Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
8d53af3f2d09c85e7a02b1e37f452e37084678af271aa7bfe1c607132424c385.exe
Resource
win7-20230220-en
Target
8d53af3f2d09c85e7a02b1e37f452e37084678af271aa7bfe1c607132424c385
Size
5.8MB
MD5
a49cb30eee4c7af132b14a3c3c6c5865
SHA1
50e2413dd07304dcea920f55d37940ada313ace1
SHA256
8d53af3f2d09c85e7a02b1e37f452e37084678af271aa7bfe1c607132424c385
SHA512
b61abfc0364f0f525fb68c9f94c24cf6a49e7eee8eb0fdbe56f168b77ae39b51755bf25dc08f841ef7aa08f3d2b0790994156f3e79738f61608cde3fbfe2631c
SSDEEP
98304:IcPSL3Vbo3TGpCBVcPCJoUZQbjHrx0tjyAbXmjdCZL18UIa3hswO8K7grYWTPpyQ:jPSDho3CEC62Hrx0tjxL18Xa3K8okXTP
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
GetVersionExA
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ReuseDDElParam
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
EndPage
GetSaveFileNameA
DocumentPropertiesA
GetFileSecurityA
ExtractIconA
ord17
ord8
CoRegisterMessageFilter
ord253
SysFreeString
WSAStartup
WTSSendMessageW
���������c���]�2�]�xF��V��~%���g���|���g�Z���8�_���N/�u��!`�8�8 �f�J:��0���f49Y�h�>|~�^���Z>M�^D���NN�aY��jN ;�w#p�E���ۊ7��d��,��HgHw,�=�e�� �z�:d��R�'6s��_O��l�$�_��N���(I��:�J�W��D'YE`�=�������,�,�Y)O�v�\x����û���#�Qk究�����?�J3��0]�*�U�7�����t�mĹ�8x'�Q^B�8��"~S�a�z��i1*#���Zj�v..�M==lH�E�b]�������T// À�^xon�G�����(��q7fOՋ���AʩZ\�J�!c2ւ��}�!���7O�8�+˻�l�0����}�:���7:�ԧ�Æ��������4G�����{�1?3h�ھr�q��1ⵟ%�x�Sv�0�@�P.��7������{���1��d;�sk�9�=)����,�E��2 .1>ŏ��B�j?<�W0��CKa�uO<P��Ez���a�v���7���Ň��� *8���\��T%Dd����8Ǚ��q�:.�X�.]fi �}K�W(O~g�!M�J`p�L�)0p8x�M�1m�I�i&Wh��>rEL�̊v��_�O$dN�w\7qm�{ϕ tY A?��~�r,�$��IYJ8��#k��'f�#%���o,��en���T̄�kb������?�1` W�)̶}L������R7k�8�0]Z�>H���s3��t�u*��&W��'�P9��2���Sy-�}�Wt44�J!������wr����II1m���g��T7�����!��i�&�� TQ�K��78�#����e��Zɨ};���mK ޘ����S�O���y�]��g�7nd�0�K�n��y4���z0��9WaN�za>3#��dcS��>�F�����$Li\�_���8:�(�1Gj����$��Vsc�iG���$;?-@P��"r��|S"-z��O�����B���%��9{�z�.�ݰ�����ӷj����s��'�7�9;*,����K�;��]�2c�=�'%�Rx��M;O��u�o�#�s������5��¥x��G���.j>��"�82N�%�/��_y���[�䦡L<P5Dqk�e]k��L*�ȑ}ΦY �ת!�B4�Q���.ak2����+䃖�h�K���#�X��`9�p� C� ��������ذH�8���m4��gJiuh�<�����T����Q��c��aZY-����=�.~�mNsm�� �Wˁ��v��l:�M �:Wa�L�<�T�8��e�'��)��Y^n�>5�̡\�&��?(n/7��s�jt�:m�2N��m�gg@=9�^ ^��WA啤��}��pB��L>��. �{L+� ��4KP� ��=�o��6�0�b�*�_ �ç R ��{�-����m�u<"ζ�p �Kw�.��XHT���*� w�FYt�6,�Y �~�Vl$��[K&�2s���xL[�rojĤ�eR��݀Z���P��9� �l���i3�T��wtf��w{�C�ED��Riz�Uc�j-x��d�c3@^/�:�-��O��F��#/&3<D[���Q�lH}�}����`�5:^ Yb��3�lc�B�ͭD%|$PW�ܻ����v�TA�t�QA?Q�D�3y�}I�*ڧPw�Q1ӻ6nT'a��YP[��0�?1�I���hK�e���5b�m�ZH!|Qz^����ݘ;ȹլ�S�(�o� �)��� ��n7-����W���R�/�K�&K%�86��;�1-���i�����Ⱥ���#�ųe�ը���9Sq/���GN�Ka�AcDm�YP��~^0J�|\�y�!G����.�u�}�5b.��c��2�����|��Ʊ�f&�rP. 3�����ֲfizZ\Gz/pe������0�Fmu70kUX�r5��@��®^����f߄.�'�o��m�"��(��o6��ڌQ�S6�,Nf�T4�� B�齙k�2�pe���&���m��F�I'U~��d}K�a���"["K�8�7�{�\fh��M�!��|� V�����k.ɮzno~q�q��/ ������ @^8*k��h'�Ч�5&�%�Qk��kL�D��V�ѭI��G;��u,�Ӽ����O���)vA���K����Cq|�������u��N>&d������ Cp���.D(7�U���5�0.U�Rְ����������e�R�7�8���q� $r/�Ua*�e����~�L|�zm��хZ�alU�s����D,�p�x��z5W?}r�������㽎�!'�m�}����C��ӭä����$����I�q��`�Pѵ��? �$xm* �g�}��K�("U��t`BS6^�8~��� ���l�FయD�c.�z ��֙}��j\�n�~���!u]O�E�1�(�����,8��v��:a�Pi�֨��ߴ9�b�� ��;�e ��`fE�f䭯I�[c2VJ�`�ڑi� �l��� �D��9+g�|w�y��������s��%��j�ƨ��&Y*� J5"zW�Ly�j��4&g�����&�b��o��7U��±�@ۢ�bڬE��P6&�����S�7ԃiD��� VK1����<��������x��'�\�*'�������c�vn��-�Ch��l_Y��G{�'�$!�6���ԦC]yr��G�~:���P5�8�'MV|yH@��-��)+Nbv/D��2��>�%{n����Kː�w�|��Q���;3��*�HS� �^\�@P'�����1�aq� ��Ǽk��+�|~^��"t ��duf�V ���"%Yc���7M����)��N��S���b7�s��r�uW �M�]���<Av��=S��k�����a�dsN��R����� �_�e�R'�V�<x]��H�ܔ�y�U�6�ssɒ��hu�������)x�)��~� �7���rH[����.��7 �h�B�?<t��*^� �%�Y;bزH�>6���@BNm��@�D���V*v4r
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ