Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
fa60cc9188f1ae442fb7b6118ad59b6b4144a0b0d4aeaaaf9df4cbdd028d8fa1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fa60cc9188f1ae442fb7b6118ad59b6b4144a0b0d4aeaaaf9df4cbdd028d8fa1.exe
Resource
win10v2004-20231215-en
Target
fa60cc9188f1ae442fb7b6118ad59b6b4144a0b0d4aeaaaf9df4cbdd028d8fa1.exe.zip
Size
16.5MB
MD5
6753fbea19ecc46321fccf399f0aafac
SHA1
0fcc777a3bade3a174275967c999e57fb157b9d7
SHA256
c6fb25ffe9aabfd45be6b82f7227557ba9f8844a33ed7abb85d5e0a4c82584f4
SHA512
81a90165e9b743916da3a6a152456bdeef6cb38b024c45fea60a7aa577fa03374d25d42bf25bb104b7b9e5a99dddd4f58a244af387dedd69847b2338729c22ab
SSDEEP
393216:F5eAAIuL9lI0tVm80rTIAQGcylpQ5BSAQW4YDtsIlao7:+dZa0tUdiGcylp6oNWlhkk
resource | yara_rule |
---|---|
static1/unpack001/fa60cc9188f1ae442fb7b6118ad59b6b4144a0b0d4aeaaaf9df4cbdd028d8fa1.exe | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
CM_Get_Device_IDW
VerQueryValueW
PlaySoundW
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
CopyAcceleratorTableW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
GetMapMode
AlphaBlend
GetSaveFileNameW
OpenPrinterW
CloseServiceHandle
SHAppBarMessage
ImageList_Draw
StrToIntExW
IsAppThemed
CoInitialize
SysFreeString
OleUIBusyW
SetSuspendState
GdipSetInterpolationMode
GetProcessImageFileNameW
CertFreeCertificateContext
InternetGetConnectedState
LresultFromObject
ImmGetContext
WinHttpAddRequestHeaders
WNetGetConnectionW
WTSSendMessageW
�O��j�֤&Z��q6��J�i{dž M.FF�tχP���;��#��~��a6ι,�u�f������V"9xO�bg�&��Q;�J0�H_.�P��%����z�?�v~/�u����}?�3/K �c�vg�!�َ�v�l�{�|����1v�T��_������7�=i�i-����>*#��Q{㙁|�sS�*�����9�)>�p�M�QJ^<�K�M(�j�a!�����d�u�g��8�5�}�� �<t�~@��4q8��.&4'��`��d9T�]�nL�3hX��v7�'�O�Lw�~�����Rͺ��j<��Uq��a��<�!I���R�ҧd���m��q����I˩[�\�{&$���L9��'m���-�rR��B�Ӕ6�J��)x%�p�u�� z��( �h=�rܭxQj�έ_����ZK�^�l� �|-�G0���|��c4GB�]ѯ���L���_%� G�_0�z"�;<�Fp�H�g��f�y�:�&�<۞�骩��L922��y%v�A^AdY�/�%hkRw����)e��6b44i�W��j�ڢ��3�j�n/�ZJY�2Y��10��EANo<P����� �;�4��abTߘ,���kJ����gh�'7<ѕ'�)x/�>[�mG}QY��51��o?��Q��%m��ia�Nɣe��K�k"rxe����WßZ���� �A�3�h���R������t��$�I5E.��2�q%:�8z� ��Z,��뜍.>���5}ĭ%"Ӌ�pĿ�[K;R�˼�`\ �8$�E"�9��gku�X͠��y#������ʭ�����'^V����6���v�O�_r�M_i�?�EJ�X!h65�ĭ&�o��}� ��!��Lg�����qުI��JXjW�U*�����N���>u����7(N�]�p�H�Dx�l�xԆ]�b��ċ$/��^�Xu'3� ������S��o k����w���e�v�(�-�ԛj���HK(��_, �s]�M�L�Ù/�O��5|���:�d�o�������\�����/�\7 W�@eJ���e�>L4�����文�:�̙#�+�6�n{v��Y>�_���M���f� �"�����B�A���s�3�O���A\~*뛜ep�29Vp�,D� ��@(��泘f�܅v�GgO�g�+�$8��@�$'���۹p�E��PO���5 ��K ���WA��A�GR�x9*��Q`4�by��U�Zr��A�Os����x��1$1����ީ��n@tT����Ts�LO5iV��*�j��m��-߸�R|�P�g9+�3���\�Qv����䞮Ui/=~��n����f��F�\�fz����G$�`�2�y�/t ���� � .�-�ԉg'5L�����N�BM�T�h�z���/h[�����`Ō)���RF��Y�ɶA��y�P���7������J`<��l.1:Vٕ�4�k�x�w<�����m�ܻ�INᒁ�w����fl���I�����l?���6��N[Ǫ��ElZ�"���~��H��Гz�y�c�œ�G���:���E#dm!8���1��>"�1"M����5p\�lV���5�lm��i��D��7T^@��q�G�WK�����u��3����μ]�!�P���fd�EjW��P�M[����_�&pQ,�I��4���kT ؊�}F���5���&x�_�]�<:��ƚ��]�PS_� �'&���>�^��9�v����>��7��s�f�Vz�:�L= T�h�1)z���!��%*/yٰ���1.B ���^��k����vg��S��R!��Ϛ;����S�":�?��=�S62-Z��� &��;�T���w��N�#e�{JiꀐK�Qx-��-�D������I�Da��X�z�_�劌 A%P����Ƭ��H�%�~8@|�k��u�� ���qy���Su.�.��o�m����D�%1_cR�;s8�&G��������B���c3֖p�?wd<�]����GZ����M��G{�N_�OC¹ܾY<��=���~����e�51�ÿ����R��8�n�D�C&W��1W�����mQ^փ1u�n�snNVH�J�@�_�C��d����GʈVo���T1�p�f-w�]�����s��}����s�(����t�hg�n� u������N@�Nuڵ]�66�����`T{�S�x�)��r+2��O�:�n ���^A�#�)gZV}��$�ʒ�X��@L��AX=��s���+�� ��i(����z��^�ӡ��d5�l�X����#��8��Hc�̅˥P��|�V-ya�R�����|.h!�m�\^�꾵��ح 0r�NG�J�מy�ܑ��W`m�s�g�<5~%�J4)7�ٽ��UM��g��vZbg ����6�M���ZZ[��˪0�����'T���>j(��r0+C�lY�3p�!bŴ�� ��$:#�b �����rq�拖fPQ��d�r� ��lc�D�~H�u#vE�A$����ڗ�T�^�Q����vJ�& ���������ʡ�Yص��V�jod��)�A��~��3���MaB�7�������$�K bF�G���}��U���ʒ3'��(��p�2�ib� ���䄚���8A>�z��x[Q�L2�����2A: 4���'5�+=��C@J|".�[��: ђ%(��5��nwuga�����y�� ��&-"�b��� �Eh��K����� fyA���8B�7�w�A��đ[���\��_w!,���s2��̆���3���+�k,��,�f�7���7�R��@� �yC�iI��r��;h�Ȫ�f��}r�E��ղ7ڒ0��2��!��7%�ۺ�gS`58�x�)m���$ �""\e�U�W��3�9 p!F3����w� ���T�F�w����幃[�$��L^��S0�ũ%-�n-Z��mgٗ�7]�25bN��#�aV&Kdj�nlC;U����"��/'�'�D븢v�fȼ�7�L9�iX�T���=�BG�Sy+:+�,��p�u��o��>�\�� �o��Ư�!X#�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ