Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
AgentSvc.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
AgentSvc.exe
Resource
win10v2004-20230220-en
Target
AgentSvc.exe
Size
269KB
MD5
61bb2cf28ad4ab7ea1368ba02c4074f3
SHA1
306f61a75a85eb0fd23c40ee63469c0e24472f51
SHA256
1c64bf2f2f643fa3ae46c57a2d9397bb30005fba06382d33eaf3651a19e7d07e
SHA512
7aca2feccaadcd46dc10d493a23e3bb0954ceb626f2d057f1f7ae90861605dd15437a7e7555203d84be5712a507784cc760b5261f65d58fdd261939414f60368
SSDEEP
6144:8wlhQxva5C3RZOul7Nv8bEtHKnRm4nkOxh:8i6a5q8buYmPOxh
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
CN=Panda Security S.L.,O=Panda Security S.L.,L=Bilbao,C=ES
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Panda Security S.L.,O=Panda Security S.L.,L=Bilbao,C=ES
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Panda Security S.L.,O=Panda Security S.L.,L=Bilbao,C=ES
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Panda Security S.L.,O=Panda Security S.L.,L=Bilbao,C=ES
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
CryptImportPublicKeyInfo
GetModuleFileNameExW
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
??_7_Facet_base@std@@6B@
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Incref@facet@locale@std@@UAEXXZ
??1_Locinfo@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
??0_Lockit@std@@QAE@H@Z
_Mbrtowc
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
??1facet@locale@std@@MAE@XZ
??_7facet@locale@std@@6B@
??0facet@locale@std@@IAE@I@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?id@?$numpunct@_W@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?widen@?$ctype@_W@std@@QBEPBDPBD0PA_W@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?id@?$ctype@_W@std@@2V0locale@2@A
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Syserror_map@std@@YAPBDH@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
_Mtx_destroy
_Mtx_init
?_Throw_C_error@std@@YAXH@Z
_Mtx_lock
_Mtx_unlock
?_Winerror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
_vswprintf_c_l
strcspn
localeconv
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
memcpy
ceil
_libm_sse2_pow_precise
__CxxFrameHandler3
_CxxThrowException
swscanf_s
swprintf_s
free
_purecall
memmove
??2@YAPAXI@Z
??3@YAXPAX@Z
??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
memcpy_s
??_V@YAXPAX@Z
_waccess_s
_waccess
_wcsicmp
_controlfp_s
wcsncpy_s
wcsncmp
wcschr
wcscpy_s
_wtoi
strcpy_s
isdigit
calloc
malloc
_wcsnicmp
??0exception@std@@QAE@ABQBDH@Z
??1type_info@@UAE@XZ
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
?terminate@@YAXXZ
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_XcptFilter
__crtGetShowWindowMode
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_wcmdln
_fmode
_commode
_except_handler4_common
__crtSetUnhandledExceptionFilter
_invoke_watson
sprintf_s
memset
_except1
OutputDebugStringW
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
EncodePointer
WaitForMultipleObjects
ResumeThread
GlobalFree
GlobalAlloc
SetUnhandledExceptionFilter
DuplicateHandle
CreatePipe
GetExitCodeThread
TerminateThread
CreateThread
GetCurrentProcessId
GetCurrentThreadId
CreateEventW
CreateFileMappingW
UnmapViewOfFile
SetEvent
OpenEventW
MapViewOfFile
OpenFileMappingW
InterlockedDecrement
InterlockedIncrement
OpenMutexW
VerifyVersionInfoW
VerSetConditionMask
GetNativeSystemInfo
GetSystemDirectoryW
Sleep
CreateProcessW
TerminateProcess
GetExitCodeProcess
GetCurrentProcess
OpenProcess
SetLastError
CreateMutexW
ReleaseMutex
ReadFile
WaitForSingleObject
CloseHandle
GetFileSizeEx
MultiByteToWideChar
WideCharToMultiByte
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DecodePointer
GetACP
LocalAlloc
LocalFree
LoadLibraryW
GetProcAddress
FreeLibrary
LoadLibraryExW
GetSystemTime
GetSystemTimeAsFileTime
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
CompareFileTime
CreateDirectoryW
GetModuleFileNameW
GetModuleHandleW
SetEnvironmentVariableW
DeleteFileW
CreateFileW
GetSystemMetrics
MessageBoxW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
FreeSid
EqualSid
AllocateAndInitializeSid
CryptDecrypt
CryptGetKeyParam
CryptSetKeyParam
CryptEncrypt
CreateProcessAsUserW
StartServiceW
DeleteService
QueryServiceStatusEx
ControlService
CreateServiceW
ChangeServiceConfig2W
QueryServiceStatus
CloseServiceHandle
ChangeServiceConfigW
OpenServiceW
OpenSCManagerW
TraceEvent
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
ConvertSidToStringSidW
DuplicateTokenEx
AdjustTokenPrivileges
LookupPrivilegeValueW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
CryptDestroyKey
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptSetHashParam
CryptCreateHash
CryptReleaseContext
CryptImportKey
CryptAcquireContextW
IsValidSecurityDescriptor
SetSecurityDescriptorDacl
AddAccessAllowedAce
GetSidSubAuthority
InitializeSid
InitializeAcl
GetSidLengthRequired
InitializeSecurityDescriptor
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
StringFromGUID2
ord165
SHGetFolderPathW
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ