Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Static task
static1
Behavioral task
behavioral1
Sample
41cafa75fab62be3074e8a13ee2e2fc4.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
41cafa75fab62be3074e8a13ee2e2fc4.exe
Resource
win10v2004-20231201-en
Target
41cafa75fab62be3074e8a13ee2e2fc4
Size
4.8MB
MD5
41cafa75fab62be3074e8a13ee2e2fc4
SHA1
5c24ff1b375206d0a58eaf8e93134658d8af9786
SHA256
1b6c6d91898fa1fb38d2ef21c96e7f2b4ef6ca670dc936a336a00c8fe904b99e
SHA512
9e69a7834b60e56794bb87f8af16c09c89418bc2b8645091403318e5cca1b1ea54af2579b82fa3e12cd67282f6d481289ea8578657761d47f09043c6c1ea0e5f
SSDEEP
98304:kI0yzTQvV9KU3akW1WH7s6CoTB+9ptscyv0FtjWLaf9lB3y:kIdkakgWI6CwQFtykzJy
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
LoadLibraryW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
SHGetFolderPathW
WTSSendMessageW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
ב��h��t�k;����Zs�}�"hK��c��t�$z5mp�Ja���l�_��O�!J���H%�>�~�gƥ�PCK )�q7bD4�D���o�~��s�^o?YωH$nC|���7�CcF��f�@�b���ULľ�e�:^�F��MZ��*�2���|�:���ߡ�� �?� ��C6pDZ��^m/ڊ4?��:@-�\��'�:����Z��:���S+�ݲ̑)$�cߙK�U]��U��c���������9�|&�쏩���V�Z�@��!��=��cQ�/n�$����S�;ٝ�+����E���K�N'����c�jIw�:���������̪7�}+����}�{Ln�Φ$m���� ��u��j���0�����Q�qv ����&�#0Ԩ��8�O��j�ܞ ����Cͨ]���..��� �E !��Xl����\���o�s�$y�����[�l��7�����ja3x ���%<y�A6E�;�b�9Gp�Ή���W�O7��z�����P�U��`En ���b���#حZ`R�9S�����M�S���"�q���-x�qo��}r>:�������eCR��4�����<�(J��F,��C�lJh���s0g��B�K�������JxgB>��ҵ& z��B���zPJ�,�rA��O���A)֣s�3-��V�N����V��97VgB�d����O�wG�"CC2J⮌qO����-L\��3�?J��.����m��@|��RL�ڪ���]z���Oڤ��> ��<�%VRs@E>�!��q"��)�͂���z()���"?N[�!}�=6d��}I�l$5fțڬ��+���?o@ȵ�RHnT���J��֏��1�C��zQ5%5���B�4���C�������tC�ӷ(��`�=(��t�j���6qu�S�m���1���lA}����fѿa�9(�ك�>B���^�E�7�CF��FF���w������Ue|>�k���9�J �C������@-��W����b�<�ޠd���i�_��Q��,�I��Ū��(Ė�{WA�cB��a2��G�T�Q�t�@~���\�����|mu�SLJ��?V��P�I�aR�ћJ�-X��ͽW���zt�8���_��d��u�m����8�j�J3(�K�=I�`���s��C�N��7qxVy���5J��$������~�\���$&��_�TC���������KC��r���8�T��R�h��3ɓ�z_@�hl4���a�˂��Z�Y�0>M!ۛ��l`�l���������8�/���3 �hS;��D�`��>v��xa8;("����� |5�a���F���0\�^�Z�[o����9H%��p愥��1*X�%w� �ΰ��҈��ՊYAk�S��! 3Uq�/[�z�N9�ⷞ]���eO| c�_�g��@��\��i]�|R�-\t��⣈�2�w���A�H9�q��?�\�v�|0z?���|�lp���mcR汪�p�_c�5T��A\�U{��S�|�>��m�� �A2�J�B)�́H�4D�Ī�&��A��!�d��WT0�n��FZ���hE���A����R*��l �:��y��@�����@#A�;��R�9�'����k��EFU�!p彫w73]O�]�`��ZF:C T�E��|�鋣i�)2o*hLʄ먶���{�R|�v�D����_S�{�`�ƧLö�ęjI�c.����閂<L{ɠ�.�ߟn�b��7��S�Y�C�e�n�z�{���|o��IC7h[�vn���/�B�C��l����,����aҲ����Y�Z�Oo9���s9`����@������c!P�h��������ݶzUV�f|A���ĬW�m����4�tT�.���'�H8�?���s̫�%�ĭs7��Zz��K�\,ĭ7���Z����r�|9��ig٬�������k��[J��ߍ(g7<=g��� �0H��h}vH��vYW}!�k�lLՀ'؋ҕ�me!Ǽ��|I�r/j�:[��;L`��V��nH�,��>��?��Γ��u�}Ǘ���}�cY�FT�ȋ?7T��Ks�21K���3�/��Z.�d�W^D�T�LnEQYh�$ `}���M�yT��{h�23TH%��\g%ar&� ��<�_�S[��>_~�6d�rW�����#p�w����؍�66z�r R���LL!���A��'�x�k����xuL�]���=R�����VJah#��O�(.T�$�!4� �&Z��#�БB���T5�����:����i�J����I������%o�)�S���G�p�B"�m� VL�d-V��.~��JJ����H%:l"j��n��F+B6�o��%q�����{��������� ��ʤ�63�*%qE�]<�m�� =/!R$�PH�2J�ܝ-ʇbc�VO�w�{�]��l����|�,�se���h����Nr֥Ĉ���^>Rc�3���q����8W��K���^8��x�k�:�;e���,�2�S�B֝ �Fs X!%��)�R�Qr9V �Iv�p!ϡ���(���� B�x�"�m��-�Neչ�P?�c�;5���DR�}�)^ ���piC1�cw��v��;����؟�u��;��7����St���ϳX5HP�;�6��� ��iY�7yg;��x1.���К�b=K��X� ���1� ���H܉��!�Ee7kP��w���1�q�����_ɘ@�ԋ d>�7�%�����C���%g�n���\i�z;u�<ˀ�{�TgNL7��><����?�����9 ���.��9�%�K��lMo�D�� ӊ����8���OV�Z�j��[�`�:@Ƙ&r�������x�y1� aB��o�;B?X>�5غ�v��3�m�%��l�EJ�L�Z���<�{]��?79�cG�� �^�_�P���<Hh�D�ƵM��\p�M��L�w���o{���I�$J���<��x&:�+���W����<�� �GRRK@��t���"�ό�J�0�f��g�z8QB��� ���f���f�]��P��hxˤRD=t��p��$�����"{.gtpc��<��z
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ