Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
8c6f6eeb68ed18225de5297096b0da7acf3c2136146f8e16634a794c6c242538.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8c6f6eeb68ed18225de5297096b0da7acf3c2136146f8e16634a794c6c242538.exe
Resource
win10v2004-20221111-en
Target
8c6f6eeb68ed18225de5297096b0da7acf3c2136146f8e16634a794c6c242538
Size
400KB
MD5
ff9821b3f1b1e7cac1a592cfb5d60a74
SHA1
cae4242bb97fc54bbe969cbbd312f6a1cb946df7
SHA256
8c6f6eeb68ed18225de5297096b0da7acf3c2136146f8e16634a794c6c242538
SHA512
060b78e3d8f8c29d5db95336f9c04f43040ff4ea47ea3a53f079f012a9a3d185c1511fbb5345c6bf01fb668a9f87be01a9fc2d1f46490610908768cd0ff6f3c2
SSDEEP
3072:8phedArwQLh4lcTxD6snkMBw4vgIOg9I/SfN9Sr2KgEzNIqMm34HRdLObOT5+h:8pheOj2IZ6rM+sOg+SfW2tE9Q/xT54
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
htonl
htons
GetLastError
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
lstrlenA
ResetEvent
TlsAlloc
LocalAlloc
TlsSetValue
TlsGetValue
LocalFree
TlsFree
VirtualQuery
VirtualProtectEx
GetCurrentThread
HeapAlloc
HeapFree
GetProcessHeap
FlushInstructionCache
lstrcmpW
GlobalAlloc
MulDiv
GetModuleFileNameW
GlobalLock
GlobalUnlock
SetLastError
InterlockedCompareExchange
VirtualProtect
VirtualAlloc
ResumeThread
GetThreadContext
SetThreadContext
SuspendThread
GetSystemDirectoryW
GetWindowsDirectoryW
GetProcAddress
LoadLibraryW
FreeLibrary
GetCurrentProcessId
MapViewOfFile
UnmapViewOfFile
GetLocalTime
ExpandEnvironmentStringsW
SwitchToThread
GetFileSize
OpenFileMappingW
CreateFileW
OpenEventW
InterlockedExchange
WriteFile
SetFilePointer
GetVersionExW
GetSystemInfo
GetSystemDefaultLangID
OpenProcess
lstrcmpiW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
VirtualFree
IsProcessorFeaturePresent
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
HeapSize
HeapReAlloc
HeapDestroy
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
SetEvent
Sleep
RaiseException
InitializeCriticalSection
GetModuleHandleW
CloseHandle
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
GetCurrentProcess
InterlockedDecrement
TerminateProcess
GetCurrentThreadId
GetSystemTime
SystemTimeToFileTime
WaitForSingleObject
CreateEventW
LoadLibraryA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
RegisterClassExW
UnregisterClassW
DestroyWindow
CreateWindowExW
SendMessageTimeoutW
FindWindowA
DefWindowProcW
GetWindowTextW
SetWindowTextW
InvalidateRgn
ReleaseCapture
InvalidateRect
SendMessageW
CreateAcceleratorTableW
ReleaseDC
GetWindowLongW
GetSysColor
GetDC
GetDesktopWindow
EndPaint
BeginPaint
ScreenToClient
ClientToScreen
CharNextW
GetClientRect
LoadCursorW
GetClassInfoExW
GetDlgItem
SetFocus
RegisterWindowMessageW
SetCapture
SetWindowPos
FillRect
GetParent
MoveWindow
IsChild
GetFocus
DestroyAcceleratorTable
GetWindow
RedrawWindow
IsWindow
CallWindowProcW
SetWindowLongW
GetWindowTextLengthW
PostThreadMessageW
DispatchMessageW
TranslateMessage
GetMessageW
UnregisterClassA
GetClassNameW
GetObjectW
GetStockObject
DeleteDC
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
CreateSolidBrush
SelectObject
GetDeviceCaps
DeleteObject
RegQueryInfoKeyW
RegSetKeySecurity
RegGetKeySecurity
RegCreateKeyExW
RegNotifyChangeKeyValue
RegEnumValueW
RegEnumKeyExW
RegFlushKey
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegCloseKey
RegQueryValueExA
RegOpenKeyExW
RegQueryValueExW
SHFileOperationW
SHGetSpecialFolderPathW
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CreateStreamOnHGlobal
OleInitialize
CoInitializeEx
CoUninitialize
OleLockRunning
CoTaskMemAlloc
StringFromGUID2
CoLoadLibrary
OleUninitialize
CoCreateInstance
SysStringLen
SysFreeString
SysStringByteLen
LoadRegTypeLi
OleCreateFontIndirect
SysAllocString
SysAllocStringLen
VariantClear
LoadTypeLi
VariantInit
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
StrStrW
StrStrIW
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
_purecall
_time64
_vscwprintf
free
vswprintf_s
malloc
_vscprintf
vsprintf_s
strftime
calloc
_recalloc
wcslen
memcpy_s
memmove_s
wcsstr
_localtime64
_wcsicmp
swprintf_s
wcscat_s
wcsncpy_s
_snwprintf_s
wcschr
wcsrchr
wcscpy_s
strchr
sscanf
fflush
strncpy_s
_snprintf_s
fwrite
_vsnprintf_s
strrchr
_memicmp
wcsncat_s
_vsnwprintf_s
fclose
_wsplitpath_s
swscanf_s
_wtoi64
_CxxThrowException
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__CxxFrameHandler3
_invoke_watson
_controlfp_s
_itoa
_except_handler3
??3@YAXPAX@Z
??0exception@std@@QAE@ABV01@@Z
_beginthreadex
??2@YAPAXI@Z
strlen
memcpy
memset
??0exception@std@@QAE@XZ
??_V@YAXPAX@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
InternetReadFile
InternetOpenUrlA
InternetSetCookieA
InternetCloseHandle
InternetGetCookieW
InternetSetOptionW
InternetOpenW
InternetOpenUrlW
HttpQueryInfoW
GetModuleBaseNameW
GetProcessMemoryInfo
GetModuleFileNameExW
EnumProcessModules
EnumProcesses
??4_Init_locks@std@@QAEAAV01@ABV01@@Z
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ