Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
excavator.exe
Resource
win7-20220901-es
Behavioral task
behavioral2
Sample
excavator.exe
Resource
win10v2004-20221111-es
Target
excavator.exe
Size
26.3MB
MD5
70df3befd1b3f8e8b016812b53ed0a04
SHA1
0e600154586673dac9d48f5bc15a6b4c211ca6af
SHA256
668f2520e49618d209ff2d7e15dfa7dc416a95e6fed03ba59007378216aa4cde
SHA512
7c6d9fd0045fb5f14d6b8a6a2199397c7e91345055aeced78c18948ba5af2a989d03d41b99f20c53259031058e1dac6dfe28231141bea3455ed5507402999c78
SSDEEP
786432:mNLdz/9GtJ8C0rbxcjXJBYB2SGEiJORRps0VAgb:4dRGjH0rCjX4ISGELRRpDAO
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
SERIALNUMBER=6633994000,CN=H-BIT\, d.o.o.,OU=SI28401280,O=H-BIT\, d.o.o.,L=MARIBOR,C=SI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025349
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=6633994000,CN=H-BIT\, d.o.o.,OU=SI28401280,O=H-BIT\, d.o.o.,L=MARIBOR,C=SI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025349
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_BIND
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PdhAddEnglishCounterA
clCreateKernel
CertOpenStore
ord40
timeEndPeriod
accept
GetVersionExA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetUserObjectInformationW
CharUpperBuffW
CryptEnumProvidersW
ShellExecuteExW
CoTaskMemFree
GetAcceptExSockaddrs
??0?$codecvt_null@_W@archive@boost@@QEAA@_K@Z
??1?$codecvt_null@_W@archive@boost@@UEAA@XZ
??_F?$codecvt_null@_W@archive@boost@@QEAAXXZ
?do_always_noconv@?$codecvt_null@_W@archive@boost@@EEBA_NXZ
?do_encoding@?$codecvt_null@_W@archive@boost@@EEBAHXZ
?do_in@?$codecvt_null@_W@archive@boost@@EEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?do_max_length@?$codecvt_null@_W@archive@boost@@EEBAHXZ
?do_out@?$codecvt_null@_W@archive@boost@@EEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ
?is_locked@singleton_module@serialization@boost@@QEAA_NXZ
?lock@?1??get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ@4_NA
?lock@singleton_module@serialization@boost@@QEAAXXZ
?unlock@singleton_module@serialization@boost@@QEAAXXZ
NvOptimusEnablementCuda
��A�֙� sv��)D_�ˡc�)�!_ε�$j�WW�d�H�����A�3��Lɳa�87�GdoMz���n� ��Ʒ~n\�����-�C�h��=d79Q8�Y��.�S����A��^j���r2��I�E�cE��2@^"YʘZ����W�V&�����:�g�� ����7|d�M����./c��u�{�~�� ���ސWSR��a�V��1+ܱY yw��( {�k 髽�!3T*�֍(7S���d�?W��^ |��6ыͮi�t� )a��Sz�X%=g �H�Bu�K�+���z ��"R+ ����@��g�hg��.��P��h H��'o����q��@��a��/�H�;�����Crwʿ+�f}�*ˬw�b��H@�ʣ*Z�NpK�*�%�k6(�c ����25�74�<�?Xm��/ȧc�#|��w�57��?? ��bx�#��e�x�hQ��8:��*�*�]8��ȍEvP\��)�Lƕ1zG�/O�z ��t+��?��� ����h+��pR�ȣ�ׁ�"< �U���U��:��J"�Xx�T��N�0�%eQ�_���ɧ`q�!Iy_���S-�{��g����2�m��{n鴧|?�2�;�y�Y��¿_��9Vn�1Z&���W��tJ֊��Z�PO�=[Td5=xH&�:?��7$��T&᳞3Srj����5�Aw>�^e����q������vD��M�pGZH��I��%��r��@UZ�NX�r"u�F���{$߂�2[!�KH!<v{��QO��1ѮU��Z�a� n�.����$9���J�vr(�D�םf��j��|�� �ƹX����e@�1�O=|SA�����)�H�TQ�~I#�1O�91�ЭJIɐQ��KjNj�� ��0V��#)]�c��'�ͅ������ ~���G���8P����ɡX����q���� �Q�⩋ �-^�����KS�K��d���P�Z��a�Z^5`�A�m�L� a�U��o�'��x��#(g6�c��5�v?��Y KOd���_�Qߊ6��v'��]��%Fg�j�ͺ3�� \尘���Yk���}�R�h7�ɽf��?]��k��הq���o����?Z�Xe`���:(�ӄo=�Ⱦ�Ƚc� ����p;�h��^�3�x���ZN4+�4�8x%��0ʈ�*��T�%Ѕ�l�v4�<eW��� �z���f��nx*�W� �(%�}- ����Ӫ�ÒcX���`�<�E2��V��{�c�]a& �!=�@���Z=X�Ô*�4 �B�n'2>��(��WQ��F�N[�#�K6T�Q��f^�2�_�氇�-��&glzX;%ar������h��α��?j���8��a`16F���N��o���osi�Ddt�>���%���3�E�?5��w�<�}(�L�<�d+��@����u��0/$����yJF�_l��:�D�1-��W������5�G��o���=K���1z*���r��[_�GF� ������� B�n��������-�gj�O{��|9"������ɍe`;�z�a�[�A_�P�&D��ڑ�ĥ�+x�P���kR����|�^-TI~�}�g7� (փz{i�T �?�۾xn��-� :����[�1�K���U�&U�R_d ��pe�*{��Y�31v{e���vI�՛���+Gfd�镽96N�����0����FZ��� S�6����1���ZiT�OYK�j��n��z�V� �RB�y�[9Sn��t�9}��Qmݚ� �8�"W��}�������>���"��xժ�+<˳I3�@HnA*�o�7�����S�͇ܓP��.��``�JFF?�p7F�9^��O��|�l�������T��=�-�����#V�9/�f������~��wzp=G{�E��M�n��o�����Fۆ��,�3yߎ��uu����9��t ��m�^��U��o�J�E��������۾��`&ξ����R�b`�uKT�,�h�2X=S0M���i#�t����"��x�N<�2����6�/�z` ��yjnx�h��e��8��u?��<�����������e���q�X�!l�=��h�w �L{fN,\���6��$H�z�DշO���`��9K�7�w���9��ڕ��6�9���|���u�DZQ���~s~��B�oyM�1&I�K ��R�I�꙯�N�}�zO_����/���U�T7��4����Ow �o^�Ŕ���T���U�gi�큃$~�T%��דs�-�_��8+��2��t�hhB�$ya*�0XP�1+�>���e����f����}�B���/����?����+x�e����*'��*_��7�<7�S��R���[vf@7�<j ����I��{�J�p�k��^[#㛏�,�M� .����\B��J*��O],0���P�����]۽� �@k\���h���{��Qӡ��"{a�>9�����hZDAx�����Kɲ�l�~�yN��7� �X�f��f���?LK�;Y�Yhovs�M���� fy[�C���5��˃XA���h�U�@)� w5H4���6�$��QM��\���=��N�_a���і�U�i"Ř�z����!gzR�*n���o�}����u�(�U �X�D�ӡ'���Z�Õ�&�0� 3ڌ�;TCNQ�9T3��)�$%��:��{D���T B'��� ~�CUl��7瞐t�Q9��� k�� �@��&~����=�Ƈv���Vz�r1���N~c�-�(�A'�`N-� @�̽/��8J=|L�D����!�{8S���ҿ�Ue���N �g)��d]��uyf�+*�d(��S�hys��;���gBB�\�#_�/���v�&�"���E!tRF;T7�14g���nT���t��P���~��$�-�hrZ�^R�w}�t�^� �.QK)�=����(�F�"MP^��Ґ��$�q/��|�n֡�*c�M�N���B����mЍ[���^m�_\�G�oY���c��}h��;�g��-��<dt��L�D��b<¨�F�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ