Extended Key Usages
ExtKeyUsageCodeSigning
Behavioral task
behavioral1
Sample
16a65ee103c74f8b23b86a436247a699.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
16a65ee103c74f8b23b86a436247a699.exe
Resource
win10v2004-20231215-en
Target
16a65ee103c74f8b23b86a436247a699
Size
379KB
MD5
16a65ee103c74f8b23b86a436247a699
SHA1
30adadb89565d621e338a50a945a2a8abcfc8b31
SHA256
c187f49b91d8cf1d5c425dced61251c27a5ec2ff6c772fe66a88ac023c9128d4
SHA512
4aa798eae3898c1ccd189759193c83639cdf7ca21c00f3eed5ae0f6e82ad66d55cce085bfc802b81e434ce170477ac04859be10b68772f3f432a931d70ed949e
SSDEEP
6144:bLBkuedz6VCbeQqlJ8J3Kow31uSb0VqYwvfrxNhVId8/yS1:vOuedH7q7tFuSb0YYwvjtham
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetModuleHandleA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
GetWindowLongW
MessageBoxA
RegDeleteKeyW
ShellExecuteW
CoInitialize
SysFreeString
HTMLayoutGetAttributeByName
GetAdaptersInfo
Hx��Dk^{,��K�7��T� JG��]���|"Z���%�zp�s�������Y3�A@�8�հ������hu��g����L��]�|�9� ���Ξ�* �ql��ș�#Q�/���ӟ<�X[e�����?8��Z&�6=�+�?A-��@w<�m)Z�V���{�죺�*�gHq`����N?�%�1c�1��q��FzbrVHdl�e��c��UV��}��M�;r�M�>\!Ҟ����Ë63<��SE�C�����2'��;!y>ia�K�ŀ�L����a[�L�C��ߕ�T��Mc����)�/��o8����-g�\g��l��P��G�=�Ug�ԶU��lU��P�Dv;��Va�t���ivz ͊�������~q���X��.B[N�����{[������;2��lKәfB�{JYYc�i���@��.x�)�Oz�����9��cf���Z�����3����N�Ւ)���nT�A9~���2���ңQ�m�k�1�M�$�����G�a\�َ!���ft8�oX�a�1��o�������Z����<�O,����@��o_oR���:�D= ��DYN�����xPo۟���n�s��p�B��7I!�Z��)���JR?�x�$ ��$����[�N�Xr��0��{EPA���� ������CSV�v��/�Jr<������59pd�r����� L�o�d�Ց����(���*P.��ɿ)/[���G�e��}�d�����������SGo� n%q!m�ck��W���L�}��"���z�)������X����髝�w���� �s��#�W�8���e(��%�� ���.������s�䊢�p,��A(ڜ�q����9�qQ��dJƝZ�_���W̉�L`��I�Lx��������gX��6��R/ԁ)�1�X.������ew�S�_�����e�:���eN+��ź����,���<���Añ������w:��bQ��]S��5�<a��'w:��� �G��h�A�#���%rKU�`�H�'����?l� �L~+�*��3&Ca��9�)��_ծ�v�aj��;�@�]Ұ$��51��ڀ��l��ձ�}�*��BQ(PhZ|�&IC�6qr'd��@>�`1�3/}5������VAZA�9|���78�g�ߨ)��!8������xuӏ(IU�^]��ᆐ��K�_9�c��E�?�ҥ�M|�������W���m������y��V)Qt�{��P�.��&|'Д;�?��om7��w?���PP��D��u���<5l�~�DVN���՛b;p���n�q�/�.`�Ğ^f3��4�tV�A��ղj6�8K��Bd��t�. (�9rͅ��,���>�Ji��R\�.��Л_��A���,[�T]���AJk�X���g/m��:h{t�+5�>�xu1���dP�I�O��W�.�)1Y ���fw�)���~��r�P\�����h�$���tK�"��Զ6Gx�4%�n�+�8�O�b�����-���M; ���IJ����ޭ�!�w$��<���)0(Q�.�����@q�n�ߺd�ᕖQ��G���d�� SzU- �t���=TȆ����ȳ@�����;�o���w����Dv;,��DG���A�R�l>�-�d��%%�7D��$or��M�4��q�����[N��gLz��a�nm)X�q�����լ@+p7/e1\@ۋ�BK���g5@��1~P�� ��U1�8N�����͑:=�K��.��1�D���s� Ė�����DA0'�PUN����'����7'�|����@P��,f��r�A�� �Xwj`�13����0�8��`�դ�P�O����lQaY>`��#N\�)ei��&!D:��}�qp��iy6M@�=T���m�U�\{�g����?{K�x�Uw|��I1���a,��&���5J=���r;ֹ���Z�q�v��Q.M^����S�a���ㄏl��*���p�N����y+o��=/u G�~��W%#�./�CQ�{z�3�.li�l�����C�l�r���?�,x��/���=dt�9��C�+}��*G8;v�%�q��IY$j#ڴ~uxޕ}x�a�- H(�.憁�F� 7�I��H�\}>�r=���Ac���K-���,+��ڸ�����2�x�r|�t��z�����iU��WT��8`��-|�kޜ�Bc&���Ȫ�_�-˹f�� ��J��Q�)�&��Zk%"<D#vĮm�P����]:HVPA�"4� 61�e5���4Md��XQ9�ɦ>�~�I����V@X�3K.}�w�3�C��3��F �鸯����t���G���k�ko���_Ց��o�n��{�T���>��"W�T���ZqG|�JZ�g���y�h��h�YU��BդzFs�a�aD^.p5챼��Du=xE6�졲�4o����?���]c�Ãh'?���ep���t�J��z��n��{㓻�4HZ4�]�)��g�tR�o??y������G}��\��h9#��V1���#� �/����|Z�k�W$j��K���荋R�EJQ�>�@��4��m��'!�U���� ?0he- ��e�6u�%1�;s��:-�69X���m{�Sc���c ���K��[��� $o���nb^0Ԃc�:�i�N+�-��4���mhe�JQP�BSKy�x��b���-��-X�%IئL) U���x�ke�D�i��YBT{�77�Pg�\��V�ד���.I��O\��2�ꌨ�n����9 8�/��8 ����\C'5�f!��EH�&�ab�:.�{!��t�&�æ���-����!?�� ��w����#�{���Roa,�|���z(�Ť��N�M��v9°�WK�2����Xy$�9� �+����V\}2��pW7������]A-U�O� ����v���GQl�]@*^�>W�b���E��(����[ ���h[DŽ�/���D��ך�*P��c�����M��*�H���뀦w�k�#��A
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE