Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Static task
static1
Behavioral task
behavioral1
Sample
028e87966ee77eb1da3eb0f90952f0337435105d772fd9e329209d845bb4f71a.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
028e87966ee77eb1da3eb0f90952f0337435105d772fd9e329209d845bb4f71a.exe
Resource
win10v2004-20230703-en
Target
028e87966ee77eb1da3eb0f90952f0337435105d772fd9e329209d845bb4f71a
Size
5.4MB
MD5
06559a54d28c356576bb956d01000688
SHA1
ff1a13d304d2be67e9c4d866c556abd4649b3304
SHA256
028e87966ee77eb1da3eb0f90952f0337435105d772fd9e329209d845bb4f71a
SHA512
f54e3a8e3736776ff9b2aba41b46dc1c43a7af1264a0117ceca4af2e3d8d98f10705e07a159c160224f77af67503de5ad8c091333dd308b1eec1e863fb89f0e1
SSDEEP
98304:Q3ZjDcBIgp9aVpZ6VvniIau+p3eZQNhsebc/C8IMJweU3:uPcBIgpO6Xkb+ueo
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
WSAPoll
WSASendTo
WSARecvFrom
WSARecv
socket
sendto
recvfrom
getsockopt
getsockname
getpeername
ntohs
ntohl
htons
htonl
freeaddrinfo
getaddrinfo
WSASocketW
WSASend
inet_addr
select
__WSAFDIsSet
inet_pton
accept
WSAGetLastError
WSASetLastError
WSACleanup
WSAStartup
gethostname
shutdown
setsockopt
send
recv
listen
ioctlsocket
connect
closesocket
bind
RegCreateKeyExA
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
ReportEventW
RegisterEventSourceW
OpenProcessToken
CopySid
GetLengthSid
GetTokenInformation
DeregisterEventSource
RegisterEventSourceA
ReportEventA
RegCloseKey
RegSetValueExA
CreateProcessAsUserA
RegOpenKeyExA
RegSetValueExW
RegSetKeyValueA
RegEnumValueA
RegDeleteKeyValueA
RegQueryInfoKeyA
DuplicateTokenEx
LookupAccountSidA
CreateServiceA
DeleteService
AdjustTokenPrivileges
LookupPrivilegeValueA
RegQueryValueExA
QueryServiceStatus
CloseServiceHandle
OpenSCManagerA
ControlService
StartServiceA
OpenServiceA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegNotifyChangeKeyValue
Sleep
SwitchToThread
CloseHandle
GetStdHandle
GetFileType
WriteFile
AllocConsole
GetConsoleMode
WriteConsoleA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
EnterCriticalSection
LeaveCriticalSection
CreateFileA
SetEvent
WaitForSingleObject
VerSetConditionMask
CreateEventA
ResetEvent
Process32First
LocalAlloc
CreateToolhelp32Snapshot
Process32Next
LocalFree
CreateEventExA
CreateProcessA
IsWow64Process
GetExitCodeProcess
GetProcAddress
CreateDirectoryA
GetDriveTypeA
OpenProcess
Process32NextW
Process32FirstW
ReadProcessMemory
GetLogicalDrives
DeviceIoControl
SetLastError
FindClose
GetFileAttributesA
CreateMutexA
ReleaseMutex
UnmapViewOfFile
OpenMutexA
CreateFileMappingA
OpenFileMappingA
MapViewOfFile
ReadFile
OpenEventA
FormatMessageA
QueryFullProcessImageNameA
K32EnumProcesses
UnlockFile
LockFileEx
GetCurrentDirectoryA
lstrcmpiA
WideCharToMultiByte
MultiByteToWideChar
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleW
IsDebuggerPresent
FlsFree
FlsSetValue
FlsAlloc
GetLastError
OutputDebugStringA
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcessId
GetCurrentThreadId
SetFilePointer
SetEndOfFile
RemoveDirectoryW
GetFileAttributesExW
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
CreateEventW
SetThreadPriority
GetExitCodeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateDirectoryW
CreateFileW
DeleteFileW
VerifyVersionInfoA
GetSystemDirectoryA
MoveFileExW
GetCurrentDirectoryW
GetLongPathNameW
GetTempPathW
InitializeCriticalSectionEx
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
SwitchToFiber
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetModuleHandleExW
SetThreadContext
GetThreadContext
SuspendThread
ResumeThread
WriteConsoleW
WTSGetActiveConsoleSessionId
GetVersionExA
GetFileAttributesW
GetTickCount64
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualProtect
VirtualAlloc
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
GetModuleFileNameW
InitializeCriticalSection
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
GetFileSize
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
GetSystemTime
CreateFileMappingW
FlushFileBuffers
AreFileApisANSI
HeapCreate
HeapFree
GetFullPathNameW
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnlockFileEx
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
DeleteFileA
HeapReAlloc
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTickCount
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
GetCurrentThread
WaitForSingleObjectEx
DuplicateHandle
RaiseException
DecodePointer
EncodePointer
FormatMessageW
WaitForMultipleObjects
CreateMutexW
GetTimeZoneInformation
GetComputerNameW
GetVersionExW
GetSystemInfo
GetEnvironmentVariableW
QueryPerformanceFrequency
FindNextFileW
FindFirstFileW
GetSystemDirectoryW
SHGetSpecialFolderPathA
__std_exception_destroy
__std_exception_copy
__std_terminate
_CxxThrowException
memcpy
memmove
wcsstr
__CxxFrameHandler3
_purecall
memchr
strrchr
__RTDynamicCast
memcmp
__AdjustPointer
__processing_throw
__current_exception
__uncaught_exception
__RTtypeid
strchr
strstr
__std_type_info_name
__std_type_info_compare
_except_handler4_common
memset
_local_unwind4
setvbuf
__stdio_common_vsprintf
_getdcwd
fwrite
_fseeki64
fsetpos
fread
fputc
fgetpos
fgetc
fflush
fclose
_get_stream_buffer_pointers
__stdio_common_vfprintf
_close
_get_osfhandle
__p__commode
_sopen_s
__stdio_common_vsscanf
feof
fgets
_set_fmode
fopen
ferror
__stdio_common_vswprintf
_fsopen
fseek
__acrt_iob_func
fputs
_fileno
ftell
_setmode
_wfopen
ungetc
__stdio_common_vsprintf_s
__stdio_common_vsnprintf_s
__p___argc
_exit
_beginthreadex
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
exit
signal
_cexit
abort
_wassert
_errno
_c_exit
strerror_s
_get_initial_narrow_environment
raise
_crt_atexit
_initterm
_register_onexit_function
_endthreadex
_initialize_onexit_table
__p___argv
_invalid_parameter_noinfo
terminate
_initialize_narrow_environment
_controlfp_s
_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
_initterm_e
free
_msize
_get_heap_handle
calloc
_callnewh
malloc
_set_new_mode
realloc
strcat_s
wcsnlen
wcscpy_s
strncpy
strcmp
_strdup
_strnicmp
__strncnt
islower
toupper
tolower
_wcsdup
isupper
strcspn
isspace
iscntrl
strncmp
strtok_s
strcpy_s
_stricmp
strncpy_s
strspn
strnlen
___lc_collate_cp_func
setlocale
_lock_locales
_configthreadlocale
localeconv
_unlock_locales
___mb_cur_max_func
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_except1
ldexp
_libm_sse2_pow_precise
frexp
_copysign
ceil
_isnan
_finite
floor
_CIfmod
__setusermatherr
_CIexp
_CIsqrt
strtoul
atoi
strtod
strtof
strtol
strtoll
_mkdir
_lock_file
_unlock_file
remove
rename
_stat64i32
_dupenv_s
getenv
clock
_time64
strftime
_Wcsftime
_mktime64
_Gettnames
_localtime64_s
_gmtime64_s
_Strftime
_Getdays
_Getmonths
_W_Getdays
_W_Getmonths
_W_Gettnames
qsort
srand
MiniDumpWriteDump
PathFileExistsA
PathFindExtensionA
InstallHinfSectionW
InstallHinfSectionA
WNetGetConnectionA
GetAdaptersInfo
GetProcessWindowStation
GetSystemMetrics
GetUserObjectInformationW
MessageBoxW
VariantClear
_mbsnbcat_s
WTSFreeMemory
WTSEnumerateSessionsA
WTSQuerySessionInformationA
WTSQueryUserToken
DestroyEnvironmentBlock
CreateEnvironmentBlock
BCryptGenRandom
?AddProcessIntoPCSCSpace@@YAHIHAAUERROR_INFO_PCSC@@@Z
?CleanPCSCSpace@@YAHHAAUERROR_INFO_PCSC@@@Z
?ClearPCSCDomainData@@YAHPA_WAAUERROR_INFO_PCSC@@@Z
?CreatePCSCLink@@YAHHPA_W00AAUERROR_INFO_PCSC@@@Z
?CreateProcessInPCSC@@YAHAAUPROCESS_INFO@@AAUERROR_INFO_PCSC@@W4LAUNCH_PRIVILEGE_PCSC@@@Z
?CreateProcessInPCSCSpaceSync@@YAHAAUPROCESS_INFO@@HAAHAAUERROR_INFO_PCSC@@W4LAUNCH_PRIVILEGE_PCSC@@@Z
?ExpandPCSCSpace@@YAHHAAUERROR_INFO_PCSC@@@Z
?GetPCSCDiskInformation@@YAHHAAUDISK_INFO_PCSC@@AAUERROR_INFO_PCSC@@@Z
?GetPCSCInformation@@YAHAAUPCSC_INFO@@AAUERROR_INFO_PCSC@@@Z
?GetPCSCSDKInformation@@YAHAAUSDK_INFO_PCSC@@AAUERROR_INFO_PCSC@@@Z
?GetPCSCSpaceInformation@@YAHPAUSPACE_INFO_PCSC@@HPAHAAUERROR_INFO_PCSC@@@Z
?GetPCSCUserName@@YAHAAUUSER_INFO_PCSC@@AAUERROR_INFO_PCSC@@@Z
?GetPCSCVCDInformation@@YAHAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAIAAUERROR_INFO_PCSC@@@Z
?GetProcessPCSCSpaceInformation@@YAHAAUSPACE_INFO_PCSC@@HAAUERROR_INFO_PCSC@@@Z
?HidePCSCWnd@@YAHAAUERROR_INFO_PCSC@@@Z
?HidePCSCWndSingle@@YAHHAAUERROR_INFO_PCSC@@@Z
?InitDLL@@YAHXZ
?InstallPCSC@@YAHPA_WHHAAUERROR_INFO_PCSC@@@Z
?IsPCSCInstalled@@YAHAAUERROR_INFO_PCSC@@@Z
?LoginPCSC4Cluster@@YAHW4LOGIN_TYPE_PCSC@@IIAAUERROR_INFO_PCSC@@@Z
?PCSCGetRedirectGateWayType@@YAHHHAAW4GATEWAY_TYPE_PCSC@@AAUERROR_INFO_PCSC@@@Z
?PCSCIsSpaceWndShow@@YAHHAAUERROR_INFO_PCSC@@@Z
?PCSCLogOut@@YAHAAUERROR_INFO_PCSC@@@Z
?PCSCLoginIn@@YAHAAUERROR_INFO_PCSC@@@Z
?PCSCSetNCRuleConfigPath@@YAHPA_WAAUEXE_INFO_PCSC@@HAAUERROR_INFO_PCSC@@@Z
?PCSCTrayContextMenuCmd@@YAHW4MENU_CMD_PCSC@@AAUERROR_INFO_PCSC@@@Z
?QueryPCSCRunningStatus@@YA?AW4PCSC_RUNNING_STATUS@@AAUERROR_INFO_PCSC@@@Z
?QueryPCSCSetupStatus@@YA?AW4SETUP_STATUS_PCSC@@AAUERROR_INFO_PCSC@@@Z
?QuerySpaceProcessByNetInfo@@YAHAAUNET_INFO@@AAUSPACE_PROCESS@@AAUERROR_INFO_PCSC@@@Z
?RegisterPCSCNotify@@YAHP6GXPAUNOTIFY_INFO_PCSC@@@ZAAUERROR_INFO_PCSC@@@Z
?SetPCSCVCDInformation@@YAHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAAUERROR_INFO_PCSC@@@Z
?ShowPCSCWnd@@YAHAAUERROR_INFO_PCSC@@@Z
?ShowPCSCWndSingle@@YAHHAAUERROR_INFO_PCSC@@@Z
?UnRegisterPCSCNotify@@YAHP6GXPAUNOTIFY_INFO_PCSC@@@ZAAUERROR_INFO_PCSC@@@Z
?UninstallPCSC@@YAHHHAAUERROR_INFO_PCSC@@@Z
?UpdatePCSCSpaceWnd@@YAHHW4DCDESKTOP_STATUS_PCSC@@AAUERROR_INFO_PCSC@@@Z
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ