Extended Key Usages
ExtKeyUsageTimeStamping
Behavioral task
behavioral1
Sample
bbd2f8013ed36305417f1355b30bda76e66d94ec3e2a195eb0505f8f7d22d311.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
bbd2f8013ed36305417f1355b30bda76e66d94ec3e2a195eb0505f8f7d22d311.exe
Resource
win10v2004-20220812-en
Target
bbd2f8013ed36305417f1355b30bda76e66d94ec3e2a195eb0505f8f7d22d311
Size
1.3MB
MD5
99f2f791fd443a64d5dca84e909258f0
SHA1
3cee2387098bb7fb26aa81e1863ee7f18235b9f6
SHA256
bbd2f8013ed36305417f1355b30bda76e66d94ec3e2a195eb0505f8f7d22d311
SHA512
41e14787c4534180d2ab2361de5fe40229d136a941e044681679790ff9da06502002baef507f151079f3c7fbb34144814a2f28885e74842f7b5af8e888ddff2c
SSDEEP
3072:yMRHFg5vd41HknXHIKbAopL4XhKOJ4l9GW4oPMuC6nXwuC6nXquC6nXquC6nX2:bgxdyi3pDLs06oPT3nXX3nX13nX13nX
Processes:
resource | yara_rule |
---|---|
sample | BazarLoaderVar2 |
ExtKeyUsageTimeStamping
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
GetModuleHandleA
CloseHandle
WideCharToMultiByte
lstrlenA
lstrcmpA
GetLastError
HeapReAlloc
GetModuleFileNameW
lstrcpyW
lstrcmpW
GetCurrentProcess
FlushInstructionCache
ReadProcessMemory
TerminateProcess
WaitForSingleObject
ResumeThread
GetThreadContext
CreateProcessA
SetThreadContext
GetStartupInfoW
MultiByteToWideChar
GetModuleFileNameA
Sleep
GlobalAddAtomA
FindAtomA
ExitProcess
SetEnvironmentVariableA
WriteConsoleW
CreateFileW
FindClose
WriteFile
FindNextFileW
GetFileSizeEx
FindFirstFileW
GetDateFormatA
GetSystemTime
GetProcessHeap
GetProcAddress
HeapAlloc
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapSize
LCMapStringW
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetFileType
GetModuleHandleExW
GetStdHandle
EncodePointer
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
LocalFree
GetModuleHandleW
LoadLibraryA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
SHGetFolderPathW
CoCreateInstance
StrRChrA
PathCombineW
wnsprintfA
InternetSetOptionA
HttpQueryInfoA
InternetConnectA
HttpSendRequestA
InternetCloseHandle
HttpAddRequestHeadersA
HttpOpenRequestA
ObtainUserAgentString
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ