Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
6b73c061a10bb1541ee13eacb6bfdd97ba64ba9da7f3929a32ba9ae0ae4ae00e.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
6b73c061a10bb1541ee13eacb6bfdd97ba64ba9da7f3929a32ba9ae0ae4ae00e.exe
Resource
win10v2004-20230220-en
Target
6b73c061a10bb1541ee13eacb6bfdd97ba64ba9da7f3929a32ba9ae0ae4ae00e
Size
569KB
MD5
ac4e407be4476c163fb9907ab52c0e37
SHA1
74b9be053e9efe0132849e00022079388816349b
SHA256
6b73c061a10bb1541ee13eacb6bfdd97ba64ba9da7f3929a32ba9ae0ae4ae00e
SHA512
e7a8b141526d59466e0b9138cbdf6a5edd3b0738ec3c38e278798951fa95b10749521545a90ce57aa64edf38ed6262d416e9c863f7f7a83d971bbe9633708003
SSDEEP
12288:7BDr8BeXvzGI65j3MoL12LAdTm/R3gmuHOR58YEWdQ/Id:VrYeXvzGz5j3vLGtR3g7HK5hzS/Id
resource | yara_rule |
---|---|
sample | vmprotect |
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetVersionExA
GetModuleHandleExA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
DialogBoxParamA
SetEntriesInAclA
ShellExecuteA
CoUninitialize
VarUI4FromStr
PathFileExistsA
InitCommonControlsEx
GdipAlloc
GetAdaptersInfo
connect
VerQueryValueA
DestroyEnvironmentBlock
EnumProcessModules
,r23�NG&��"4|c�#�"�d����s?�k����?��L9�ܹ�B�%)�94S�ב�>�h�;z��-���~�\������I�f�2\�y�}���^��c�� }d����/Y��$D�@�-d"F� b����U��]}���_���x\6O��V��Pc��ѐh��-Y�%��1�tmh?�¡�$KΑ�����hW.��[�A��h���Ѐj�U�J� �m��]�y��5���P���[~D?��1ڰ���}��U�w]�F���I�� [uxu,��댝F@���Ѹ��UR2�����٥��U�����i���A�� 4��2Y�p�L�Ze�1ޢ[d�a�Vq�����ڃr� F��?�D�;*����G�������D�u��'H������5��7v1?ȿ��a�����M(�&��=\ MF�2�R�K��g�ӑV�j��=�+��;DQ �I�I�)�uK�K�VR�L�.�J[�J���t�z Y8�&���=H$�-C�b�W��<����aTU��q�&?f筎;�����ćR���= ���%�:���}�NES�<��痛��:�Ҍ�7~���<33Z��۴1��+��C�WM���5�1����AG[wls@��h�sm��'��K�R��F�D(�0�y���n�47��G�^m˗U$n&O�z�<�'^��Se��A������r� �K�V$�Ƞ5�qz���ᐞB�"�����0�0>4#0>�d}���mL��9'"�=haz�<�<R,'KP�i�}Hk�{b�L�+�/%�:���n���}?�ON�VVT��]�����l.p�p�ʊ���w씇jr��Giqpd�ǭ�D��� ��\B��� �Ԩ��P�T6c?\����1���d�F`[��0Nb:����Mo���c#݉8*�}��Dx�5�v�7K�j�A|��|,���/Ħv����/BK`�81�.��v&q����۶��б/V��'��Po]"p���v�d�|HK �$uP>�#����j۴��2��![�|��f�X���_�V�yzu�@����Q�&hs�'2�'���ˆ�ݒ�'����څ��Q$�O�0��_�X�/��� Χw ���,�)���O������ю$L4/�n%�p���Ԭ2PI 5 >[{g�.X�������� w�蹈G�����G��K}w�r�1�X�"�������:%�=����3���Es��]�a}:�A���s3n���4���.��Na"u^�S�����Y�����o�|�ꑒg#Y��ik�I�'���$Q��9ZC����S�W�Y�������\��}�S�V�m'.���Cx�dFo�$���8�Ftkw�UG\��5?��$�5���w�� �cD�`�� ���(��^����H ��Ba��:��ɰ���Ρ��Wb����`��QG�HP��!����=,<S��w#��p"Ώ;�2)'��E��L����9tǔL���7<�;�$k�ͩzPM�ԵU�����>{���h|�o���xwY`s?�鸓 �z,/g�}#�Z��[2���!��v�;$�@�*ek��8Tu��h-H>�P�ls����A�����f���WW���1a�AN��w`�<�71��`^�R[��w6 -3��s,R)�T���N+j���&����i� nbo��3T�"3���)'��d�S���C�"B�ԥ_�������U�1_��V�4pԇ�皁;�;����צeXV�b�����������J;�~ ѱ����&��Uq�ys�M�3뒈��n�>0ViTg�~NOKd����N��T �?��K�#D9����2Z� [�ӂ� ��1�o�HH=h��Jq3~���,��Z�:��ߚ�t|��.x�Z�1�@����g(;#|��m,h�z��'b�Y�?���1�'T0 �a��ht`xfz��$7b=)U���@ji�Ţ�<=����/lyw�Z#����}��rιC)��,[^�Z�L�wKͨ��J��R}!�Y1 ��<#���XT��`�Y����X���@3Sr,�p�бhlzL���Lu�N������0R�A)ً-|�����CMq0�������r��� O4 T�%�!�u��',W�iL&��b�س�*a���{y]��S�_|}���_�a���py�P�}[ۜm�Q'�H�Ղ����ˎ�hނ`�!�mw�Tc</�����ƑRY�C����d ���,�?���V�f�й�Q��:{T)̩3�*��U>�d�c���DF2s�n�0�-�N�_0ex��%uYE*�Y6�˹��3ܣ^��pO]�c�2g��`)&m���Ƣ�c�����ԏO,g�� �K��Z��b5ֺ�%|�\�W��b��ѹ�8F�`��Hd��Zڪ0�ڣ~�LnKv�ޭ�[*n]�����Ë;^t�51����V�k0ԋi\0���S�x��t˦Ǖ����P�y���g�D�#�q��/� ެa n�Ɓ7} ?HE@PanU�WP�%\����x��YM�d$�yX������F3��%�{;d7f��|}� ����QI�:4�m�*����/�S��<!6nu��ԋ��Ǥ���!�i�̬(=R����j\��I�M�wħRi�/��q�+��>�Jc֮�y'�IV4��t�,H%�ݹ9gB��2ĉ�[�P!T��Y�Ε�����܋�n/z#�� �q���D���P�Y �37�/�{Me�������l����.Y�0�V��e&�4?����]k�Z߷#È�q�S����A r����$?%�q�� ����ܙ YT"�v���4rrCo�f���c��x��'��³��7��0q��kK��J���Dy�<GU����0�,��9Q�%/=��_k�@д�N(�D�֤��]� =��pp~!�9'q/�w�Sp����<r���7�y�ċy�c���F�WW�v��Wt0��)�lu樆Or��ݻA�0�-�� ���"R�Y��٫����Rya۵������]\J����?mU��_�,*�M[���<�$�\�]f���!
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE