Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
1aa31d74ff7495389a5a4ec09c9c5c8c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1aa31d74ff7495389a5a4ec09c9c5c8c.exe
Resource
win10v2004-20231222-en
Target
1aa31d74ff7495389a5a4ec09c9c5c8c
Size
12.3MB
MD5
1aa31d74ff7495389a5a4ec09c9c5c8c
SHA1
dffa58f76779c5a787b44e032703dfba602d66c9
SHA256
b3715d9b854d21770c1a0f90cd1d92b9e5a8e507dcaf3f60c7bf8c688e0c5373
SHA512
6fd4192a93d2257ef3f0ec6232568fa857aa7e5ab07e9db02a4017bbce2cb940812d22cbf9145488a6021cdcba118b71daff8e8ab0ff53d6aff8de92e0f34c41
SSDEEP
393216:5J1yCga13npa/WmJbHDMfwoqvplm0jd6Y0iLSQuKK:5J1yxk3pafA7ypTjd6Y0iLS/F
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
midiStreamOut
WSACleanup
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
SetWindowRgn
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
GetViewportExtEx
OpenPrinterA
RegQueryValueExA
ShellExecuteA
CLSIDFromString
LoadTypeLi
ord17
ChooseColorA
WTSSendMessageW
§��w4���?lF-#t��0�������u�o��,9�9�*JA�;K�B��Z�lJ`v�$���l�ހ�@Q�RT��"=|�$��d9�Nqѷ��/��2�w����[l�����w�M`a�տR[RС����z�h�����<2!.��k�&$��ͧ�SE��,�_ο�}�u�1��`$�&�����`��@�-ʁ�-3�{[�ms��"~h��6h�t������:��q�=79}=Rt�Nu�{�\R��U���a��Yy�<I�[�>]��� �j��t���h5���/>b�͘������&�b��M �Q+k^��JA� S��$p��;z{�Ec�(��&���{��j�C�¥�"و7 ����:5�L�_�� |81�6�mN=��H5ހ�_���P���=��`(�F [�m�5�{�}�q���p+bd�j�D|/�t�c+�D��PD���j������k�)�Vߢ�Tb�_���[���l��jE�Ԣ��:��6�"�N��������v��lxfG�8�Ȭ+S�����6� ���lƚ��i�#lrJ�=�e������^3e\� ��y�{�:�%�Z �q<ue���x, o��3��XHL!�+҅j�Zv垩������&%���4�w�߹x��j�C��+�R�G9 ���:A �3_�L�E��d�,�>E` &t��C͵鋓#wG��q�A9��_��"�ϜLӪ�I��c�8-M`�pY����7�B�7�h���:$�q��w����?��8��Z9{�D, 2�B�J�Ŋ��$��ךf�Q�{�z-��O'��_W��K�:S�$J-��Պ|DfO��l$�iwZ�y��Ȇ�H�M�k&�zL�>�9��>�".o�ᒗ@S�*�I������tQ�ݝL?��tӆqsEn%�H�����to��b_k�A͓�09/�5F�k9Bد�V}Mm��z����CkC�.��R��^8�m_��/PS���rl�$�II�(���W���s'�E¹w|р�4hY��|���C�Pn�dI'�����㌑q�}�m���ֳUu���I��d�zT�U�a��9�#��͍!˸��,md���AQ�u�Lq�f�ZmAn�v�V"-M���}t-f�+��u�X�q�u**�oG�a�n�(N����8�/;���kr�@�o@�t%'mN�ݺ�H�t��cF~��0�(�jÖ�����c�'�\q��#��.�LC��>eX��Rf�r1�r��y�(�X05���ى�A�T��*��������R�(p�l}Kp����gx��ΪuS!d���-�?{(a�ݵ����<��U`�s����ol`�͕w˱�k4J����e�[.����{��Kb��� uR�]�:�Z�q9���&��_Ϸ��}j�(��",2��K��՟���v/��|� 83��?���B6n���Fb ���oW���C,w���o2��ڄr:�iQ� �<K��'j.s���Hٷ����Z�����'�����!ĥj��Ru\- �ԏ?x3L�E��X�/ ���'�h��������*&���^�Î��@��y�'��W���]T��l���9>X��<^V��8[�����5ԟ鳞��D��7W���"h��\W�[k�&��K��/�4����A���1�<�9�W�4��N���_�u@��9O���Y���A�u�����{M����`w�IP���J����L�pn� *�9!�=M�'ԢH�+~�WT5�J���u[���Q�U�����$`�8�G�WS�~�^{�[�>�r��L�ʱz ���yS��R�©�����C�& ����V�ir��9~�~�����-���2akeX'��!�[S?"V�ǵ��� ��'�L���]�Ңq"Lx.�04����6��܇զ��A���2��2�J=FN7�aR.�P.��^ma�t'����-�L�v�ijﱉ/d����xx*S�Y���ӊl��ÏWa�����I�c%Ihc~� ���0Ix��m�kz�Q���Hs��P�~����=���h�@MOAm`�l����B���i��?��1~u"� ht@q)�D���`���q��y/�o�6��鿵C{\蕴ͫ�Kݫ1�ٙm��#�c����W����K2ܔ�Uj�iiDĐ�� �� �����A]r;��;��B?�����q�QCW�y/C,$�:\�\V�8�:�4�|��`��d�)��G���U�Z rC���N����X�w`&.B ːWlC������R.�����!�5�(] n���;(<-��ቇ��S^L�sE�g���nP�Ehm�������D��IeG�;e_r7�Z��8c���4���_��P�UT�#9k � �H�L����,axP��'$�-$M=��me8~ޠ�Lm�y��{\I8͖HӺ�x�A�DZ�t�ٻ�9�o.�i>S����i��6���!G9���b\k�~&�� Z��������(�M����M�@�({\��eEI쳪�g(@W�"��qބ�t��J��&'6��c5 x<�|(?���|�����u�E��<[�4��k�D)E�\�������ūA��2�������`��Lb�Dڅ� |���'�<��6H?9@Ȗ���yH�b�f:va�eT���_P�gZ(��i��W�3(`��>�__7��1@��<֎q�h}��ӗĺc��B����Ȳf������Q��N�Tʤ@ �}���1�t��UӍ6�� ��~T-69��:�.�W3��ycϺ�]ztR��s��$a@�R$���7���ɂt��`¿E����:�&� Ol�P,8 J� �!#��tJV�}$��=G:C���z3Z7�T�+&�N�q���:;R�A��E� o�)Ub��ܮ��Q�����|\k��|c�G$�K���%ү �|?�!��5=K���mf]c+�Hv�����_��x������J��#z ���.<��g��&#��S�!<E|�kb@hV���� �B���Fl͕~?4�Lؓ$Ϥ�)�|&��&H˴�D�zS���sú���� ��^Nh�O�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ