Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
00b168b6ef815feb40a700c09a2019cf.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
00b168b6ef815feb40a700c09a2019cf.exe
Resource
win10v2004-20231215-en
Target
00b168b6ef815feb40a700c09a2019cf
Size
12.3MB
MD5
00b168b6ef815feb40a700c09a2019cf
SHA1
e210ee259e0c5342e4f9515f25799c3fecb0180d
SHA256
068c354b7435fec4c6f6772516ca729f96178ebce5441590ff16340e53f32f35
SHA512
49d03cfb5bc533dcda0a71d5a8355acaec11d4013c54fdcd480f55b0adf7caf1f9a363ddb97cc0d78b40c5640ad5f9ec8ea8b6f7ff463a61bb43218a4e094133
SSDEEP
196608:mSaSz2IGIo0RUkBAOnLfvBcl1srEMVhOrswgaCPTql5yJFNTZtqZnoiUwK35g:Ild0rq4LfvBEKr5VoI3aeqUFNttqZodq
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
midiStreamOut
WSACleanup
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
SetWindowRgn
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
GetViewportExtEx
OpenPrinterA
RegQueryValueExA
ShellExecuteA
CLSIDFromString
LoadTypeLi
ord17
ChooseColorA
WTSSendMessageW
.�n?B�����e\��7���zP^<��r��F��Vv�J�Ӊl�v�?�Ն����/��ϰ=@�7� � UxBJ���㮇�C��{2 �!�4u�� )��l��x3r��P�I��|��Y��w����F:w�I�����SbdaX��HV�|�=n ��V=(�]����>�mS����$j�����x�����A�����vk`'�dy����Yܧ������w�Ί�[6��U�k���o�d����S*�۵��<<p-F2�5-�y��� �J�u�0�ޑ��W�ϸ_̏Ѡ�S��[�� �|9 ��wM������GBd�9}��.��u^f�ҭӘVB0,d�sP��9r7 ��+Ip;�VBϕJ�,� 2�椧���$+Y=�l��o���9.h�k��:�r��9�8X��}_q�#������_�j@�kl���H1�����"�,3�~+���y�� ��:R5��w�6d\^1L�f�$�J/��n��Ra�Bý��w��&�y?�ܽs���F�����q�B�z���ѵ�r1KL����6Q�r�0�������L�3���XJF�?��ٶ�x@z�;�:�E-&J���}��);��P&�-�C=�b|��V�!�Şt�(��n[�G1]Fu_ު/]�C���)n�� �9���|�A��k�G�6�N%�f������-$MJ�c��M�y��7�!����3�����������g{x�߸�e;F'��&%��i�7SWZ�X�y�A��Q���8�A?�xkI6���7b�H����FN2�5#���� �bZ�mޜ����ld���Nq��7��״�w�7DC�UZم�J��œ<�"[C*RWN- r�!�6l �ŏ�2��_s}p�%�#,O��.�Rv@�o�>U�3ɵ>kĭ���5�Ҳޏf�(^�^��,Ъ���W�LH�)�1���Ws��yJ���F.�1��~1�t��Kܗ&�vn��N��=��^�:�Yx^_�|#��L�1 N+1P�ˎ��>5�o3j�h�C�uk����",{��?��)��>�nO�7p<D6�$�D�<B &4fo��Ya�&[�ج�l��+ȿ0m��7��d5����gT�5\m��7[cFm����w���Y�*5H0OF}��XL�zo����5�ʩ��BMfˀ���w_1���a*��3�+ �,��1��<�+1�pX��H�,�����X>������̱S�?���9�cS:��ZE�n�3��/WKx�Y���,Hfi���RFX�Յ]��m�|��[#��q!��b�2-��6>n,N:�s���CC��=^9�P�mx�}w_K�Ȑٱ2�Ja�"�s3����ƻ�����75���!�~P��Ft�� ��ѽA��0ٌ�{�DH��O ��"�H��T���o�_2��p���0�#`����x~��Ld8.ᕛ3�A�Z�}�IL�Ϣn�+T�{ ~S0�� VJ���Ƥ� &R�hۚi��i�K[#a8����B��J ڤ���2aTD��`���9��Rܼ��c�{.$���[��@�)Ӎ�bqB�>wF�q-�Ӡ�n �d�c!�aY�����Ho�"&�E;�:�7�P�-���gĞ뉒)��;v� -����p�*�"����t��(z����҆��1�����Gu�³C�������w�� rl��J���>J�?�5����U=���x/��B�Ѕ[k,:�du��a�����3U<��8�,0L:2!�Q �N*�k�D<�χ@[�iC?'�(F���2*LX�>�on8ю���|�p쐉/��G���� g�/&$��O�Bu4�u��오-7���Jp�Pw=�I�̦R<3Hͨ �I��Qh�QRe��G���۔� `��吁 �`1G��a�P��spd�[{�xY��Œ"~7��âm��VN:��^�i1�a�kd��G�b?=��6�ӹR�YZZo�AM����7n<���E�O���:��f��Җ��07�C��7�(��.���J:qA�K�-� ���J$YRi�� ^���R��������=����=�bgwG��N�@N������-\͌�H�����7M�%}4�(����Q"�M���.'�b� T˂|�9���qG�n�����R���3I���#�F�����3�D��<JG��s(�B��a�1S��3f7�/Y��20�z�'�,X|n-����7fʧ!�y��=Kg���4��3��`�V�,W{Kn*�0g�y��oGFG�?�ҩB�ը�h}̔��z]5��/@��m��y� =ұ<Yt+���;=�Re�o�|$�N�wؼ;/����sgE���4�~(�����9N��g�`t�=ϼʙ���*;��-�oA0��@TDDO��+�����M� ��/���W$�ů��ڗ��y�l��i�y"���|'f��믵�/���b��J�Ek�m�"�i@�QB8��6���]I��gK@邀�}~�����<ͥ�eJ�4/a��E=�����챁.9���GTx �j:��9,A���?��.V!�Q�u��ˮ�~ҲVK��]-+�� �[����g��!��(�N�gLY!���c�>�vn�v�C��8��>�H�I@�R�R�>��}$0������#P�-#�ou����~�F�Qp�����������?~��'}��V8 r�*gu v}nqg:j�]�/B!�H�-ՊȈhq �d��Ob~�����b�iN�P���k]گ��0]��89�1� V� '��x�yBvR�2�������f�����9J� �d����?�t6{�'��e�go�im��?�G�{���k�u �6�1y�s L���h�b ��x�̙H��������+�^6דH�m{K������4H"x-xQb�j|5иj�P`.J��� ���N�iB�A���O�1��v����$J <���e��<����.�9.,%Q�������+Q�����,��,Eϓ)f�I�Y�Zu�m��BI���nu��UV�R�� �%l�T�A��D�]�� �5#���H
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ