Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
2065157b834e1116abdd5d67167c77c6348361e04a8085aa382909500f1bbe69.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
2065157b834e1116abdd5d67167c77c6348361e04a8085aa382909500f1bbe69.exe
Resource
win10v2004-20231127-en
Target
2065157b834e1116abdd5d67167c77c6348361e04a8085aa382909500f1bbe69.fil
Size
1.1MB
MD5
9a16a348d3f4e7da3e8746667624115f
SHA1
bebdec590d2a2fffaecb970b73e3067294c9125b
SHA256
2065157b834e1116abdd5d67167c77c6348361e04a8085aa382909500f1bbe69
SHA512
df6a3116a0167dc0736147e76e2fd55e2fb1539f70752ed0013d4d06d619559baa1beb7908d0e8e7725e81a2f3dcf8ecbef982a3f2887b2728386381e184f737
SSDEEP
3072:a1h7JpmJdthgBLehOzOHsK8qPnGvGp1jEwqusivmo3QrwuL9C:a1fpmJl0NGtFPGOjETXcQ8g
Processes:
resource | yara_rule |
---|---|
sample | BazarLoaderVar2 |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
GetModuleHandleA
CloseHandle
WideCharToMultiByte
GetTickCount
lstrlenA
lstrcmpA
GetLastError
HeapReAlloc
GetModuleFileNameW
lstrcpyW
lstrcmpW
GetCurrentProcess
FlushInstructionCache
ReadProcessMemory
TerminateProcess
WaitForSingleObject
ResumeThread
GetThreadContext
CreateProcessA
SetThreadContext
GetStartupInfoW
CreateProcessW
MultiByteToWideChar
GetModuleFileNameA
GetCommandLineW
OpenProcess
Sleep
GlobalAddAtomA
FindAtomA
ExitProcess
SetEnvironmentVariableA
GetCurrentProcessId
WriteConsoleW
CreateFileW
FindClose
WriteFile
FindNextFileW
GetFileSizeEx
FindFirstFileW
GetDateFormatA
GetSystemTime
GetProcessHeap
GetProcAddress
HeapAlloc
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapSize
SetFilePointerEx
LCMapStringW
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetFileType
GetModuleHandleExW
GetStdHandle
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
LocalFree
GetModuleHandleW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
HeapFree
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
CommandLineToArgvW
SHGetFolderPathW
CoCreateInstance
wnsprintfA
wnsprintfW
PathCombineW
PathAppendW
StrRChrA
UrlUnescapeA
StrToIntW
InternetCloseHandle
InternetOpenA
HttpAddRequestHeadersA
InternetSetOptionA
InternetCrackUrlA
HttpSendRequestA
InternetConnectA
HttpQueryInfoA
HttpOpenRequestA
ObtainUserAgentString
select
__WSAFDIsSet
sendto
htons
recvfrom
ntohs
socket
inet_pton
shutdown
closesocket
CryptStringToBinaryA
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ