Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
RS.exe
Resource
win7-20230712-en
Target
RS.exe
Size
23.6MB
MD5
4dc4c1c0b0d0a128eddf72eecb607499
SHA1
b192e5b66448671ef479ff37fd7e0164341d3628
SHA256
bd504e925d5371061757fc999b866767d3d5f163d07bd67422177b1db41c802c
SHA512
a8bbc4d55e12f073c8204960875f6b8111430e8ad622ee1ab2222f2f339927d1025f94b82026a4e1214df91d65d7e3774db896db0ac9318539b6e12f891ca440
SSDEEP
393216:nWr41o/JvTmPTW2MbVjh9YVRCLzTYxKJGxohI5OZkHARxuMEh7ObIhbFrUB4C:WMSy7W9jh9YyUGGcZreCbmFgB4C
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
GetAdaptersInfo
midiStreamOut
socket
RasHangUpA
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ChildWindowFromPointEx
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
GetViewportExtEx
OpenPrinterA
RegQueryValueExA
ShellExecuteA
OleRun
UnRegisterTypeLi
ord17
InternetCanonicalizeUrlA
GetFileTitleA
WTSSendMessageW
D����o.(B��f��҆�B�S�T��jR:�����?ߌɏ�e�/���`g�nKr���q��|� ,Go�U)�@?/gwh��#�\7��c�m�w�a��%���� ���Mv�ہ�?��}}��St��e ��x����ο��k�Ѫz�_��+�~%C���> مS�2s��xa�;{�O�c�7�U�*��N|�����造��S�Z�c��$���d�`<'5�p�����0�OV�,&�h�j��N"%��{���vԽ��]7Q�(�� �����U�ӛ�JA�'7��������]�~�>)��1�N�z0��^��ţ�Кٯ?��:%Z�=<lۦ=_-����#��U�s�R�a�U���Է���V�Rf]x`x�!�y�M���Lj�������@x O�E��5M����XO,���>}�XV�%r�w@q��d;c�)q�P\2ߧ������G�����f`U �/{��~w�*�Bزң�pN,Qn�*(~ ��w�Y����s31>w�@]�����A��P�)�a����|ly��2�'�� 8dDZ����3��pY�g�s���6~h:��M;�6��˂�l���<���߃���S`I��o�_���.�&>sᕾ�pbZ��UШR����Үry���j&�PDX�����d�Ѣ��Y�O���\P��p1���x8z;�����i2�F{HX�� D��I����Ē� |R�8/p� T����������Q��X`�Q\�ơޗ\���.7˗�C�=���[2�5t/7_����Z�y�T��B�D�جX�ؘ�Jr���* ��K|�]P����Ǩd����R�J��C�z�����{F�v�V�+:��h��'$n0< �;1�+�o��n`&��|C��[�u q��+�� ���,_'u������X����"���O�9��I�țyo���L�s���ث�<H)���oZ�'�`0&>>u˴?ma�����Y��!gxo:�<�?��qI�w�|�����E4�w�hx:��۸��Pr[�=� }��i�*f>S;�.n�&4�v� U��E��ெx !�i��5Y5fj�*."������Lo^��Dn E ���/գkg�V,��>K�w�毖�]�;�4�Uz���c2R�=��XD��SZ�`��7B�PΙA݅�n��E��L����5&��z_� w��sk����v��u¥��7�)��w��:a�W��=Э�h�����G|O���NeE�9���*E�����B��ָ�)) ���9�����H%Ј�x6l��Y@)!U��U����E�'��������cRK{�X�EV�HŠ���ƥ���%Ԣ��&O�wl�{. ��e/�2��y1z�뉲�e��aM������ñ��s��_Q"0ݍ\yu�7�6i�{���-� �� ���뛟̍O� 4���7��cd8 yㄅ8��hE&!yI\�r���Ane��і*\���&`��7�:0۳Q�(@�&D��}{NM`h F�K�g�19�*'䂪ju1�;pI&�=�C��qA� �s����{̰ndl��`��V(C]]ҩ��}_ƺgH,�6 ���������0U%�5����rV&��u3��'���'���!!�����C�e(J�~�r (�G��sC'�;�i���kwY@<��ٱ)���:�μ��I��A�J%�o���)���ď ���@x���2;{v�M�V;~�� 30���}��GpG@�ߛ������X��SB���ޓ=��&�}����\�r����50����7[�IC�h����|}��^D�c��B�lui��p)���Ka��n}�cE5d�����k����1qއ�Bq~�|��'��[.���9��v���2���_�qYt4��������80�_z8Ư�&3�����k�&ʑ�~#�4N�T��k�&�t��E^W�(����[���ڧ��<�+�y�����ϣ���y�D�Chv� fHYD�j��XT� ڔ��&-ȼCԏ5��<���8B+��g �w�yп�zS���2GPm`�إ�Zڛy�(���g�����3����>����B��3��D+!�%M��i�.�p�ί���ȁ|�i��j�xE��& k� ��G��Yﲅ��&6C�����o���JÑ��^>�1�߭�+�)i�HQv����=�ؐ�&c��6�һ��ͱY��ʶ���X������EXҵ�[8�� a�H���7v:k�+@��j� �z��6��f^=��"0�3����K����IJ�j�v�H5�gV�`b;FW��~����n|8ˢ�q�������������8�U��$�b���h@S ̈́���ց�o�<e"����"t�v�ʛݦڭV[ݬX����ĤQ�b;�;0���K��*����%D�I��mz���6�Jh|���D�k��b���^�9r���@=:�ˑ�=b����h�O2����ö�16����|���V25�G�b��~I?�]���E����t�/����ct$�t��i`�g��ѭi&ʓ�"�Xw����ʗ�>x��l�1 [����R��7�kݜ��s�/b �M��ޝ~j��գU1�3��:Ֆz��\Ch����RQ�}=�ex4=���2�NJc��̰迀����x�z�f6=�5���N�&u��ȝ6��1���A��>5�nu�,Јa;��0�A3��Ӟ0��洯�'k�P qys���I����fn�E����ru&n)!�Ө���/��Ae��\���Y�Oo&úv�H� <b�O�f���9!q��X+l����ZGs9������gU��.���j-Y^���L�m�edtW�y3uě�A����x5�KTM]F%cO)���c�c�����%���L���'��f��&28ı��di�MUq^����%x��q����K��*�뜵��t0���4Kz�άN�w� �Q.��)߰���C�Z��b(�����4/�ɢhE��h�����0>��%���YK�"����?���2i(�-H�k qY�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ