Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
Behavioral task
behavioral1
Sample
0f17ff6159ebc40263cbf43894d2f89b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0f17ff6159ebc40263cbf43894d2f89b.exe
Resource
win10v2004-20231215-en
Target
0f17ff6159ebc40263cbf43894d2f89b
Size
249KB
MD5
0f17ff6159ebc40263cbf43894d2f89b
SHA1
9eee2acd7ca5606da77dabf985719725a5a1a0d4
SHA256
beb6e71bafdfc7ab6b4ce5d392b80a22f416adfd85b8da0575d015d4c1845fd7
SHA512
d2054c8856d9500f142caa173ccf6d2e82142182852ae94db3ff1eb52fcbbbc59b82fc0c43495222878525417f8291f2d1d0c0102dc137d17523bc6f9c3f200a
SSDEEP
6144:oRGgR1GUOse5+jUO71w9UbObJXMiF9FQqJ6E/roK:WH1GUOl5+oU1wiS2ivFQSP/rH
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
FindResourceA
GetModuleHandleA
GetProcAddress
VirtualProtect
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
GetInputState
MessageBoxA
MessageBoxA
LookupPrivilegeValueA
ShellExecuteExA
CertAddCertificateContextToStore
��Y�L\��-�B�S�F^<z�^��ZI���ci�l�������R���#C^c���Y{�pv��*6>�%xQ�����贒n�_�Q��~���C<�4 75d�|K ��0E�/�'��D�!��w���������v���M%�&�ߎ�y��f��� ��p��Mד-��Y�0D�S8յ�f�M�L�����P���=Ҷdc����Ac��y� Q��S��Z0l��G"E�[/*O�����k�NT�,���Pm;m+�r͋�窼��m�)��n�-�%F� '����aJ�@�X�˯���-�Fa0� ��/�G�}�����b�l�<B쬽���c���[ȀP�4A�AE��=%�9�Ң3����v�3�p-�$j>�����+��%�|/��@��y�TT:�G���6#��0�fџ9-#��쥎�]���Oh?��SA�ݼp�V�0p4��6Fl������b������Qp���L�D"PkFO�^��[��'n}8�W�z�SH؝�����]V��*��g��R%��Hg���z�1�/|r��FE�S�,:�\�Z�p�rvG��3��#�]�qd���v'� �[\T�W�����h�,]o�S�������C���R.�p�(�K��囄A�W��ӟUm3������M�o_w�����z]*A���(�����q0�WG4�e�����L���ߘc�M9t�*��b��Y3�JF0�8�x�������Nl���F2p�K4��#��1�}x� �Mo�7���aQ�>�f�Aɽ���z=�5,��<���{$e*Ż_Ɲ�kq��e�� +���|���`���c��Ś���F3����w���������ޣݡ ���\�úH�"��),�������;�z��O)4Z>��eB�g_�G4T#��<?w1_���[��M���W���i�XG�+]��v�d��MP��k����kd�%�rO����v�C��L��c<4�-�ֽ�9<��5� ��7�^�5*>�(k��i���M�H�@�}��#�g_�y������u=��B���3 ��x��u��tXR���!��'��+��w�I��T�����9�uU� ��~�"�;cd5�'��-�G�`�1߾�+��W� ]��] �gM��a]�L�v��G�(���� ��r;���'��sQ�q�?Rb��� I�����+���g�A�.��D��f�hw�_!�m�%�v�T��_~���b#�`��մ@�*�Ѝ�v=Q��8)a�x����em�4��ֆ��������]i��i�^��";D�C/N��v���8�$�~v��Ѹ�r��Х�,��٪�f�t�/"��� ٲ�&�6I�L����DS���z���������H*���)��ҨH*O]�()x�M�ܲ�m4�؇n4t�z������}�����}�k%���!�����è�����t�i��t�4���CD��7�� tf��H{��F$�!�6-a���y�î�B�f��H^���pn�É`O��ȍ;��b?��@��OkbVW�)�#_@�����s[�̓���L+��aߐ,l.�v-Y#Y˫���t���H�Mg�?r�p�[F�z\3I>5�q�Ȑʵ��N��A�籰��� �4$Z�ㅮ$BŠe\}��9i�e�E������w�%� ft���'�� r�Oy�F$���,)�a@b�{f%w_���4��Ƿ��mK��G��pPK�S��;���Ƃ�A���Z�N��{,h,P��oN���U�ŗK� �]�V�.����ň��0�Hf{��t&p}��~��m4�ÿ@�Z�7�S�M����QB(ۍ&��/�:�}�HE���1콏������Gf�� �k�܆kmQ:$�9�t�} ��䎣�O �#x,l�)�@�1����';[��P\Q�5srB�ZA$������v�z 7 ���[�!��-F��2�o@I��rr<ÔC=p�DP��#>���Mt�#�xfђQs�F ���I�B����cpb���G2ZT�~�T{��kt���DPx.?�|���s6��!b��o��f�d��8�Q��i�qμ�$a���?.՝��։6(9H�8�e<�M2ߓ�K�%��8�e����)��^��� Q�5��uޘ�>�76]G����C�V)��q�o �Ϸ1��or�MK���u�ŌŇ����5L|��AH�� w~��$2á)�T�_��wԜ.�z�>I܅l©�~��cG���)tU�a�Y���|?[,�DY�GE_�>�<��� 1'��e������I��'<}':~�C�p`�h��(#���5�p�O ��'kqı���h]lؓ*��Y���;</B� pt��{����'Hr��e��#`��ʁ)'A.Jf���GQe�1�G�n��SRz3�k;=eHH�rs@��,xT\��6�d��d�����w���NT���%��ǙL)kL�j�j�d�����2� ��LiJ���s�v��"���1Q>-���Ӗ��[�����l|��A�ʬ%"�2#� ����+��E�!f��� �c�P�4^P�I�v0u���_�n�l��wpW(\pL�=����M�W�eG,��١&#��b���GTD&�(��D���.q�؈Lz�"p�KL����$ؼ���a���-��PV�F�τ ��K���E\�y8����/쵢bu����Ů�`���e�4�0�a [Ƀ��Z�����i�����������n��c�=���7�+@p����'*�E=C����5��,6� إ����9�Y@�9Z��S��)W�F�؞������!e���tIU��Ŏ�;��:#�ն�c$H?�OS5Ʋ;��*�ԁȃ��2�\��+���������5��6wh�=](�o��Ќ���?����tN��4ނ�UEA��&0��x�]�J����,ps� �\���J�YS�y5��AZ��-�>I�=�4ߓ.���5�eP�y�|d%n�K�aq|��n�66R�^K��u'm�$��U_ �VG��V�j�H�婱�w�o�E��j?J��6�=g��W����ܦt��i����Y+����7k8���;4�?���
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ