Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
290f2ef74a114395ec0b24cafd76b6de171b692f17f9149d0865bd8515503835.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
290f2ef74a114395ec0b24cafd76b6de171b692f17f9149d0865bd8515503835.exe
Resource
win10v2004-20231025-en
Target
290f2ef74a114395ec0b24cafd76b6de171b692f17f9149d0865bd8515503835
Size
12.3MB
MD5
765a4bfda46e5a783052966730e48934
SHA1
e4d67d24b9b53964da2983d24b4113a338325cec
SHA256
290f2ef74a114395ec0b24cafd76b6de171b692f17f9149d0865bd8515503835
SHA512
1689866641b148300b0c847beb6bfa064bb0039e72910094e66c190dfffb70728514332e7fb443eca32f4f86d271e8901b74b9471d293b704af35b1216795119
SSDEEP
393216:yT1c6SAJTJl2CBBbDAbxyVDeNVFNj+0sr24XWeX:z6xJ2jsVDetN60sr24Xh
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
midiStreamOut
WSACleanup
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
SetWindowRgn
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
GetViewportExtEx
OpenPrinterA
RegQueryValueExA
ShellExecuteA
CLSIDFromString
LoadTypeLi
ord17
ChooseColorA
WTSSendMessageW
v���ͼrZ����{�'g�5�/�ZF���kw����w�-��Ai��܃�!Kn�%�?T���_��gq3$�{�)Tvr���.E(u�w;ݫ�k�F�)4�_�?.��p0���L��1W�3,���ߋ}���P��PYi����Qi*q-*3ߜB�3 OJ>+��2����Oӕ�3�'? �z�~V������z�ռ���d���$3��R����H��:��(?"0vE�v�`���tx3��2~b� AL����y� d��N��8����=�-��&�ӌ���gRjg@i���������>����� ��dm�Q�ؗT�t��pL�`=�KQL~�V���kX�;��2UGz>�uE��^�H��+���r��?k����ę0�o�,<���,�K�Ʀ@�%ly��Sx��W�^擾�|���"䬵��/�@6ό��)��W� ��}�!$���W�J:z�K"R� �Q�k�� �No�yH����}9�w2P����!CG���y�4�Ao�It*���[Qyχ)f��FZ6�D����P?���ib�?Ic��8���?diXB����X��i����7&h��bK�U�uB�Z��@~\�v���wMr���f���6٠�?�d:�̞|C*��W@�h���Чx�їc%H^(<3��R� vG��I^,$=/Z��gPrI]���#��;S��8l����u�#0���#e����b�$D�.�vo��mc5� q�b�&M��B�G�|��m��Վ�tT��X���,���p�gX%2��@D���3���G�ԣ3�4�r���n�(��W���ٖy�<�ìgC�)tG]��#2��d}��I�-��}i|�P��(�����0@I��pEݰ�a��?�v],���Q��g�ڌ��RM��)�Am�g��P��`�������'�Ue����7d��<쀪C��� ��Y�b��b:"J�N��=-�l���i���0�7Ri�x3�?&ö�B������> �|K?*9)Ԭ^r��� ����J.0V�)S]���TUyfm��đ9��CC0r��b瀭5S�߃3�d���_��87�!2�����*���KR�t>UuQ� �Ly]���u�&��oD�����J��!�O�,��������#���p,d�-�Q4�g��S*�X ��~�������T4�y����E��$V�ͯ\�YD-E$sہ���gF�GI5��2��&V� �Y����[5x3aD�W�Χ,��ݏ@�+��K�E���o0���,���h��*P!53[�?��5@8�|g�;�dNJ�-���M\,�^# Y���ܛʍv[jb�Q;���#����2��̑%s/��n�E�E���.�,��%��d�-S4^�é��T)$8<+���m��N�t )����q�0�/N)�3eÃ��!������h� 1�je�XPYPi� J�ل-��lY��,�����Z}���&"��B��Y�b���f�|'r�Z"��k-��:�ʞ.n��W��8!p������{�)����b��Ck��^��x�5m�!@WHM�v���W���^јN�V��,��͈VQW.C��gU���4��^ǡY�����C4Wb��C���bL��� ��ǂ?�����h�H�3�I%b���'���2 ?ݻ�����x��EyF�s�3C�((�G�&p���f�:l!:�:�@��Oc�B�>A��2��(,3�\��V�3��.O��f��s����UUN~Q�p�za�MgG� ��vb� �!@i|7th�^L��3N�#E�"�pf;D[\��D���:��L�9mo�����_5�R�����$�Ӆw!"��n����76x��e���|r�|�T��K���K9d�O'��խ��{h�|���{�s��Ň���� ��� ��cQ`�WTX`0��Pl�g��*��D�8 �ܰ�k�f�^����E�عT�yWgE��,(��O3�`�5�$��xB�9w�N����B��f���k�9����� �W/��nː�<W�����J��A�)KD>r���c���z���R/��48=/�<5g(��J�L������_nM��ͅ�)譎m\�a$}��Bn9�� �¸�x��-�,��w�6������s�_d���/�F����+�5j�hjK��<�2��KT<[��s���.1=�b���'�ifOV-7iq��Y�b�\�}�K�e&�l���X1�X�:�?]�����@�5PE�P��{����H�[.=R���~:o�M���_d��.���v�;�p���R���]�,.�F�+LE�٫RM �������Ȍ��B�߲�l�c���ӇlRp�M�.^�`������ E�ϧ��!z"����G4��~\U���2�eI#h;ŝk��po���<��?�3h��"����-ژ����#0�:.Ra�?ZR0 U���?����N`!������\���̎jg)1��˶P(���X��9Z=�Npm6�~�\y�4Ҥ�FKy��l���O���q����,���lYb�E��A���#�6�p�d2u�(V=A�m�[��H�ɜ�Ǜ��o����F��<V��R|�jPn�>#hτ�5;����@�u�?��/���Q�B��bW�671�5��1X����� �+Uzr0i't�7�D��K���y�.�囙�J!�H��=��6L���������B��_Aی��M[�`L*E�X����%�����AK3���7X�r�% ����^S+��{�m��;Q �r��{�TAۉ�"QMf�2l,a��6�m�ȌF���N/Q'�<�8�u������Z�چ�WMj���7x���%Vh��uX�|�K�N�E�^
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ