Extended Key Usages
ExtKeyUsageCodeSigning
Behavioral task
behavioral1
Sample
a012c0617eb64fa6d6abec68e77d7d2c3c2e0a8e2aad8be194966460d9bffa17.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
a012c0617eb64fa6d6abec68e77d7d2c3c2e0a8e2aad8be194966460d9bffa17.exe
Resource
win10v2004-20230703-en
Target
a012c0617eb64fa6d6abec68e77d7d2c3c2e0a8e2aad8be194966460d9bffa17
Size
5.3MB
MD5
128bf6e813600a7e217c654cf3804a75
SHA1
0753f60ab40b5d31f56eaf070f37d703d388eb0e
SHA256
a012c0617eb64fa6d6abec68e77d7d2c3c2e0a8e2aad8be194966460d9bffa17
SHA512
8fc62c59401dd822ad16f830bb50ce092d1626add77ef5a5b04f26f9bfcd45e4cfdd29463498ddaad8b739ce1fa253f242a341d3bf2a5479a9329dc924d8e887
SSDEEP
98304:0ylXzcmyHpdq08ZtojDUhDelytKIgaaeGd7tJtg5r2G8AjUOOn:0uDwHiNmjDzlGKbaaRd7RKrjje
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource | yara_rule |
---|---|
static1/unpack001/out.upx | disable_win_def |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
unpack001/out.upx |
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
?DeleteFireFoxFavorites@@YGHPAD@Z
?ExecChkDskScan@@YAJHQAPA_W_N111P6AXPAUChkDskDataStruct@@@Z@Z
?GetFireFoxBookmarks@@YGHAAV?$vector@UFireFoxBookmarksData@@V?$allocator@UFireFoxBookmarksData@@@std@@@std@@@Z
FragmentCount
IsFragmented
TestRegValueExistsSamDesired
_CleanregCleanerData@8
_ControlWindowsService@8
_CopyKey@20
_DeleteAllCookiesAndKeepCookiesByHost1@8
_DeleteAllCookiesAndKeepCookiesByHost@8
_DeleteAllEdgeCookies@4
_DeleteAllIECookies@4
_DeleteCookiesByHost@8
_DeleteCookiesByHostAllUsers@8
_DeleteCookiesByHostForFIREFOX@8
_DeleteCookiesByHostForFIREFOXAllUsers@8
_DeleteCookiesByHostForKMeleon@8
_DeleteCookiesByHostForKMeleonAllUsers@8
_DeleteCookiesByHostForWaterfox@8
_DeleteCookiesByHostForWaterfoxAllUsers@8
_DeleteEdgeCookies@4
_DeleteFireFoxC@0
_DeleteRegValue@12
_DeleteRegValueWithSamDesired@16
_DeleteRegistryKey@8
_DeleteRegistryKeyWithSamDesired@12
_EnumFireFoxDiaCookiesDetailed@4
_EnumSafariDiaCookiesDetailed@4
_EnumerateIECookiesDetailed@8
_ExecuteDefrag@64
_ExportSingleValueOrKey@20
_ExportregCleanerData@16
_ForceWriteReg@24
_GetEdgeCookies@0
_GetIECookies@0
_GetStatus@4
_GetSubTitle@4
_GetTitleImageIndex@4
_KeyHasValues@8
_KeyIsEmpty@8
_ReadRegWithSamDesired@16
_ReconfigureMySampleService@12
_RegeditJump@12
_StartTheService@4
_StopDefrag@8
_StopRegCleanerScan@0
_StopService@16
_StopTheService@4
_TestRegKeyCanDelete@8
_TestRegKeyExists@12
_TestRegKeyExistsSamDesired@16
_TestRegValueCanDelete@12
_TestServiceIsInstalled@4
_WriteRegWithSamDesired@32
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ