Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
1a01f7fa75da59d8285b375654359fa2c323b9853e126da417d0bc730cc2a69d.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
1a01f7fa75da59d8285b375654359fa2c323b9853e126da417d0bc730cc2a69d.exe
Resource
win10v2004-20230915-en
Target
1a01f7fa75da59d8285b375654359fa2c323b9853e126da417d0bc730cc2a69d
Size
551KB
MD5
737b5c2c4a8fead5fb358153776259d2
SHA1
a84b6f16daa765c166e1850a6845397cdf5c7728
SHA256
1a01f7fa75da59d8285b375654359fa2c323b9853e126da417d0bc730cc2a69d
SHA512
d4b4775c16c753c68d77bd9429130800e8cc6985bea380eb94ae9c951b958a009cf992ac7bad172185619ce9fb20647d1127d11a47f40b92b93c4a53dc9c9cea
SSDEEP
12288:sSTqWc9u2gPFH3yQpntwuQc/4Au5q4ihK8S8hfGM:s2YuRPFBwzy7us4j2fGM
resource | yara_rule |
---|---|
sample | upx |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
KeReleaseSpinLockFromDpcLevel
ExFreePoolWithTag
IoFreeMdl
IofCompleteRequest
IofCallDriver
MmBuildMdlForNonPagedPool
IoAllocateMdl
ExAllocatePoolWithTag
IoBuildDeviceIoControlRequest
ExQueueWorkItem
ObfDereferenceObject
ObReferenceObjectByHandle
MmIsAddressValid
RtlCompareUnicodeString
RtlInitUnicodeString
NtBuildNumber
MmGetSystemRoutineAddress
ZwSetSecurityObject
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
SeExports
ZwClose
wcsrchr
ZwSetValueKey
ZwDeleteValueKey
ZwCreateKey
ExAllocatePool
ZwQueryValueKey
ZwOpenKey
wcsncpy
_wcsnicmp
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
ZwWriteFile
ObQueryNameString
IoFileObjectType
ZwOpenFile
PsGetCurrentProcessId
ZwDuplicateObject
ZwOpenProcess
ObReferenceObjectByPointer
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
PsTerminateSystemThread
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
IoGetRelatedDeviceObject
ZwDeleteKey
ZwEnumerateKey
ZwQueryKey
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
strrchr
RtlInitAnsiString
PsGetCurrentThreadPreviousMode
__C_specific_handler
ProbeForWrite
KeUnstackDetachProcess
ProbeForRead
KeStackAttachProcess
PsProcessType
RtlCopyUnicodeString
IoFreeIrp
KeSetEvent
KeWaitForSingleObject
SeCreateAccessState
IoGetFileObjectGenericMapping
KeInitializeEvent
IoAllocateIrp
KeAcquireSpinLockAtDpcLevel
IoCreateFile
KeCancelTimer
KeWaitForMultipleObjects
KeSetTimerEx
KeInitializeTimerEx
KeSetPriorityThread
IoDeleteSymbolicLink
PsSetLoadImageNotifyRoutine
IoUnregisterShutdownNotification
IoRegisterShutdownNotification
IoCreateSymbolicLink
IoCreateDevice
IoDeleteDevice
IoFreeWorkItem
PsCreateSystemThread
IoStopTimer
CmUnRegisterCallback
IoQueueWorkItem
IoAllocateWorkItem
IoRegisterBootDriverReinitialization
IoCreateDriver
ExpInterlockedPushEntrySList
ExQueryDepthSList
ZwLoadDriver
strstr
_snprintf
ExInterlockedRemoveHeadList
rand
MmUnmapLockedPages
MmMapLockedPages
_strnicmp
ZwQuerySystemInformation
strncpy
RtlUnicodeStringToInteger
ExpInterlockedPopEntrySList
ZwQueryInformationProcess
ObOpenObjectByPointer
KeDelayExecutionThread
ExInterlockedInsertHeadList
ZwQueryDirectoryFile
ExInterlockedInsertTailList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
PsGetCurrentThreadId
IoStartTimer
IoInitializeTimer
CmRegisterCallback
PsLookupProcessByProcessId
PsSetCreateProcessNotifyRoutine
ObReferenceObjectByName
IoDriverObjectType
ZwQueryDirectoryObject
ZwOpenDirectoryObject
MmUnlockPages
MmProbeAndLockPages
IoCancelIrp
IoAttachDevice
IoDetachDevice
IoSetCompletionRoutineEx
KeQueryTimeIncrement
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
RtlEqualUnicodeString
strchr
strncmp
MmSectionObjectType
srand
ZwQueryVirtualMemory
KeAcquireSpinLockRaiseToDpc
MmMapLockedPagesSpecifyCache
_strlwr
IoGetCurrentProcess
PsGetProcessImageFileName
ObCreateObject
KeReleaseSpinLock
TdiMapUserRequest
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ