Extended Key Usages
ExtKeyUsageCodeSigning
Behavioral task
behavioral1
Sample
3b642abbd002d2aae864ce0456fd71f28ff67d3e73a2ef3d87425704a4c1104a.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3b642abbd002d2aae864ce0456fd71f28ff67d3e73a2ef3d87425704a4c1104a.exe
Resource
win10v2004-20230220-en
Target
3b642abbd002d2aae864ce0456fd71f28ff67d3e73a2ef3d87425704a4c1104a
Size
5.7MB
MD5
393cb7b2d6a95cb053f119c443c9e33a
SHA1
3cc31a587610a034b5647a2acf7439e1d3e9fc2a
SHA256
3b642abbd002d2aae864ce0456fd71f28ff67d3e73a2ef3d87425704a4c1104a
SHA512
173d7d5aeae393e15e7953d7b45a5ba19fcb79caee0209b9fb816d8fb211d6eae66fc552d93a36f92e633622b9f7a8dbc02457b3528d03aa853ecf98636aa8e7
SSDEEP
98304:Amf9i0ClMDIoxOb5yZmvnKEs96+B5GkbVnhgRfd1lcGsxS5W2l5Uujk0oOIOeFF:51LIoxObQZ+k9Hzth2fd1jpVCOFoOI9n
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
VirtualProtect
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetForegroundWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
CoCreateInstance
VariantClear
send
WTSSendMessageW
Q46� ��9U���T]v�pq����J�W*10�"#����V����]�O�-I�Q�չ|����w�ܡC��ɘlRL%3�"bh�/V�)�#kDX�j ����p�aK~�� &�N�q��=���鱌��⢜0'�QϜBB�T�Omo�vH�%�cW��4�{�#�#��6N�W(��6`a,OJ$�r"�i.�֧�d5�;�e����8��I�=�Ӷ��|P�����D%:g��J{JN���/���I)VaT����[��k_\m����aݣd\2�����B XWW���S9� L�i��3s��m�p{|{��0�W��8�Àl27�w⡒b2U ưף�ں��+�Mʼ�EAő#W鮅}�O_��h�R�����F7��0P��G7���Τ�2�/{���[����N`��y�I�����<R�܃H�l)o��a���=q�)y�����&Q�VN�"V{����q��_��ݻ�y��{z�oB�K`ȉԠtΕ�r+�i1_����5���&{ lK��E0�] oÿ��ҫ'���ːJ�SϺ�cT�I���Et7�E2�Jx�h�+���%���N���D���b+} �Q�7���e}/w�� �wZ����m<��W@����@'��8�;���o���{Ӣ�<�:h�Z�%__b���ߍ��w͎��Iޑ3�W��:xhl�h�D'�$�� �B�@�{h�]�h� �s]��W%6��<�҄�����;�}R�8�b��҃]���u �9T���$F��g�����O�>��DN ��m��Q�6��iJ�B]q���B���-��j"����9���X,&%��xսi��Z�[<�q*���V\<�"��I����f*�l�����!�.��Uo�~J: (�e�w�DI�WOV��"�H"!Zǹԍ|�?�|g�a��5�U�t'$�?����'<H�!ej͚.�y#y��(��J6��dx9;�r]�{B�KƱ�W<Z���kk�yqxx�� Sؙ�;��!:���������B����ȗB�A=x����S*�"Nܧ�_N�n��O??v|6rZqR�)����<2A߇�Wz�h��Ot440R�$W+��7�Շ�P���ӫL/7ȚQ4'��'�𡅣(��R{<5d�����nW�Ȫ�f�����k~�)���e����f�=� y&s������gG��箼¬ ��E�����m����:��� K����%ofz���V�r�C*L|�;�T�;^Ix=mƙj��Um��� ���g����u?QE��'Zr�p�K��c��=�p�0k��\�ք2����̂ �"�<�݊'�@�5��=� �s[�V����i'z �� /�L����M���۬�����ct�z���>�~E=�_�!��$�:����PZ�-M�� "��k��U�XxDNٖ��rA:B�5�2-�u����KG��i��dw1�2����DUY�i~I�H7��;�6����>~�L}>̚4?2�ɓ�X$o��s�w0�� ���\��,���Ψ�hd�"ʑ�9��\!�t��I�+!z�A 3=�2�հ]��=�����c�YTPj'a��c�!�f��{�7���e�����qi��'�醫�s0�G��g A}��G��F�U�m�=_d������\��A��� Fz�C`$ D(��T�8�Mp���я\y��B����RLV��ګ�����aE�>����Ť�c¹��HC]�j����d��M,[�������U�k��~�.e|���=D�z)ajd�����v��~ʇ�)/#�!,BD����e�T�0��D�e�9���p��CHa�V�����62�B��6�����<�x_y�pԏw=�\r�ϾH4���E���x�/��CR������n1F%PW̠�U��F�-��tH�h�h�Ѹi��F`n8D�w<Vl��A��Ř�B\D�ie\��,F����QV*�l��"�ӑw0#�Yo12��pȄ]S:��z����"Q�*�̳&.��J���`��3��+�=��9NJ)�?^�V���%��]�����x@G���8v+Iw�Т�}c�c-�X��։�@��>j,Mb�J��W��4�Ua�rz��<;�0N�Hk +3o�&#����?P�.����m��a������y��8��1T� <��H�TD���>�ӗ2��rHI��5��lеBJƂ&�$xc�5������z�w����R#���~�>�;�-s=�NKe���m���)I���VAױ��,��MU�dj��E�8/�7M�c�5�b�żN�@���&U���sx�_���Q�~OiU��ڋ��68C@?�u]j�;萢ˀ���Bp�ɀ�T�q�(���x�h�3wv����X OA�n� ���_���C��5�\��b�����0���z/���vk���]�3l*Gt���O��N�c'X��Bߋ8+D��M!�WZԏ�U��Rb�X� ��h �����L ���w�D���L���SrI4S�-+�Q ����+� �4ƺ8ؚ^ȩ!I^�xO�e���|���V��WmCi;�ˬ3L�%=�������@r7j#딠�������Ĝ2��)<��^�ૅ9��b�%�6�20~>@wQ�Or�,T�j��^�Dh9�f��0h�"4�x���m�0m?�w`�SN��ܹ�֞<�e��f�(�����Ն�qC��0n�w߈��E������Fu�\z֙��pb�I��g_1YW�c"��l�[��F��gb�����kP������ ��>�Fk&�؆[w������2��ᯃ�<ӹ}��NU�~�Ved�L���I���r�ƾ����������mC$��!��o.�`���~P�� ;���2̺����ZVЁ� )^��?��T<?Ϳ#h��GDw"���pX'����O��]�X����.��8���m�eW�`�c?ῃ�4�#о�%ƍ'�)3��^h"��Zk_�߲�k4U�tI8�?�75]�����{Ϛ����t*&s*I��X���==�I�*��&Z^U�!Ѻ�V���lz�;����8 匩�p�H�Sn��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ