Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
2037cc8ddb99903834342b8f3b7068dc.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2037cc8ddb99903834342b8f3b7068dc.exe
Resource
win10v2004-20231215-en
Target
2037cc8ddb99903834342b8f3b7068dc
Size
12.3MB
MD5
2037cc8ddb99903834342b8f3b7068dc
SHA1
04f12791aeacf5a44165a0ebbcfbdbe9a0f05199
SHA256
3e197dfe2769af51cbd183309f495ceb9d4983a6c0db05a3deb8a9968ab712c4
SHA512
a48544c45db7f8fef212edaee7b2321acb481d2f0cd48fd1d2d57b0ac8819b1c80ac5e168116bf970e4b3d1f664864b3ce1a8f6c77b98a08f33caa4e2246f838
SSDEEP
196608:ZyE62AzusIKpjNbODX4NDmHPCD34qrbZXWazy5tw+guvkUQI6Q5zen3pLZ5B:O2+vbbmH6DfrtD2tTguMUh7W1t
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
midiStreamOut
WSACleanup
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
SetWindowRgn
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
GetViewportExtEx
OpenPrinterA
RegQueryValueExA
ShellExecuteA
CLSIDFromString
LoadTypeLi
ord17
ChooseColorA
WTSSendMessageW
=N�HH��OD����rl�;@Wg����|*��g4M ����K��L��5�?��u��I�{ʟ�{RFF����?~�^�d��/B �(x�s��P�����7m�fx��$M��7C%�D_[����G�ۿJ;֓�{]6�v.�E��癜��� ��ł�d��e��N䭁s$[������?ʵb�&v�5RW�48��x�;����N�g)��b~'�-t�����-2�)�6,\�gc�l�: ���:-�.&��ہm��Y�� 6���[���<!��~�@1���͈|R��d���P�d./��p��/`8��߇o0���չ����uE se�`d��'�9ƪ9 \,{Jr+�5d`|�N�� ��\p��q���YdR����hX`��p�-�ҜO��pĶ��p�07�s�*�W� dc����p�I�U��c`�⩞�;�Bv^zͶ� |�>����P�@�lH+ 65�dg��v��[/�#OÁ�*�[�ּ��`) h�b|�*��@mn�3g��P�s?�z�hA�-��{b���0�~4��|@ �ߞ �ΐ28D�Z5���4��ZI@H7h��6�9�D��05��ƕ&ьq��E�<.��L����\��Je&m�yzk����q�i5������*�>�D-�x�D�ߛIn��J�l���b/�{��ݴ�������9����j��^}U�L�%f+��>��?`>H.b�F}7�b�/�v�m�8��a���S6���:�I��~�U/���}ׄ���/��)eE ?��:����y��H���a�I� 'tYI9�<�$��Z#�d6#�ԧ4�/�Ue�s�@ �;F���7frq��P��$#��&��`tQ�qf���7t���2�1RY�Ҭ�1O��0�����d4��3�f8�n��2f�y��57c��"�J�`���v2-vї�j�.�)Ю1Oa�*� ��0[�j���d���Rd�����J��W��Zp�ȍ���Z����}i�=��u��8�����z#� ;�eW"��N]{&��_@�:�I��q��,]5-qm �4�[���Tڝ�8CGl]�(!8�L�T�w�i����$�K��`��d�sB @6�H3�j�������A�N�Y�f��~`|kg"��<B��M��H�QMa ��9�b���Gr�����5��^��i����B��������Ajp�@5]�<��?�t���)�R!�UG ĤV�Ή��5"$pQ}�`����?DEL�)�<e�ps"�}�*��Dit��Eb���Іg2j��c������A^pO�i�����TUρ}I����/�����OM�ͳX��I�7�ݑd�F,�F/�0K���]e��p�a��DY�ah"L��{���j+K����KO�4�F��\G䝇��5�W]SO �)-I#J*}[b��6i�8�8�T��� 'O��И�s����mR밯��[E���d�h�� �o���i<݆����x�T� e��G�4��_��/�z�&�!��.�P�����l08�<~f��g� M���UtzA��ea>�dW��f<p�p�C�KH�o�ν�� ����[�^���&�������@z���Z�я����J��A�꽯�������0��>�!cY����$�j��nGb�[�$�8��룺�u�J�W��h�Tw<Wd�Ңd�����v)�G��`�)U�m���eQ�o�`G�����#{7��;c�tj�YJ�MV�a��ۙ�"Md��q�Pu�M��k0|��:��5��N}�O��G��b��<�`�u�~���r�Np��|�S#�����1�bl���wڕ�����v�䳖_Q~�9���4P�X ��*]�f�������xPpC�)���Y�z���+;CiC��^ *{���Ǫ(Re�Q�c��� �'�"��[���"���n�����}�u��'j,�s��V&t5��S� �(�T(H�?�Z���a��s"r\��J�T�@�u3$�B'.���,�b&�<��uJ�:��6]��`ʜ��9�E��b����l��~i�kѻ6A�k�[��qj]� ���'W�$g.��8�/RVH܂?&���Y�<#Y֥+�ԗ �;�1Te��@�t�y������F�ke���y��Ӝ�#�4�A�ɝ�Ta*��n�\�Jd�7,}S��1%�!�E"�-J���2g� ֱq��8�\��5��O*�������P*��3"s�7;���E~������g��l!���Ǵ:%��1�Lj�|�{��_N��un����L/Q����A�w��{��yą��\+ԙ��<�(E�����ӡ�DVC<ho��`M}��Å�ce,�a ��'Dq�}���E����PR��rD�"yN��%s�9��,6Ժ�k�#��s&�d����Rd#��������\������"?����!����* �M�u�������%���d�V`���?�J�͗�s����d����fb�G�s(���Jp쭈�38L>T�'I����4��t}\�l������\��gBV�B�c����fC�}}�|��ґ�v����#łc���3J��o1���+�d�e�� �y1=13����NT���� \�8�Xm=�UO9X;:c�����m�f�A_y���i��1�U�9�+26�XEJq�dF�'o��$a$ML�7k������ �v)��O�zy�4~Bգ���o�����YGt��KU��i����:b$R��uo����ȮV��zS�C���aH���>�б��'�r����Z��oĚ�,�3D��~C��]BTH\?2Qsr$L�NQ7,�|%,ҁ����m���p*s$@]��w�7>k�c�c������~M�H���Q�<%{k��W��Z5Q�Y|����k/M�XN2�����g,3�v }�#Dc����*ɪ��6��2��a!���N��]���5w�`��~-�'��Y��t1=�����I7d�c���}����]�0FFG��9\�����e��^�Yܘ�Um�����3)�l+0V������/~����6��3�8^��ʲ�֩2顭-�Y:�MbV�%��Sp���G
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ