Extended Key Usages
ExtKeyUsageTimeStamping
Behavioral task
behavioral1
Sample
e371a2c031b982eb7a65364c4b2d19a065d936d4054ca9f18afc1fbdb2bfb2f3.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e371a2c031b982eb7a65364c4b2d19a065d936d4054ca9f18afc1fbdb2bfb2f3.exe
Resource
win10v2004-20220812-en
Target
e371a2c031b982eb7a65364c4b2d19a065d936d4054ca9f18afc1fbdb2bfb2f3
Size
1.3MB
MD5
d9a3fc0c9fd3d4c18ab60d8d1e2488f2
SHA1
3afbf6073c5817e30ea1d795b516f9eca1750f76
SHA256
e371a2c031b982eb7a65364c4b2d19a065d936d4054ca9f18afc1fbdb2bfb2f3
SHA512
5c075e35ebdc898a38336c3d3119cdbd72e1b9d813dbded95aca259796f9a14ed96c892beda500cd5d5e57b9c56b0f3acf49f2c0ff801953542c003d74007023
SSDEEP
3072:yMRHFg5vd41HknXHIKbAopL4XhKOJ4l9GW4oPMuC6nXwuC6nXquC6nXquC6nX2:bgxdyi3pDLs06oPT3nXX3nX13nX13nX
Processes:
resource | yara_rule |
---|---|
sample | BazarLoaderVar2 |
ExtKeyUsageTimeStamping
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
GetModuleHandleA
CloseHandle
WideCharToMultiByte
lstrlenA
lstrcmpA
GetLastError
HeapReAlloc
GetModuleFileNameW
lstrcpyW
lstrcmpW
GetCurrentProcess
FlushInstructionCache
ReadProcessMemory
TerminateProcess
WaitForSingleObject
ResumeThread
GetThreadContext
CreateProcessA
SetThreadContext
GetStartupInfoW
MultiByteToWideChar
GetModuleFileNameA
Sleep
GlobalAddAtomA
FindAtomA
ExitProcess
SetEnvironmentVariableA
WriteConsoleW
CreateFileW
FindClose
WriteFile
FindNextFileW
GetFileSizeEx
FindFirstFileW
GetDateFormatA
GetSystemTime
GetProcessHeap
GetProcAddress
HeapAlloc
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapSize
LCMapStringW
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetFileType
GetModuleHandleExW
GetStdHandle
EncodePointer
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
LocalFree
GetModuleHandleW
LoadLibraryA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
SHGetFolderPathW
CoCreateInstance
StrRChrA
PathCombineW
wnsprintfA
InternetSetOptionA
HttpQueryInfoA
InternetConnectA
HttpSendRequestA
InternetCloseHandle
HttpAddRequestHeadersA
HttpOpenRequestA
ObtainUserAgentString
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ