Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
fa4fee2ec3891ace51173c577eddf111c9d1c703ade6b13872065c1ca516b852.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
fa4fee2ec3891ace51173c577eddf111c9d1c703ade6b13872065c1ca516b852.exe
Resource
win10v2004-20230915-en
Target
fa4fee2ec3891ace51173c577eddf111c9d1c703ade6b13872065c1ca516b852
Size
6.5MB
MD5
05229ac15c33b951f86341d8f374d5be
SHA1
1854710acb41eac022ae1fe7f274ea435bedb913
SHA256
fa4fee2ec3891ace51173c577eddf111c9d1c703ade6b13872065c1ca516b852
SHA512
355ce55cdc65b8f39324f60d71f159e36e919f90c3e3317f8e90d792738cebd899e08b4bc3842e188d4621ed6958b2ad48c1874d414f63fa43464dedf2f067e8
SSDEEP
98304:V+6gfUydB1aow5JQGEX5dBTM90okEzwvlsZOKgLZOLHCTIFZ:V+6vydDajpCq/M9Y0ZoZ
resource | yara_rule |
---|---|
sample | vmprotect |
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetServerFileInfo
Net_Request_POST
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
CharUpperW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
SetPixelV
AlphaBlend
ClosePrinter
SystemFunction036
SHBrowseForFolderW
_TrackMouseEvent
PathFindExtensionW
GetThemeColor
DoDragDrop
SafeArrayDestroy
OleUIBusyW
GdipCreateBitmapFromScan0
PlaySoundW
WSACleanup
ord28
AccessibleObjectFromWindow
HttpQueryInfoW
ImmReleaseContext
WTSSendMessageW
e�1�U/������z��T _QS��~#� ^�x�5��]c,�-����23�G�ݝ�����G�>�2�OA]�w;P ���l�5W@��8����&�װ jG'd�+�8ĸ���G�p�?�.��C�N矰>Ъ�����} ]ӫ <���t���C$D���X~A<��� �Ey�u$�Q�"3�����D��.�uԋM�Nb�$�^����Mm��@�.R��z5%�3���d~���ȱ���8��P�V�����Y�C'7��]��*2�|s�V��R�ݸ EԺny����5pj2�~�z~ �q�z���}��bi��2�nv�}����]q��v�I�F罃<�jy�R�b�̢�+���8������� �v�u��uTl����%����O9��/I����FU%���E���O@~|H�mÒhK.fD�l_������ ����]�; ����Jz�ﰶK�t�7�h�C�%���NԴ�;�U�c�;+���%ۜ6syk�B�;�.���6�bAu蒸��P�����+l];bwm��u��������,'����LY�ȟq��3�N����1��*������~�b�]k4�2�d���;@��#�ex_����L�zx�iʨn����)ȧg����������2�[��$�Ų�Uڽ0]k��w��b^��G��Y�� ��0 (�E�?ݭ��.�X�k1�#ܧ����O�*����8��GL��A$0ׄ���H�>pu��ob�A��4�W����-L��\��ב2�鬭�QU��������t"c킔�;/�5�ʹO����n��<�"��&��k�_p����{�Z��I������Zׇ;L���L��ԷnG-&A��;���όJ���@a�"�N�9+�<ʼS���%09W���9�ԗb$$�����v�U����M@����S�n��hh���D���)��� lؿ��_p�\qai}��\;��R �s6��%e���mx�~�6�ߨڜ'L�"�L�vw������&��j ���e,����CKˉ�dXr!?��7W�V��P�nO,1;�n��\�:]��� un�6k��q �韨���n����?;�m��߰t� �s#]���x���"�Nn~j�l;{��>�a����2=�7u,FId��]r���E!������~������&�5vZ�4r�k���2ڱ ���\�<�n+4RP���`�f♎О��Aq��T3��~Wc��tz�jWkY�&A��84̤�]�5�;v�s\AǕLB�{p��|$��ھC�q%�ɘ�5<u��E]�� �_)>WM��[ԣk�<[��^�F3�� <.p���_Oӧ�8ap >�y��_�����Sf��0>�������W��R���y�|>�}<����{E�v���Bn�Hi� ��W����������ߞ�/��l��`�Af�ە\V<�/�e�����M��D���݂!�5L��=����S{�l�,�x�K�8�R�������5����o)tS=¢A�JN���� �9�g�UQ��,Q����͂;�Gk�28���R��̅�'0�3��t�1��k�,��Gm��q��d�p�6n�\�]x(�D@E�a�s'$2�*�;�?v��l�ۥx���mJ��F����+��~h.����!��gO��G|8A�b����N9}R#b��E:���O�uF�=�nz���&Ds=B� 0�-��=ܨRO��e�)ܢdx�by%��W����Ar U���)�\���|�탃m���1 ��eǝ���ʲs����K�$�$�o������pFm:�g�Gr O���ħ%G�����r���#�� -����O���M��Qu���?�������Goa6H�6SW3, ��aQ����b>�}_ O�xr���j��!�feaW��EKN5h�b$A�\ ̎� �5`����6��.�jI�"e&�A�8�P��X�/����L�}�{�卮Zm�~rX���t��G�7~~����e��|ض ��}4Q37����"cs�I���LH�NQ�܇ �/6L e���H�-��D@ܹ1羝3�"^.�i��dOI�[k%e��'͋}9܇�1����<m��8�pT-�C�fS�8��9N�#iZyMyZ9`͟ޮ�3ܧ0�f�Ŵ�����O ���V!d;��G0h�$���f_�q��2O��+:[��gb�Nw��`H�����}�Z�`3������Z��X*��yl��='����� �dE��KN蕶I�ќ\pYkd��N�-OWԮ/��*}V���͞�ܨ��Z��,�Q[�u�y�� k�y����32��C�7��d��V�_%�qH��l�N^�٘�:w�$�N�$�SS�5��)|yc� �|U�.��e����$�Th7�L�Yސ�ëo��; �Ue �-����ȳgHT��!���� �H�Dn�XYgH��@Y����}\;H�f4�� �O���A���CG1p��-���웄��qʻ��~�����/��G��'�19�{]���2osZ7�v<�˴%,CW��2�F\CF+�h��!r Ś�<�ZK����rSx��~B���&xM۴V}y��+���!��t��ri�m��p���v衖��\Lx��_�2h�a��/x5s���l(�Ύ�P�� �����4�GQ �X���z�9)��-h~���h�H<����"sL�˥O ro}�6����_�L`dxz�Z~��d(�^QK�#��-����{E٧udf?�x��/�W��BM-�{(��y�¿g���c7��x� $8�:R ���:��P�0�����/�uˡF#��R+wv��όOo�?�C� �3Bh7�BaL ��)�>{J�%(���a�D'�����pu�<�憸E�����ک'1��6�h�6m��QM-~�R�OH0�a<Ț�x��{���TE�`��eU=7�,f��VQ7�|0�=h3��7��n=&\�'��Ar����bo,�s����ZLd&t'h|C�Ǭ\��}��Vz�<4#Js㲂�������s#Dr����9�5=��2��ﳅ��]t1s[����w�2֡n<7�iJ�7S5
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE