Extended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan-Dropper.Win32.Small.20398.15794.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan-Dropper.Win32.Small.20398.15794.exe
Resource
win10v2004-20230220-en
Target
SecuriteInfo.com.Trojan-Dropper.Win32.Small.20398.15794.exe
Size
3.0MB
MD5
f027c23da36d00edf4d880050c7950b3
SHA1
51608e84f6220dc779bda6c9a6a6115279c32a5f
SHA256
8f656f5dc635a4269bda0853043fd939aa2ddefa40d9d56c55f9d7e5319a85f2
SHA512
ab318a1e463aa5cc54e51f56bc27ae9e1bd1eb7a0c9d0775c2b11567c2e93c127d2267c598606a64aa87faf203545d56f4b9b8c51d1041777cc0472964e885ef
SSDEEP
24576:+b3ERl7Tc2BkI2iIPGxg0C9QJECee3JoVy/WMyQDYwjx7NDUT9/rN+XAPQmXu:aURb2/cDeeWNMZUJ2m+
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
ObQueryNameString
ZwClose
ZwDuplicateObject
ZwOpenProcess
KeDetachProcess
ObfDereferenceObject
ObReferenceObjectByHandle
KeAttachProcess
PsLookupProcessByProcessId
MmIsAddressValid
ObOpenObjectByPointer
ZwQueryInformationProcess
NtBuildNumber
RtlUnicodeStringToAnsiString
IofCompleteRequest
SeReleaseSubjectContext
SePrivilegeCheck
ExGetPreviousMode
SeCaptureSubjectContext
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateSymbolicLink
IoCreateDevice
ExAllocatePoolWithTag
RtlUnwind
strncpy
ZwOpenProcessToken
RtlFreeAnsiString
KfLowerIrql
KfRaiseIrql
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ