Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
AiStubX64.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
AiStubX64.exe
Resource
win10v2004-20230220-en
Target
MDE_File_Sample_fbd5060c1824c6eb85ae40effd5b8387dd2618e6.zip
Size
269KB
MD5
ef9f01aeb8dc509e605dc669cab1e254
SHA1
b20cf88f059e6f7766849bc2cce3383815a79ea6
SHA256
b8431e9855a3960b7b3e593e9f6e7ba15a70f83425fa60cd58115b46ff892869
SHA512
ab57e12d8004c3cacb9f1a3bc7bf15b3fd8b5e41644cd2e183c8251d278459086e4eb890425b9e7c81ddf30be526d81f92bfd6b27932e9dc6ae87ea111a2763d
SSDEEP
6144:4kgt8SzzhuxUtMHUvqrJL3HGVWaiofAJS+DwQqpT8+096C+cjh:rJSzlOqvUiVWZ/UQqF8+w62h
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
CN=ASHANA GLOBAL LTD,O=ASHANA GLOBAL LTD,ST=Buckinghamshire,C=GB
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
ord205
RoGetActivationFactory
RoUninitialize
RoInitialize
RoActivateInstance
WindowsCreateStringReference
LocalFree
DeleteCriticalSection
GetProcessHeap
FreeLibrary
GetModuleHandleW
MultiByteToWideChar
WideCharToMultiByte
CreateDirectoryW
SizeofResource
EnterCriticalSection
WriteFile
GetModuleFileNameW
LeaveCriticalSection
CreateFileW
GetCurrentThreadId
OutputDebugStringW
LockResource
CloseHandle
FindResourceExW
LoadResource
FindResourceW
GetCurrentProcessId
FlushFileBuffers
GetCurrentProcess
ExpandEnvironmentStringsW
GetProcAddress
GetSystemDefaultLangID
CreateProcessW
GetEnvironmentStringsW
GetExitCodeProcess
RaiseException
lstrcmpiW
LoadLibraryExW
GetModuleFileNameA
SetLastError
GetModuleHandleExW
OutputDebugStringA
InitializeProcThreadAttributeList
FormatMessageW
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
GetCurrentPackageFamilyName
GetCurrentPackageFullName
DebugBreak
IsDebuggerPresent
GetStartupInfoW
SetEnvironmentVariableW
GetEnvironmentVariableW
GetFileAttributesW
GetSystemDirectoryW
GetCurrentDirectoryW
GetOEMCP
GetACP
IsValidCodePage
SetFilePointerEx
HeapDestroy
DecodePointer
HeapAlloc
LoadLibraryW
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
HeapFree
GetCommandLineA
GetCommandLineW
FreeEnvironmentStringsW
SetStdHandle
GetConsoleOutputCP
GetConsoleMode
WaitForSingleObject
GetSystemInfo
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetFileType
GetStdHandle
ExitProcess
FreeLibraryAndExitThread
ExitThread
CreateThread
RtlUnwind
TlsFree
WriteConsoleW
VirtualProtect
VirtualQuery
LoadLibraryExA
FormatMessageA
GetLocaleInfoEx
GetStringTypeW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
AreFileApisANSI
GetFileInformationByHandleEx
EncodePointer
LCMapStringEx
WaitForSingleObjectEx
CompareStringEx
GetCPInfo
QueryPerformanceCounter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
TlsAlloc
TlsGetValue
TlsSetValue
LoadStringW
MessageBoxW
CharNextW
RegEnumKeyW
RegEnumValueW
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegDeleteValueW
OpenProcessToken
GetTokenInformation
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
SHGetKnownFolderPath
ShellExecuteExW
SHGetFolderPathW
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
VarUI4FromStr
PathFileExistsW
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ