Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
Behavioral task
behavioral1
Sample
1891c859e083983421b0898db4253e9c.exe
Resource
win7-20231215-en
Target
1891c859e083983421b0898db4253e9c
Size
243KB
MD5
1891c859e083983421b0898db4253e9c
SHA1
6863e8adb0e49d6c562739343e53457c922322e7
SHA256
415c951e0a8e41281f7837e49808d468d151eb61ebaecc9df8c7b9e634416483
SHA512
d6c88293f3a92a2c38b7c621cab7c306859b50398968c4a514792c2a309f85f28269d7376fad2645f06562b989ee3a54e38a50775f670adc436071e563299a80
SSDEEP
6144:ZuarY9vQjifa+4WtQo16Jctnd82V7g2y9zQ0u7hA0w:ZChptL2cLR7g2IaK0w
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
FindResourceA
GetModuleHandleA
GetProcAddress
VirtualProtect
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
GetInputState
MessageBoxA
MessageBoxA
LookupPrivilegeValueA
ShellExecuteExA
CertAddCertificateContextToStore
�r�����Ŷ�L�3|����q��RK' ɯ媝���� &ck���Tp8���I-�(�k$C�ln��j��D3ѢM����[�T�j�Zv�X) 4��E *����4@13���Ap�V�n�nri���F6�L�@t?����,Ś���F�A�����j�����49�V���� ��= k]�k�GO�ʉ���@X�T=cDԇ���.�vjN)����]S��ǖ�k����YBC��h�_B$�m�!%�L[pXd��B���7bB��F(SI&��8�@ z�~] kD&o�:�1�������e�T��gOt}�����ر_��Z�0����K8'�~b"(羶�(O�o^zZ��Ĉ��v>{�xf�'ӯ�������{���e����^�:� �����9���]�F8Z_�j�J�y�{�w����Rc-��N�� [�������q�&����@qY���2�>��Q��ě��X|/�Ւ��1�yR�e�%VY��P92-fcE���*��S�e���9���pU���H̾�H�G� [�7j���T���( sow�^���(�6���;N�AؖD�Iy=����ט��\��H��V�Z�fm.ᶞ�¦N �^�d'rƾ���Yu���v�&� �(��(dr��;�ˤ�Q X]%|��#����F�ױ�`����F�()�z�t؎��#��^��'_��aª��^��h?��lm��D8����Q]B����؎��i��&x�BQ@)�_ �2}���(��e�CJ�>���=�l�!#i�<� �[}��]}/���2'1WLW�2�N�}1�_@�w�F�v����Ұ�� �T���pͼt��NH��nrp���HH �)�Ckg&�ǭ�uʯc�Y;m�N_����c��Mv8�X"@�Qˌ����3=�[��Țڷ4��q���*{ G�a��dµPa�=" ���`��ug�K��Q+CV�N��>��hvٰ�s��a� !�m�~c;Yvr�w�,�~�YmD�!cyEO=5����E�Z/*D�b��D��˲��tNK%j���1�*��n� q�X0�|�W�����q?���^�U V�Ŵ���4�ۏ��%����hq\��M��`���:��l������[��W��D�AF T $o�o���K?X���]�L��6�z����Q�6�������y&��⽱Dn�T'U*)�~S���n�|���U�0ͫ~ӽ����#Z[�!�_6d���yu?TW�h Wb�d1���SI#�ڋ7��S��$����Z�Y[5a sҷ��;|,���0��?���@s��9���� &�������z�>�u{o}����l ��JGZ%H�3�k��ؐWy�H���&h� ^b�p��uƄj{ ���N;�_��im���옙�P IeyE��|*4���R�C>��O4~Rj2�����7P+��gX�+�e�!.MQ�r�0θ�U��fn��4��˶�>�IK�p��~'m����<1{m�x���W�|? ̿��0����l����BQ0��[���<f����?���C��N�A~$��O���$����������O}u�]=R�e|�hǨ|��IFN�xf��Ͳ}����fA?�t�p�'`�Ks���;Svev�b�*ؓ#[�m]�[j��е�hz�f�-C�:/��1Ѭ�ư���ၜ6IfW��SK������-�~I���W�H��bңژK�5.�|�}��H��y���;����*rֶ���k�ON_�rM���l�g���z,�U;0�&�o��{o�O��Lh�'/^/ ����-�٘u�*�2.6�@m�bY���m�[]�ﲌ�d R��)LC�B�eL������Ss���&%V��>�E9{�-���Q��ť"^�>��\��)����pI���$�D�m�ov��7�!�C���D���-���Rd�����/IK��%����TXZG&|ϲ��m����g,$#���V��5���xW Jw��'M�aY"9BX���1�S�+U�+��̈́{<6)Z`&O-�J����c��H�h����Jkx��FZ���|5�7h�8T���H�>o|Q����y�T�dHp�����A13�P>��M���h��TMcCˤ�&S�5����,�;�NN��'M���� ��B���_zt�2��GCh�o�H{v�~b�V C_*�$1R>������q����p���FĀ��RΦ�� qɐ>�iT�2�=���.]I�\��֤�q]�Zf����Jj��.��Bj���a�����#��D����8#T�>�*�Z��55�����F��H�������ʒ��b4�_2��F�n�ȃ��r�-�U���T���VE�x�K/�h� ���s؏��6�����1�S8(M��`�(�ܧ]-���*��~�ӊ:��oF�H �ah���d�`��, ��=���n�ʖ������G�ɦd��P���C��h'��}���zx!+Y���=lw��"����L��A������8�0�[Hz�>r�̀��n]7�K���q�L��ߟ�3-�&��wd����� ��̂g��f����x˂�]�\A[4��Ag��p9�;5�$�6bV1ꬩ�x�h�}�i�#c��E���^w.�"������B̻~"��Mn��HAkMµ��� s7F�܂��ަ�!m�RO�췌�e�gf �ĩ7ݏ^��1��c{�&r<Ôp�Y do���h�o�6���pa��F/>wGD�e������V_��Ku�.0�d{�=<��:�4�c��8%} %�u!��/�C������"��T���a܅�b�vr���V��w�#2����ORU?,���:�7�Z�>s�6���{H<�`����U �{�2��ޗ��KNu�� ��#�ӊd�.p�}9����Z�_�N��t%�݆���A�FUcC�sI���U�[�C_������LI�4�.��$]��m���4f�d�J2<Q���+�v�85eLnrN��(Զ����Q�O=huj��6|ؤSf� ���a#
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ