Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
03-02-2023 22:04
230203-1y75bsbd55 8Behavioral task
behavioral1
Sample
VMProtect.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
VMProtect.exe
Resource
win10v2004-20221111-en
Target
VMProtect.exe
Size
20.7MB
MD5
aec99b769f8b6f3123a2e1093924b8d9
SHA1
161e809ece4b66c98b2814598c890878e00a935d
SHA256
b65cf8d20570251862e6ca7df92f29c7ab0fd2a1154d623628bc9b6cefd29afe
SHA512
4fd7e154195e4549b62c64f5d8114161ad6fd682c4945491d203a8db47661fcb3c12e2f2f712962b7496f467ab1bfa5a5ac3e9fb72503ba7407b420e0c2d74b6
SSDEEP
393216:jqj5sYHvvibHwAh1ml1IdnMiAbdqdEhhNj4zeTyktSr2IX7YU9D5Q5d/n:js5RHvvibHwsMl1ULMdXhHEzse2S7YUo
resource | yara_rule |
---|---|
sample | upx |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
CN=Ivan Yurievich Permyakov IP,O=Ivan Yurievich Permyakov IP,POSTALCODE=620144,STREET=8 Marta str.\, 194-236,L=Ekaterinburg,ST=-,C=RU
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PlaySoundW
ImmGetDefaultIMEWnd
glBindTexture
gethostname
SetEvent
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ReleaseCapture
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
SetWorldTransform
CopySid
CommandLineToArgvW
OleGetClipboard
GetErrorInfo
EnumProcessModules
WTSSendMessageW
5N&x�ַ�F[Y}��b*���J�p�G��wp�O���1)��C���,���7x���͆'5�jM���>�Y���}0�s����+�^(�1�Яǧ��%�&���r"G�I<�7��/�ƀC-���Eפ�pKJy�l��9a�AbN@�(z�P�[���M�s�'���OYgK�u�u,�5�wK�#l>7ҽ�6��..�e��Ee9Y�$���Y�[Q�Y\�ͼPX��R�F��?)JR7W�oJ?����Ķ;f��:/��cծ6G� �o��x���2 x��Ă)<�E�g�RnmUOzW���bx�b%���9��H����vV!�b����� �}6��s`W�Ttg;�x���/���h+_u=+"�;1Aq�cmG2+���N-��s�����Cu������+ ��~ n�N�fՖO��Q}!܆: ��5�#����A�T�|O�ХRk:�q�Gd���n�Hg�� �m\ 똶r®�P��O/���r���A@ͣ�p�h�� �_��L�̺��$чV�k�����Z�Q�J? ܈��U����~Y�+y�jVN��1�\����dZ�,fo��Qn�j��=r��Ls8�������M��H��1-�� ����?��t��m��e�������y�(X�h���R���Uu����&�Ƴ��M�4N@���>~������9u��E������ƾ�t�;�&�L�M,58�d�5�b�$Y]��=w{V���}���[�X������f�v-���zٮSG��� ]���ACh[[��#8{�y��[�yw� �Bκ�h'x�p�#/�0��}�Q�q�����%~]^_�G��O��4��=�^�ŀ�̽����Wж����d��ӓ�I�z,��>o�E"o�b��]5~��o͙mF��KVrM�$Zy-��!Ɋ�w������m��myIنl-��sx���QR�(�a��Z�D�F*�)>�l���m��f5�nGݏU�xMg:d�'r��|�����+U�� ���&D���@�����p-��؈q���qQ���� �"nU\�A�<g� k9m]�U|�G��-5�#����Vw7̔YjF��X�wZh�_�4ߋ����/e���������%S߃NH���Fj�1*�.�DG�ձ0qn�,Ԫ$�."'�O-t�o�Qu����rxD�&G���+Yw����c>���d�#�Y�&O��=�:���'�ޑ�����?sK�^GU ��|/v@��[c�I\&��"���~�,����,��l1d*����ql��Tܗ�.dD`��>�� 93P��kO�q]��1���IEϖ;�|yk��W�K��_w��PEb��1�$2�Z�l�Đz��6\���%�����(��}:���eE�_f���/�[��Q"7����7���o��RY��2>_��z�V6g�Ɂ��Ԋb����h��"� ����t��)vZM�}���EBr�����~�_��H�=��@��k*�kS�,6Ɇ�l�7a��a�0���Σ�o��E͝�������G�_U���?��̣�rE@lj�b\3ջ���c;] \v��m��2 �q�5c`��<��y'�ˣ|�fL8dy�&W6, � � �,��Дρ�os냿C�J�UV�@3A���e�Y�'Gwg��q��2�d����X�Wo�T49�A���VAh�ѽ�S5�I���yd�_wa��c^cZ}�+�j r��#�1�k�v��Hu��>��������1B c䞏��7=�y+M�5�dJn�dM�ޡ'�-�⊹��\U��p\LA1h�.˥(1�LZ���A`ыК������ ��0�J���o��Q^��Z�ې�|~S`�7 �^�.��L�U9��NRP,�K�z�fp�-�-���D���s��%�D����s����G*([�@p���T(��a����,9�ҰtK��_m�g��@N>܁�v��e�#$c����{���� ��C���'m$��A��x)>Ӗ�g&ɟFc M�ۜ�}ȬI��_��53���\���o�*�3J��K�*=�X@���>���yi�9��V�ڷ^ϭ���^���*��@Z����K?ފD����g�qݫ�|�HTN�BɃ�%xOVU�֏�Ӄ�a�G�x�[P��y,��B��-Zc��ج�[%f0-NbG�k�R���Ƚ��Z]�J�~���3lw �?u����MK�帽��g�c�uSU�Dž�������� jF!�mg�,�Khæ��}�;w�R0������e&�A��@Wy��� �D� ��Q7��f��B���+M�X3ݵ��w�ϒ?�1�ZSq{w"<t75���.����wu�N1�����ZI�NN4���dHj�v�g�r~� ���X�RZ�ja+z"���Q��a��y��ՀG+�u�p̈�����A�ЄX�t-��������(?Y�!����2X:�i�#��������b��_��3�*�(徟� #�myy��bɃ@���T"0e��j鯢��2GQ �-d�U59*k��6���S�c��7��W�g4��Do�T��ƣ��%�4���XҬ"9T1W���&)V���ݿ!E�]!�� ��Xa���M\|s�gO�@� Pxr�hB_hBF��^,�u"�|��}#��٫�^�0�3���Y�;z�o�������O��W5#ރ��щ};A�^��j��NL�c�9T!1zO$��`���EӸ�!�r���}b~2{I�S�͐g7f`�塤l�;gH�nyB�b� ��wڳ��g�b �-4�:���yzG�'�{���>���[@����4Q9�D�q\ 1p����ZY�i#$+�l&z�)���)^�&����h����/p��m�W�e:�qRKf�j�I����������Eʆ�PVy�hf��k�?@����+'y�qD:��2��^X�m�K8`�EN�1�����Gp�-����I�o�->�0��St,�(�A��Jy����uv��� �V�X� -3L2類��xW��J:MN��U���� ��O�������pinC����p�x;���"��6�g>�Q���!az�����
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ