Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
57da4f40_eaf7ba8c46b2faadf6a232be87044c415a38dc38350cc75caae8b6358e9c679b.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
57da4f40_eaf7ba8c46b2faadf6a232be87044c415a38dc38350cc75caae8b6358e9c679b.dll
Resource
win10v2004-20230220-en
Target
57da4f40_eaf7ba8c46b2faadf6a232be87044c415a38dc38350cc75caae8b6358e9c679b.dll
Size
8.8MB
MD5
57da4f402afa1e7532a7f3913872803d
SHA1
3ddcce9796613a5fa1b6a1da144e760f935f6285
SHA256
eaf7ba8c46b2faadf6a232be87044c415a38dc38350cc75caae8b6358e9c679b
SHA512
cc646523c0dcc4f498ea6bcac5a4b0b7696bb2c6bc39054242915409eb5d4036d8f85812014e3e92f1a33f7aaa0dea2d99d9ccd4b1c469baffef19822675d95d
SSDEEP
196608:zooOWSACgN6xoT4+5YwUu/ju3d4fpfW/rbX:XDN6yT49w7ju3dS4
resource | yara_rule |
---|---|
sample | vmprotect |
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
CreateToolhelp32Snapshot
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetClassNameA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
GetObjectA
AdjustTokenPrivileges
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
GdiplusStartup
WSAGetLastError
GetModuleInformation
fputc
GetAdaptersInfo
FtpGetFileA
WTSSendMessageW
EntryProc
��~�p� �R���b����U��粧T�R�bEeCS��J ��|��ܵ+����j�X�{z܄�H�����aUFn+&���lq��C��`]OR@��stcQ�_H͗"�;ඬ��4���Q�j����m3Eg+�@Y�̎�l���&Ɂ5��Y�+n�"��=T��7�![h��@�~��{iw�7��FE�esT��Ď����xG�P��� m�8�da�a�>��h�g��v��F>Z��xNг�ϔ��. �}-p���ǯ�����h .�N�:|w�2$Gx��6|��c6��?���)�O>�ڐ�%V8lW������ݧ�܃C��)�)��]Z��>�ḫArv��M\<=6�y���Iu;;jx}��}�/tE%wQ�X���9�y ����c?*�����R�_`3}Ui�|"Ջq,�*����P�Ec�u���f�E����*a�s��E�����ެ�Sδk���o��:�����r�B��k&sʕb���<9c��"����=�B�����M�FLW�M��:%l�>H�hA��o�'2�V窬��p:{�"TĦ�M�J=���{�L1[{�DX#�|����",�i��qڮ�B��:��t29>����<��68P��y�@N �϶�� K/���4,@C��E7*���6��]�E�+��ϵ]��2�����(,������������@�^(�ӂ�{`�Oi�,u��Y�d��B��d�������_������:������.��.T6���=�???{�����D��O����+��1��PcV��?�< ��E+,��R��7�ʫ5��� \ݑvɹH���/bU���"���3����.�Q ���`��������x/@���)�~Kj�N��ڗy�zdH��Yg���"E��T�r%�LƄ5��ʉ7��� ��]GsQ���xp��}��)�o[9�ar��]�ò�M#�h�Ob�9p���U��a��� ui� ^�7��<TJqL=U@��u�m/t8a�m�#�*��0iK~1h*��,G��f�!P�B�p��0ʞ��ٌ�A��m�}������MuxŶ}���s�bM��%ꖉR�Ȉ����&�'Y���^ıD?�rw��5{�����7����\ٟlh���J�������ɿ5�w;��� ��O������4�[rҚ3_x�"�ﵜ������T��saF�Q��A�a��z�,������F����y�;/� (R������3A1��!���U�6�A8�)���ގ����xrw����I�҅F�s/'�����ʄ�������.]B�r��DL��Ue�kOZC= G[���B6���>���M�����#0�dѸ�}��l�;\Q;��-����ӡ��R��jl�����w'v�<P(/�(��*��Ž�Jbu�ѱ�%8'���+M<,����G-Kff� ^�=���v��Щ��c��<��k��$jr~��D�ir��ц' HVrz�Ps餝���C�A����F�JŞ���|�&~U� �b��-�8��H���`_i��_���4x�SPo���� ���M�^ =�YP\�-���8��7�F7��^Z���R�Nx��i�3p�Qn�K`��(C���E8��T���s�� Ab��[r��7R�!���oϲf67�2縶�㾋�:�GK��l�<i��_7�r�Y�w�<�co�킱 _NXgW�<��| ����eO��1�?���! �1S5[N�8��2�A����*�]�����Ƹi֘�� r�-Ĥ���I��z{1��%�'��Nw`X���D�� ���~��^{�{&��{T�j 0��o�$���5��m"�m&��+�A�ذ��(�b�|`[?���jo� He2�xPH��H@Q��J�l�����Y˔7!Dy�z������x�b�<�g�K%/�s�jI/����| ͺ����{�h@߸��A���h5�����8?IE�����&� ��k��ޟ�E�,�����r�C̮;#�&���eˊ���^��\�9��)�>������S��)vbId����:�X}I��Sc���Y���5��uc�����O?��0�{��p����)D��[0G��;o�Aa��B�V7����S��֛^,[��Z�,���=��B��%/��~5��:i����{�g5��O;�:�!�43y�6��z���O^P��7�̦֖�FCC��(>�i�Ԗf�����5�2�6�;$5�����|���*Kb,�p�gg=�O;H.)f��QI���i�4���.+���=Hw!�+��6����\�o/��h��n!p�~�eUD$��l���G�d'���� ���7e�o�G���-��\�"��'{1�͞�J瘑�D��o1�OZ���M�mM�����[.V?T�����!�� *�;rq��t�s)���F�u��a�e�I9��rW����Zۀ��4G�#��ml�~)�d�2�,0q�w�O�)b&�ǁ#��ۜ������t10jnk�"߯���\���@��"�'��ޥ�d�緽}�$��2�BU_���z�b�پOZ���� P�ݛ^Eն�'_��u��§t�++}��\��EB90"��8��,�C?���O���G!)���� ��?��z��B@7������L�@�f�O�v��[��«���fW+l����0Än�=��2u��I<k]�o�W��VY_k����p�D�|�$���.�g�^e�0�#V:�.�J����'�����|�ǂQ�m:H;d Lص�^�nD���)BY���pԜn"�S%�Q���s�w�Gj�X����o�I�%�;�W����ERE�u���f�:Ƶ�5|<ᛙՐ.�JPؗ�x�����s�g��i褖�[�&l�p b��E�����2q�e�8"S�Bd@�!������`�E���r�=.��J8 �:)��)�d� ��:b ^~���|۔-���C�y:�=���쳀g��v,��QH4���7�L�K�@�5�B�䤃��;�DB���3sV�U��[X:�F�R��r��-� �>p����}�����{��6+&�8p
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ