Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
27f04af9e2439d69f75fbcfab5f47d84.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
27f04af9e2439d69f75fbcfab5f47d84.exe
Resource
win10v2004-20231215-en
Target
27f04af9e2439d69f75fbcfab5f47d84
Size
12.3MB
MD5
27f04af9e2439d69f75fbcfab5f47d84
SHA1
a9f190ed02cb933f119003bbe031f52a222dac1c
SHA256
c0293abefd2ee4e144a10062846ab8458f4a5b5b459ff8c886f518fe963eacb3
SHA512
0fc74465cac9f1d5cd326cc4f88e1d07ee387bb7c47b7a101fabbde85cb3e1110f17ab794b0f9198a622d292e3f4e4e70b579cdfdb69f10b552180bc20e73ed6
SSDEEP
393216:/Ji1nS3VSC0aQ79LY6bhhEVdn/264TbCioHuk:xISP0rBnkRECioHT
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
midiStreamOut
WSACleanup
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
SetWindowRgn
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
GetViewportExtEx
OpenPrinterA
RegQueryValueExA
ShellExecuteA
CLSIDFromString
LoadTypeLi
ord17
ChooseColorA
WTSSendMessageW
t(��y��x��8B�A �I���� �sj��Io���T�bD���-hE��>tD�U-��k���.��7"����m(��o"7m��f|'~Qu��.�߰�/G�T1ѣFƷ<��ݼ�zS��*�Bf��8ӷ�s#^R/�:��~l\�0:3#�v��Y��l�͛�_px(�jQ��t��S��<��(dT�qfp^������P��Md�"�ĕ��ˈN��lv� Fn��M�g��ZĨˋc!��E,��7Ug9[�P6���{��H3��|�Ψ���<3��D8��S�t�����D����;��l��B�,�d���E��Xg�ht�'J���-��Ds):>�c�_�����}x� ���Ϫ$~2�<|����FQ,������1�;/�;y�,�Gm�ȴ� ���T���6�h�2�W:�y���[�N�CIxB;���c%����[؈��R�Q��1}ڛ%���Tv�!r�$�>�:�#SJ➞y��ؓ�E�`�B��@��e�}�%2C5ģ�L����m������TL���5�277���3zG1�W��`��A���ڇ�%��8����eR_���'I���|��8������#��R��9�q���_�G�Z���N]�<�ݚ�����u"��=/�P��ڋO"+A��.�^�A-�����uQ��aB���p�g`�t0BЋ7�d���S/�C��t����,�ȯ��t�����K��+��F�I�L��_!"P�ɨ�J��S}��VBH�l7���0���+䶙���C�M6���斦����z� �0 W?5�D��J�8G䛬[f���[����OΥ�u������� -�4�:.D_?�iB�$4ǡF'6S� m��Z_&db)�@W�er02|o ���Z�r�K��~�U�<O\Vl���6�2�=N��RYAY�b40(FF��c�J|��#a��|��|�6����~!A��[��R�,*�hm��$�`U�����"�"{O�F{��3���ҢҲ����<ƨ�r>����n���γ`�f�s}��0�;�A�s��`95z_?�y�;�H�d%����{$��X�z�I�A��U���-=����`��H�#u1��MI�B�W��ԫ�J���Y�Ǻ�z�M����f���� x\v�x��[���I�m����H���e� �^��2dρ��%z-���g�����zk�V�T.MÛ���A�f�%�m�7�$��0G���)GQ�LL����,7g�؍@9.�<;%;��C �����+�; lJė�r}������O8��q���^�z�w;:bH�����w��t�J,8� ��l���2�Y<u�s�C ���0_I�[9��5V_/�Z�*�'Ǣ�U0\��.I^Y�[�6F�����W��t�!����z��̶�����Oc(Ħ��&R2>�Û#�@N��Mἥ��c2���j�κ$�Y��i��eNkH� ���'�Q,���=]8�?���O�F9N������7����b��r��5�#����rÆ �������� �R=���|�q(���o4��p�ǺTXR��Z�Zozg��A�l`�G8O�ݣ�ɬ}��3Y���Sɧ�����/���C�b�����Tº}��o� ���%�z�,z�(��9�[qJ�y�M���*���8�j@^��҇/_+����4���>����%�\�U�Խa'"�?\q��6�����7&��1����Hj� o��'j(cxF]��5f�JO�r�K:�x����x��e�K7h�>�ʜ$�����Jj�W�CQ�B�yd��?΅8�Ŀb�S�gK'B�m ��H�ؠ!���.�#>k=�+�t�ydW�a)[�'g�,���<A̟��� Q�����HE�w�&K��ؘ��*w��P���y)�h��&n_���d=�Mâ�����Kr����Z�B��ou�l�,IƠ匫j��Ǒ��ӪtI����i��#�9�O��S��j%qk�� ��������?��/�q�0W����;�b�d��G�?Jq�q�.͆�gB�=���b�� �&��/���<<���δ���IT�@1����H�C,���a����,�8�L�)�ty�CA��/T��;�V��iކw/�](H�'�������T��]YC�����@� l����E��O��������'�� pb�������:���۟#Cg߉!Bw�Rk-`>恝�OR?��ZL�tn��� )�o�jM]���C��lP���uq���2[ao=�ӭOHI>��QY�ū�,�Ț�Ԉ\a�.j�p8� ɏ��Γ05�5��ף�Wť��I"S3b�G�fm.֠(P�Kr �]gD�������-����|eޠ�T�� "x�i\��o�f�'0�N�Vb��S��J�|}� ��Z3�id�a�{F������R(��;�ee�kH3S�� p��b�,"�{9� ݞA+��_�L2�)������L�62�������|H�p��(O�ۑ'���GU�%j[=];bm>ҭ\���^r�9��J^̝6ܥ���j.�ۯ��+�{W\�o� �qs�rTHX�z�-��8#y_(g�x���'�hvU R�4�A�����./�0-h��]�1gZ�/���?���u{KS�g��|��<��Y���K��цJh���u<j�+�g��1\�C�Z�l���r̰%�:@�/�D"Z��&���h��o$H�ޠ�1�^مat����kL����9�I����1y~���GK�3�tl�;��5�s��}�tD9ػ]��2����[$m�p�;O�A�%!��@�U�N��ZQ����ޜ�T���Vϕ�/����y8�dr���'������l(�j��0�eA�'�l�*����`�o��2��<N����'�6��aG��F��f$��c�O�^�7����L{�}��kǮ�~[����g(�=��9;�����Z)a���/��6|��� � �ux�k�E�uq0yt��|o����*b%����dPS�$eI�ihԗ�I�����CF!���W6�Q`B3�x�����gt�r��� �}ڮE��=��-w�&JV��)
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ