㄋ)����.���զJ�ThT6�@e؈���D����k��ĵ�wH���n���+v;��+\����Ug��C�uے���R����tw�����p�R��h�t4me��W���5B8���Gd��*�mm�5k��� P��Ο> ��⤑9k���½�Y�E0CsG-x�P+�����e/)���� ��}��>puzntJy���d5��0dV�T��ߑ�+=���q�턏������I������ $l~*��풌/���:EL�"�-�y�T�>'P�1�ҁy�� ���`���^B^�j-��Q�� t�H51Dz/�����r�`�H#��!�jQ�imylR�:��;����X�L�E�Q��uV���̻��f�toC��ܒ��oo����ЙUJ�H�������"�yc�֛�U��obt�+M��6O5b=g�P��? D��=e��ʴ���� ^żq��N��z��)���"�!,-x��P�:i���\�|�R@!�Ȉ��`�5��j����"�#+o��X�>�U|Vp��}�β�,C��/��p�oJ��@��}���A�O�mW�w�N*�4x���A�E/ � ��a���v�b��g']tcþw�uV��ql�����&�ٰ�oJ�������6�����C���k���*��<I�A�kd�$}ɗi�άɤa����B��DV ���N`��q9OT �n6�d��D��t�V�U��k���nv[^=������%�LQ�a�e XqY���T�x�������K3-��O�C�gD����C����A���?�y-��"��N��*�qq���E�𤅐�J�i#�F[}�>O�o����Zkթ�����'�P2�=.�v����7�mҖ��:�B�穀��B/h ����k�ϛx�+��Y:)�h��n�`]��Zֆ*a�zԱ�c����p#�~������%�\�:�'���+W+.�śR�!Y��B���9}jE@��Zi]8>��A[i�y�poN㚹����ޘ���K-���W�&q��L�[|�����%F����7�j��ê@G�@ƃ�� :���i>?����S��k�.DY/��&�,�2�]�P��ZT,3�vF��0���6���^7�n��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ