Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
zz.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
zz.exe
Resource
win10v2004-20230220-en
Target
zz.exe
Size
4.8MB
MD5
7c2afabc220b4b028711a9e6f3cd0338
SHA1
3416cfc38829d830b57f8471095513c2dcaed01f
SHA256
bb043f534da86109590562ce3be0c70f8745e394bedb1cb484d8d982ed32223d
SHA512
39a61fb8a545e2018d53ac0f50603bcb0f46608f911ad6c12a05a18205b2f3eb856952a4548c06f6238931906738737b8e132a89b7af737cf5ef171b99e62c7c
SSDEEP
98304:dnbmvxrW+4DNQKjQDW9mnxWU7BtrOzWBOqd1m2J5TD+/o9EHmsipOXItm:dnbmvxy+UBmnoU7WqBOqdjuGLpIP
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
QueueUserAPC
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
WTSSendMessageW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
\��V0q���ܭ�gԫ��[%J�4���=��G�7CE�c��D8y��?�Bϒ9�H�+�����I�����CJwX4:i9������?c��A����Ӎ5)���+#������m0-RF��~�E���b�[�\\��n$�$-#q���U��u]���J ��xې��X���#4�ܨ�x�G��専����a��+`o����&�o �zC��" =����m���v��x���(@�R|�@�$7N+J��[-�^�3px6�����X+�6>`4��e�[|�Sp�IT�#B &�=�Mzvۈ���a:5xtC �(5�B�F5#�{}�E�'���Yb�n�6\��|��'�X�4%:���ǐ��0g(P���#|���'���us�`M���KY��|*38)�g�EN��8Ƙ趤Q��@�t�eN��ߗ���s��. �{4b��Xz�F��A�If�w �J�TiP��wr�}�.�Ub��%�� ��q���s2�gՐ;��U�UkW%�K{j� �?��a+�i�A x��C�R�����>�<��)�X���`"��?��B�@�h�oC,���هc��.�G��`���j�l!���{ʛ[����`r���Y�P��r�F� ~R cH!k�?��QM�(�N!��ڥL�s1`�x�[��� 4~Yɼ|��g�� U��Э��'$�5�kX�V���s�эQ�Ӎ���[b%�v���OҲ(>�m�X���ԵL��B�[о#lel�k�v�~�*F�*s�ʤ�`���� �����uv�&}1��?��b���#}vi���k{E���L[�v&�J��1(����Y~���bh��,1�eCJ���5x��Ig��Xrsm�p_mx6�W���i��c-�Jm���V##�=��|<R" �0��%ܵ�X�"��)m� ��T��l�g�e�E����zQ�+&0}�ߏ���� ���?���U����r<p���~�0?D�����EG�2?N�����~4�T#�l%&U=M�y��~�u��Ni""��w*�.���Kv]���#V���r���_���M@��x%�ѩ'�`�A3�(50�`5g�%q��#8^��oj_��&�_ܯ�gL&B��8E����JU��$C�c`�)���c���ސ��F؍G��9� XB�g�Q=���t�[�e�dz ,:B�I���L�::4��,��eJ���8}��B6�t��(��3�B�o5=s�-���$�H;�2�~�@���&>Y �?}�bvO���ω(D�ze�W�]�����u5�sE����ᐎ2�z�/@D��ق�)�������$Ŝ˲+�=�װ��ͪ��-D꺢LL:?�A�Y��h���t�tj�Dy��l��Z���i�,z2�����X�G���5������s-5dQn;A�{w6�Е��vT�_kƎ���#��銂��SMz�k�͟�������J|f��o�5����m �S����V�9����R�O�|�����B��5��$v+Ka�;�ed��GJ�WT� "b�~9j^8��l���;��BFZ%�S'Jm8��|x��s��U���$��tǬ�-N泔&h�D|����I-�;�,��npf263��W7Ч~�F;hu�����{����(nPA��T�y���̬E��oJ�ǽ�p9�|>9�8x�m��c�)< c8f��^��*I��Z�lo���v,|���QHoضn1Tg6�A�K�R�����j��'P)~�P�e�>�p���~�/3�gIJ��.d���5tV�R�q�&�if#��@����K�Yc9��De����Y�ڲ--y"L1�^�b,5ٗkΛ�b 8�5��1܄�u%�zz>��Y��E`�d����q��mM%�x�����ڰ�~|�u�~���sw|��P�|�Xq <��q缵��U�g5�G$KW6���l-� �bj<�Y9�Dtn���" x-��q�w����M���UԲ?�����T<+}���r�y9�Z~d�a����:�^|pc����:��G6���1�c`��]J a�v���X�H�[��m�Xl �bD�&a4�]x� ���Z���ٖ]����Z� �R6#^.�"��99l"���Ov�S����R+]\�ט��zs�vq��DR��|�ծ�Zt�*꿏�p����j�F�D%� T����������u�h*.���osDmB�������B#4���`r�e������[;[sM�P������e&��ڋ���x?h��:`�Ӿ^fSr<p�p��F�Y�� �n��@,+x9����8)���c[[����a��>�ͤ2�0N7��Fz9�Jδ&#�94LD;�9O���о�jy]�J���'���T0G<KG��=�����_͘�L�� dhuR�b�WzZ,��6A�����?(Mf�9�8������� �G5m�ރ{3������)=M�&�馨S T9�ڲ�� ���T�@-���_� ��q�_`�B��$�]�.A���9"�XR(��9�cPJ�;�0K6W�;��L�C}�c����Ϲ�w�b�8�(��&��f��)����7\�g( �>0[��'݇@����eY��x:��u5gZ����)���I�y�*���mLnM���U%�(��.q�~G""?�_���AVUp�x,N������Dh��`F�ߩ*G#�= �!;1%�+V��d�/�'��� �P�,��+�]�����TJf?lA^� �Bx�荩Pc�rzٜ�}���³�A���Z���A�����J�:#ܔ;���[��} M�`҈\h�)R�G$<������Q�Sba���T8<T�%E�5�B���T��^�x��j_�?V�B���_Sz���q9�)"�b���R��- �}��D��y�X�-pVdU)^�}R"�Σ����i+��Q1�q'ykѼ�! k���ɏ���*��:�g��^,t�z�H�D�?eR�<x����RO"NH��t4��Y��P;��qb@�j����0}f �a)��z+l�� V��W���h�%�P@��l�$`
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ