Extended Key Usages
ExtKeyUsageTimeStamping
Behavioral task
behavioral1
Sample
7b00fd6d51b83ea4456472df563c3734f2255969b40e5cda061516250f70ee71.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
7b00fd6d51b83ea4456472df563c3734f2255969b40e5cda061516250f70ee71.exe
Resource
win10v2004-20221111-en
Target
7b00fd6d51b83ea4456472df563c3734f2255969b40e5cda061516250f70ee71
Size
1.3MB
MD5
23932d76200fad0915025e2ddb3ce5e0
SHA1
7f1849a7ef86d0550eb57e142e97aa1a537d6ade
SHA256
7b00fd6d51b83ea4456472df563c3734f2255969b40e5cda061516250f70ee71
SHA512
d098e8f8b5c81546fa69d3f27761ea2fef067eae1621947a03dedaab3ae4974112e431987647f5b4e90ee0560827403967b902f061966fb05e902edca87c900c
SSDEEP
3072:yMRHFg5vd41HknXHIKbAopL4XhKOJ4l9GW4oPMuC6nXwuC6nXquC6nXquC6nX2:bgxdyi3pDLs06oPT3nXX3nX13nX13nX
Processes:
resource | yara_rule |
---|---|
sample | BazarLoaderVar2 |
ExtKeyUsageTimeStamping
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
GetModuleHandleA
CloseHandle
WideCharToMultiByte
lstrlenA
lstrcmpA
GetLastError
HeapReAlloc
GetModuleFileNameW
lstrcpyW
lstrcmpW
GetCurrentProcess
FlushInstructionCache
ReadProcessMemory
TerminateProcess
WaitForSingleObject
ResumeThread
GetThreadContext
CreateProcessA
SetThreadContext
GetStartupInfoW
MultiByteToWideChar
GetModuleFileNameA
Sleep
GlobalAddAtomA
FindAtomA
ExitProcess
SetEnvironmentVariableA
WriteConsoleW
CreateFileW
FindClose
WriteFile
FindNextFileW
GetFileSizeEx
FindFirstFileW
GetDateFormatA
GetSystemTime
GetProcessHeap
GetProcAddress
HeapAlloc
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapSize
LCMapStringW
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetFileType
GetModuleHandleExW
GetStdHandle
EncodePointer
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
LocalFree
GetModuleHandleW
LoadLibraryA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
SHGetFolderPathW
CoCreateInstance
StrRChrA
PathCombineW
wnsprintfA
InternetSetOptionA
HttpQueryInfoA
InternetConnectA
HttpSendRequestA
InternetCloseHandle
HttpAddRequestHeadersA
HttpOpenRequestA
ObtainUserAgentString
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ