Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
4be8c373c31919ef5a5d0688142b25c935a6ce1b88a8f47537af0028523d5ccf.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
4be8c373c31919ef5a5d0688142b25c935a6ce1b88a8f47537af0028523d5ccf.exe
Resource
win10v2004-20231020-en
Target
4be8c373c31919ef5a5d0688142b25c935a6ce1b88a8f47537af0028523d5ccf.exe.zip
Size
9.0MB
MD5
91d76ec3646cd99292c2110062dbbc64
SHA1
65ee1a9f3553a93e3733134385f0252b46301734
SHA256
00a474fb61d0d0e6f950b59d921c63551b1e28a178ae92863da103587d327902
SHA512
01472a0e540819a00c6a1db57f374d1c010303366a369cb18af3eb4b7b8ed64960a441857e68cabd91a2e52c6dec7045ff04fdb3f50dd0ad40befb46376afc70
SSDEEP
196608:NEwe3QZzg7TRQ2OnV4iS+G9UE5xB/vvqkciRFHMdOUQ:NEwe3QZUnGJV4i9C9PqkcYFHMdOUQ
resource | yara_rule |
---|---|
static1/unpack001/4be8c373c31919ef5a5d0688142b25c935a6ce1b88a8f47537af0028523d5ccf.exe | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
DrawFocusRect
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
GetTextExtentPoint32W
AlphaBlend
DocumentPropertiesW
RegDeleteValueW
DragQueryFileW
InitCommonControlsEx
PathFindExtensionW
GetWindowTheme
StgCreateDocfileOnILockBytes
SysAllocString
OleUIBusyW
GdipSetInterpolationMode
GetProcessImageFileNameW
htonl
AccessibleObjectFromWindow
ImmGetContext
PlaySoundW
WTSSendMessageW
n��3R����)���t�NhԀ����#���^g�hk��u}<ı'j�"�S9���:���T,5l}͝O�^�g�p ~��Z���D�{���dV�Zz���O� a*����[s��ƅ�`��,��C+Vd�яdž���OZ>��mx����]Lx�:��UU�!�yT�ifԜ��>�ѾM�z�F'�l1>�ik&����X<ngr�H����YR۾1n��R6�C2���[�[��B_��ŰS_w����o ���D����^�N���]��?���iH�hsn ���}JU��b�34l�N�}�佄�y"�4���_��0P�5(2w���ܤF��tۯ��"(�"��/��+�S�R�8�ߡ���\86f�x�����ń����-��'2J�4]���6�Q<H|�zy���D n��p�=c�G�����uNN5Z����]M��y���@�Ǻ-�g㑱�tHQ3��߳����,�,.Q�&���m�@}���5����kz�_��<u�+w�. f�0{G��P���_�v)�X�#��?UH:��v�| �Gj�2g�&�}�"�bn�um.'0��]��wP���ҿV��/�Su����M8"��FJ�kz�N�aSvq��`�y���ߺ����+�0f?����ű��/;>Nrv��: �wob�����Eo��d�������H��f�ߧX��[ |^kt.�Ơ"���\BF���K��=��*�۾A(��`o�J�|ۭ��*����G�^q���I�H�d�d {�x�n𬨈�0��^������V��L ��%▍�I�w����SK�����H4��q��IVE�ŭC��惟��N��!,��A1^�!g���P}��[�:jhB�cՏ��>��mҚ�_�h�4���).z��z����݊c9��)k~k�N��<�&,�2b�9�"?�ǹ���.�����ٓ7}�>M�HcQN3�jJ`ϯ��� 1˽U������(��������O�@��%�;�t��SV@����'��ZH�_>/o�@٘�H1Ag�|��X��=�������v��n*�����V$��.�=;���d�^3�(a�d��Zq�����İR|O a�0�ֿ��op����J��b)WsRy�]�Gí���Ӳ4������ک�pS"�0�抒�6?5��4�᙮*MG���;�'ã�7�ŕrz<ت{��G�j�}4��+~���6��Z� �1�T��p�l���S���(���C�M����!KT6����͇YJ�5�h�g��+RZʼGGݧ��h�#� S����jL����M�F��k����I��r�)~l�n�E<����P.�%Pa�[�v�0��Ѿ��$-�fb�8�߮�8��*\�����3hC7)�_;��O��0����c��lH�����E���}YqX�s���f��m>s�uԨ�yo�4�~�������bo"4�3���ا0Jh�C��U�lS����V��{��N6����i&�s���U���={Zѻ/"��|�x� �����B���T��E�����T�����[�sM��.P���|��@p-���|�.��7��s��� 5l�� M��+뎜�a7��X��'���~y՝ �W;��w�2ǚE�~��F��b0�O=Ӌf-r��\�8mڲ�U�,���_�MوF�o��&�m�1�S�����{��,��\��(�Ry����U��$��j�����gC�R��S�����)��ԛgO��Wv�_���*���>�.-�J�3�K���uy5m���0�)�(�����ٞ�����1�f�� ��������j������W���q �]H(���ڒ�<;�Q��Ӭ�%gMH��i���_����\1�e<|���Qb��b"�������\� �B;�JaA)5g"��B�b�/�ރt�i���[������X�0R��W��cLP����/�A�` �(S����B堗ĵ2ao� ;����MTչ{3��?�B�����Q�����x�k[��s>e^2p�[��^=�ZAO�sx3��^t�6�O�]G�����js��9�\]��!.�i����9l,+M蚗�v���,f���Q>��v�v�ݽ��%�G�D�fU�D���l�7��j����T{I�T��ɴ� ��g���!����)wx��Y�z����ņ8�h��vd��u���6K�$GF2 �N2�E0�s߮P(nj�Y��#p���p� qP�10�+䜄�)0V����2;;�ɘ�l�����6L�̐թ���dB��M93ل�ƕ�Y���qc�e�cſjΈ�h�s�����x'ѓ�J J��}3Qӭ�Oq�.��i�!��x��k��D��H��]�=�8qv���{l���[]'���� W�[�@��ݔ�ħ_,�WPĥ��Q]�k����d�J�ہ�(U�}g��Z!GSL(n#�2�����:�]��[L`�������-+[�:��P@����S״9clu��e���S�҄�D?����_6��εѪ��8�h8s<�;z6!霩�D �qMy�P��n��Q3a����3ja2���S�t !p$��t/$pۉP��b��A��%de�_}tn�lhQ�����0���Eg�#^�<�I˺i�'����9�m?��f52Lj��(�<�,SU��8�o���(��˓G��b�&��P-���n]l�S\�w�����,J�m��'���bH���H�����~'jҐ��dM$�s|����O�E��I"�>���_t%[En��_⢕�tŔry?t��K��B��`!R΄&j��H?>�wŬ����`М�銁._6�F�+'�X��� ��0��MO$�@���-�=�T���x�b� U\D��=��<z]T�ӊi���<K�r5v���_��r�GM�Lp�Uz�ع�1�-�J�{gY=��k:ԝ&Y�"ӔQe6������A���A���y���j۷U��ϯ�)��7�2L#"~��D��^����fa6�{������Q���WAUh$.�K �7y�r�(I9N�IJ���ν�Jr
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ