Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
18e2d6ec657c58d050665a6d9897216f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
18e2d6ec657c58d050665a6d9897216f.exe
Resource
win10v2004-20231222-en
Target
18e2d6ec657c58d050665a6d9897216f
Size
12.3MB
MD5
18e2d6ec657c58d050665a6d9897216f
SHA1
3782a23dfe4bb7e67cd8ac01bb6ed0369b390255
SHA256
6a9dfb58e1f88e4f63aa68352ee8cf9ae325e6b9b3295ac2b7d8a2180aaf5b45
SHA512
775edf428b3018a6da11cec5c48ebb97b2d74e1b6e3f94b022b603a6daa3e8192cfb14ab90e39e8b228b24468f509260bc6c3e614e83a572d2f1b2081ee79f8c
SSDEEP
393216:FBLR2N8LdY2YQ6J0ADu3kR95YdZ1iIw1yNHN:FwPr0fkT5aZcIw16N
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
midiStreamOut
WSACleanup
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
SetWindowRgn
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
GetViewportExtEx
OpenPrinterA
RegQueryValueExA
ShellExecuteA
CLSIDFromString
LoadTypeLi
ord17
ChooseColorA
WTSSendMessageW
:������Ѝ�A5��4g\a<e{���*��������\� �UX77 ���q��ʹ�a�A^>��^����)�d'�6 l]�f����8]I��M�rD:,�J4ˉ����;l�@ϧ��J;S,_c��t[lw#C*����=�2$s���#��H�p�������bQ��L��X3��>$f�Ojf���Z%#�:�����@� �%�*p��%O���ca��v�5���Lg<= �̀��S[?���W kW-����f����e��6� �-��om+�"Yj7+u�ų%��%��9� �Dx�%X�R} U�u�}��f���CFؑ��&P�^�K8���ӳ�V�m+�&fڮ���ǜ�X��X��=��r�B�X�D�'��)��L.τ�殌�,έ��87�s�W�͟�&�(J��7�<����(Dl�i�����"�F$�eDX��� �/������ �&+u,3+7�(��z�r�z�KհԘK���ei�������o��r��Ŝ�%��9���d5��9;`��)���i���3�Z)羽N�~(S�ª;T��e������;���+Sx3�LFC�B\;��=G˝�*�ᅒ��<_���@��z�� �N��$R^�x:N�~������J�c쬧e�<&؝B���5�j��\I0a��;uLn�|� ���ԙ��M ��9O� �C ���h����&�v9�堋�M+��u�hd���!�v��L�&�i\x��=S��%��Zӌu� ���G QX��D�b�+�$�a�|m5)ڞ�o��L��6i�g@�`�^��j3g���<`U�NӦ�L��S��Gb*ˁJ��'��H��k`���@c���_��xw�<������.��X�y�\+9��.Hu�p�D��S�)���S�����"-Dz�=G��UA��ǘ!���S��~ٲ_���T�����v���4�)S6�<Jpj҈ � Jku�\���Zu���{B��B��5X��B����G�m�q���� �)��X�L촰�Y ���t����j���~��N='��7�Q4��Qk #��e,���Ekp,�'�kOH5`f[�s�/�˴ÆY��0�}������~Amu7��J\Z�(I�����ò��8a���]ᤑ��� j��i���9�j(�<���"�/����?��L����GJ^Ñ]*g�!wK��Y�) ˒B����G��=��x6 4��O���[�w,�DV�_k��������o�Z(e�;�W�씴F�un�&A3#�{�\�#}�V�� �kK��|6��kc�81�L*��.$���jVJ��@O����x�t;cK��f2X�r�:Ze?Ʈ��c�M�x4DS� /�}J��R�'}EwD�O������r�^�s��װ�4@������qA����B�юs�3ke�i&�7��Gp,�������P����Y���;k�M8�����bX�E��n�>��� @D�����c?L,�5Q���f������X~w��s�0��Y�JӀ�z�}�P@�;41N��� ��XfN5Zi־ǿ_�o��<���vF� �?D�B�Ӱ|��j���w�'��#���U�} �< WF���^�����FÆ�`o�?;)��d~ЈZ�F^�J�~.�&�bZ��f��Jo�}cR��#��F��� u3�,5�J�J㮵���|��j�r���-�G�"tH�*�Q�����ea��-�����'4Q���Z���uR(#��]&�O}��<f�C\�I�;����k ��x��i��+G�Gg��Z��Qy%P��,-�&����H��Ɇ��;!o#�%t!��8=6�:̙�s@�T��FK�1�gVsUt�*̇|4m�!�@e��\[n���5���=K;���%�os������HbE��9��/��{��0�i)/ � ��T�K��Y]ؖ4dG+ko9#{��HN"�B�9;e�R�gp&�u����o�� cQ~��I�ݷ��Ǚ�M�����j��O��7f��VHlp�����.�L8����N�N.4�LW)V9� ���a�r|���z�i�[�g�[37���۳�E��>��}�<��Z�qx � �L!�T���Fg��(�'����}S��^����~4���R��sٺ���*�q�[9qC���D�!�D�L=.eo�]k���zO�d��7�ZA�1$X��-?�q�5�L���D�X����p����a��F�J̄h��;DmMK�_FH|V¶y���+�E�wј�iEC�B<� �z���3E�������_��|aL�[��V����A�8k�;�{��=�W&`�y]zJ�=HU�]�c�b�ڕ�ȮN����-�]`���G`#��*�.�y�}�Ԏ�����J�D�K���9I]�֩��P;��>Y��L����Dž�����|W$0%��N�HH��ihz��]S�Y���pX�8�~��q�T+��|ʏ#:^[�w�������F��z�� @��6C�aɳ������?��ʼn���d�[�g}�x5X�P8����f���N-'+h�6�%O�0����yÅ�j4��5'��t�E3����QRx��~��RC���h�W� mB��o� ��K<C�;�_�k-�=W��PI�/�p����.ܖ^NT� ��*��0�i˒�l��'<�O��k)`��;,����cH��e��g4����&Aj��c��̝ �P�`e�!V_�Bj�Y3F��E��{�8�n��� G�H�^l ��!/�2�8\�Fˮ��ө�2�)s\!0#_�fc�)֪P�?!2����`�k�Xq��;=t*����<f��V~+S�߮WՂ�?v � ��'�g�#1�*�����p�*�r77>�7ҵ�#��n�u^Fx���^Ⱥ�,ķ��?f%��'B+����F��7��(_٢#C���x���.c@�l�N��}��[��Q����~!�sN��9��%���H�dx�Գf #��o|��_YVoCSZ��~����qqJƵ^��(��/4$w}xg��>w$�s�AU)�T`��!X��/����NF�k��VL��: ���f �#�!�Ϯ��4;
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ