Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.85f9924fb26d924c4a10dc620ae2c350.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.85f9924fb26d924c4a10dc620ae2c350.exe
Resource
win10v2004-20231023-en
Target
NEAS.85f9924fb26d924c4a10dc620ae2c350.exe
Size
1.1MB
MD5
85f9924fb26d924c4a10dc620ae2c350
SHA1
d67569dec025abdd300e1d567a700cacf8614b7e
SHA256
52dc870426ef36851d5037eb244b156f66ce2d661e0378232e12f635ddfe3d1a
SHA512
ba7142e560fa4b664c509dcc02f6f31a9412f6ac0111c4e4ce14e171152080728254eb1312bf00911b1e6a5aaa25056d60924853bcc231b50dfadcf77ba873d8
SSDEEP
24576:mSboCF4e4F/t7ygxjRC5EPBY+3wheiy9lqLqB7nIGBzzcG/xJ:Re3xjzBDV9lqLunIGBzIGD
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
SetFileAttributesW
MoveFileW
DeleteFileW
GetTickCount
CopyFileW
FindClose
FindNextFileW
FindFirstFileW
GetCurrentThread
WideCharToMultiByte
GetFileAttributesExW
SetErrorMode
WaitForSingleObject
IsValidLocale
GetDateFormatW
GetTimeFormatW
SearchPathW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
GetModuleHandleA
ExitProcess
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
GetFileAttributesW
DefineDosDeviceW
GetCurrentDirectoryW
LoadLibraryW
GetProcAddress
QueryDosDeviceW
SetEvent
lstrcmpW
GetCurrentProcess
CloseHandle
VirtualFree
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameW
GetModuleHandleW
LoadLibraryExW
FindResourceW
LoadResource
InterlockedExchange
SizeofResource
MultiByteToWideChar
FreeLibrary
GetSystemTime
InterlockedDecrement
lstrcpynW
IsBadReadPtr
LocalFree
InterlockedIncrement
lstrcmpiW
GetLastError
DeleteCriticalSection
InitializeCriticalSection
RaiseException
IsBadWritePtr
lstrcpyW
lstrlenW
GetVersionExW
FlushInstructionCache
VirtualAlloc
MulDiv
CreateEventW
CreateThread
GetCurrentThreadId
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcatW
lstrlenA
GetThreadLocale
GetLocaleInfoA
GetACP
Sleep
GetFocus
CharNextW
UnregisterClassW
LoadStringW
CharUpperW
SetWindowLongW
GetWindowLongW
DispatchMessageW
TranslateMessage
GetMessageW
PostThreadMessageW
MessageBoxW
DefWindowProcW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
RegisterClassExW
LoadCursorW
GetClassInfoExW
RegisterWindowMessageW
KillTimer
GetSysColor
CharUpperBuffW
CharLowerBuffW
OpenClipboard
EmptyClipboard
ReleaseCapture
SetClipboardData
CloseClipboard
PeekMessageW
SetCursor
wsprintfW
CreateWindowExW
CreateAcceleratorTableW
SetTimer
GetParent
GetClassNameW
SetWindowPos
DestroyWindow
RedrawWindow
GetDlgItem
IsWindow
SendMessageW
DestroyAcceleratorTable
RegisterClipboardFormatW
IsChild
GetWindow
SetFocus
BeginPaint
EndPaint
CallWindowProcW
GetDesktopWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
GetClientRect
FillRect
SetCapture
SelectObject
DeleteDC
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
GetDeviceCaps
GetObjectW
GetStockObject
CreateSolidBrush
DeleteObject
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
SetServiceStatus
DeregisterEventSource
ReportEventW
RegisterEventSourceW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
DeleteService
ControlService
ChangeServiceConfig2W
CreateServiceW
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
OpenThreadToken
DuplicateTokenEx
RevertToSelf
ImpersonateLoggedOnUser
RegCreateKeyExW
SHGetSpecialFolderPathW
CoSetProxyBlanket
CoImpersonateClient
CoRevertToSelf
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
OleRun
CoCreateInstance
StringFromGUID2
CoCreateGuid
CoRevokeClassObject
CoRegisterClassObject
CoInitialize
CoSuspendClassObjects
CreateStreamOnHGlobal
CoDisconnectObject
CoMarshalInterface
OleInitialize
OleUninitialize
CoUninitialize
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoInitializeSecurity
PropVariantClear
VariantTimeToSystemTime
GetErrorInfo
SafeArrayGetUBound
SafeArrayCreate
SafeArrayGetElement
SafeArrayRedim
OleCreateFontIndirect
RegisterTypeLi
UnRegisterTypeLi
SysAllocStringLen
DispCallFunc
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
VariantCopy
LoadTypeLi
LoadRegTypeLi
SystemTimeToVariantTime
VarUI4FromStr
VariantClear
VariantChangeType
VariantInit
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysFreeString
SHStrDupW
PathFindExtensionW
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@PBDHH@Z
??_D?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXXZ
?close@?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXXZ
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHPBG@Z
??0?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAE@PBDHH@Z
?close@?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXXZ
??_D?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXXZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?eof@ios_base@std@@QBE_NXZ
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z
??$?6GU?$char_traits@G@std@@@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@PBG@Z
?width@ios_base@std@@QBEHXZ
?flags@ios_base@std@@QBEHXZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEABGI@Z
?width@ios_base@std@@QAEHH@Z
?to_int_type@?$char_traits@G@std@@SAGABG@Z
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?eof@?$char_traits@G@std@@SAGXZ
?eq_int_type@?$char_traits@G@std@@SA_NABG0@Z
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?to_char_type@?$char_traits@G@std@@SAGABG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?good@ios_base@std@@QBE_NXZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEXXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?_Nomemory@std@@YAXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?data@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IPBG@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBGI@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHIIABV12@@Z
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
?Compose@CMGIShellNameSplitter@@QAEPBGK@Z
??0CMGIShellNameSplitter@@QAE@PBGK@Z
?MGIRegisterCrashHandler@@YAXPAG@Z
?GetProtocol@CMGIShellNameSplitter@@QAEPBGXZ
?GetExtension@CMGIShellNameSplitter@@QAEPBGXZ
??1CMGILock@@QAE@XZ
??0CMGILock@@QAE@PAVCMGISyncObject@@K@Z
??1CMGICriticalSection@@UAE@XZ
??_7CMGICriticalSection@@6B@
??_7CMGISyncObject@@6B@
?Split@CMGIShellNameSplitter@@QAEHPBGK@Z
?GetPath@CMGIShellNameSplitter@@QAEPBGXZ
?SetProtocol@CMGIShellNameSplitter@@QAEXPBG@Z
?GetFileName@CMGIShellNameSplitter@@QAEPBGXZ
??1CMGIShellNameSplitter@@UAE@XZ
_wgetcwd
_wchdir
_ltoa
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
malloc
free
_CxxThrowException
memset
_except_handler3
??3@YAXPAX@Z
memcpy
??_V@YAXPAX@Z
??1exception@@UAE@XZ
??0exception@@QAE@XZ
__CxxFrameHandler
_purecall
realloc
??0exception@@QAE@ABV0@@Z
memcmp
_ltow
wcsstr
swprintf
wcsncpy
_wcslwr
memmove
_resetstkoflw
_putws
vswprintf
wcsncmp
_vsnwprintf
setlocale
wcslen
wcstok
_amsg_exit
_wcmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__security_error_handler
_callnewh
wcscmp
strcpy
strchr
strlen
atof
_wcsnicmp
_wcsicmp
_strnicmp
wcschr
wcscpy
_wtol
ord129
ord141
InternetCanonicalizeUrlW
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ