Extended Key Usages
ExtKeyUsageTimeStamping
Behavioral task
behavioral1
Sample
2a92ca5e6ea843df9b7e6dc52671161cf5a39d3f3c3ee4d2acb5899a27024c45.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2a92ca5e6ea843df9b7e6dc52671161cf5a39d3f3c3ee4d2acb5899a27024c45.exe
Resource
win10v2004-20220901-en
Target
2a92ca5e6ea843df9b7e6dc52671161cf5a39d3f3c3ee4d2acb5899a27024c45
Size
1.3MB
MD5
29bc0a0819e8ea33219a6462b2230118
SHA1
7dce4507cda593b41007d163a7f606a7b9a06efd
SHA256
2a92ca5e6ea843df9b7e6dc52671161cf5a39d3f3c3ee4d2acb5899a27024c45
SHA512
dc45c4bc310e34654ce4cfe4eabf5a5f0c01d754c46aa0cd6b9149fad2013659184342e38e99fe3a47e89c205dab51c65d749337c34285cee4a122118f38c5bb
SSDEEP
3072:yMRHFg5vd41HknXHIKbAopL4XhKOJ4l9GW4oPMuC6nXwuC6nXquC6nXquC6nX2:bgxdyi3pDLs06oPT3nXX3nX13nX13nX
Processes:
resource | yara_rule |
---|---|
sample | BazarLoaderVar2 |
ExtKeyUsageTimeStamping
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
GetModuleHandleA
CloseHandle
WideCharToMultiByte
lstrlenA
lstrcmpA
GetLastError
HeapReAlloc
GetModuleFileNameW
lstrcpyW
lstrcmpW
GetCurrentProcess
FlushInstructionCache
ReadProcessMemory
TerminateProcess
WaitForSingleObject
ResumeThread
GetThreadContext
CreateProcessA
SetThreadContext
GetStartupInfoW
MultiByteToWideChar
GetModuleFileNameA
Sleep
GlobalAddAtomA
FindAtomA
ExitProcess
SetEnvironmentVariableA
WriteConsoleW
CreateFileW
FindClose
WriteFile
FindNextFileW
GetFileSizeEx
FindFirstFileW
GetDateFormatA
GetSystemTime
GetProcessHeap
GetProcAddress
HeapAlloc
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapSize
LCMapStringW
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetFileType
GetModuleHandleExW
GetStdHandle
EncodePointer
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
LocalFree
GetModuleHandleW
LoadLibraryA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
SHGetFolderPathW
CoCreateInstance
StrRChrA
PathCombineW
wnsprintfA
InternetSetOptionA
HttpQueryInfoA
InternetConnectA
HttpSendRequestA
InternetCloseHandle
HttpAddRequestHeadersA
HttpOpenRequestA
ObtainUserAgentString
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ