Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
2c3a5d49e3da5d8d58f97c49033ee789.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2c3a5d49e3da5d8d58f97c49033ee789.exe
Resource
win10v2004-20231222-en
Target
2c3a5d49e3da5d8d58f97c49033ee789
Size
12.3MB
MD5
2c3a5d49e3da5d8d58f97c49033ee789
SHA1
0332e0f4896ca261eb1d0bda878629e70d9002cd
SHA256
9c095263679e26835a9a7530665ffb3dbcb521662eb49e02b2a4e2885e1c2137
SHA512
e298eed4108e3107af44877bedcb364665481cdbb6e87323bc0279e6c7a67a28442b0f34a5ea22719093bc993d077ee74f50809e07f7bfa7f7afbb09bfc08486
SSDEEP
393216:SgyLYMkXrPCsJBoFn2gsObuamOEQJafN+On:SJYMyC2gsOhmN88MW
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
midiStreamOut
WSACleanup
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
SetWindowRgn
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
GetViewportExtEx
OpenPrinterA
RegQueryValueExA
ShellExecuteA
CLSIDFromString
LoadTypeLi
ord17
ChooseColorA
WTSSendMessageW
sx4��*��ũg��������jO�sn�X��57��xw�?�} +��݃:�{G��6 ���e���%U���U�`,��H䵙T�Zl�~4�4&��T+n����'ٔ?���Y4.��b��v/'�<�m�D�0�ݶy����n�Ro�G6A�s�0�o#��AfθVhD��u����L~û�W� � �����¸���U��!^[Ӿ�"��G����q�00NkG��6����D�ݦ��dl� ��y`��� �u�dxL��#j�lk�yf���VW���I6n�G�K��:$0��T��4.ޚ�jGH,�Q[�x���-yiGcq�V[Ε�멢�����T��D�x���k�di�����X���](��f.�����IԌ4p���T2�"�Z��m]�t��� L������b��P�����d&M�Í�X��'"�gc� B}���oGX����L+x-s�X��c�˪��ι�ދN���$�aI�83m+͡ɥ���9ff��*�B ��/,0/y<M�k���`���O���䚻"�-�߳'�L�C��r���X2|Nd�~:������9�LWWx�':3C���q���e�"�$�sM�?����7����I��nco�V���O*]��G�+xE���u��h�����m��J����<�G��3�Pg7���~�v J��\cQ����>@�E8�P�4��9*�Ø0��މ�STO_�$C8�I�����Pc�23�w��ں�����&���(H���k�C�Mi �s�g��ui �@�>B��c���ZP�T�yb�-�G�$ql]��O�ix}NN.����2�� S�(#��m+'��L��궯\>�8���h�.��"x4%�"_���j�ΰ�'�5�o��'&����3Y�FD��pI�c���д�G�Vhs�y��$DT��P7��-U0��Q�SbR�&V�|y����(��.%�@��A+x'e]��\�!��"ؐ0��B��(C�89�� �xidi���4��J��X;|�y��ϢB"��Q��k4����t|�ߵ����U��Ox@n��@_�aj/��Ƴ�_ F��C�]�+X�#�rZ�&��6�st�� }��}r]a����D���cO�5U?h˾��/�i*���R��g�DQ�Ӎ�5T�;��7�)�o- �+�����b)��A�r8&���b������.�.���y�%dI�k�7mU�$i꾢�Y�&(Bw�Q�1:�s8�F��GvE]�0OR|�Ϝb����7EѐUיJ�7����ؕ*4{�3|F<P!�oƘ4����T�kS_NЧhY^r�?�KZ��7���z}���9_.�1Rk�C������㋣��E�!����`�o�oiad{�`b=�YoA�v�XC��g�P,�,~J&7os�q����Ul>P�m�'�� �aJ����;(�P���A�˨uy���JI�J�J}S3�#o�^EGE$��,�rv ώ�Aq&���c���*�3����i�1����v�6.I_M}�f*qE^������d��M�T+D�9r��S� V�ȉt��:�P����e���9l������GѮ�}*Dǩ�ͮ4����n�%P'�S�"�d�D�78�_2B`)��,* z`�O��Di�t�O�[���XA�$�\���^�kGj*E����δ!�%֑���?�F�7�en�o�0�$j%b;X|��B�f��$f�����t*!� �MY�������؞�b{:Y���]z��:c���Q�vX-��� @�+�F����j���ޗ��l2P)<����9�u;4�A��s��x�x��_%�����Cq<��g]�g�Y��0��x���Ҵ~�k� foV�ϗ�1)y���5��Ki���2���������_Lx�w�F��Đ��~�����-���*ş���.6$t�Yp��#Y�:��d���f��#1� X����Eb��R�`�k)��r2P��O�����jk ��g���&�ڈ� ��]-G�[����ɕ/����dN%��î�f"P5F��_X����k}��i��R�����@ь�JbH�QX�6�LbU�6�*����4b�@z��Qj1��Q����Phw]��:\|�����47��L��k<ԗ��C�M�Q��^.�3%����.��:F��Lm�٪��v�V]/�p�5_�o/~ܬM�5t,�c�3\���~M����6��{�R�Z[2K��v����y�������9m��T�����,��r��1e|���?�m�{`=�;���һ�}*�ڱĒn��ʇ��N#�ۙ�<B��%��Q����U�(�/u������x�#�B�8���~ax�D�����Q�b�q�t�j���z0�Q����>�]� ��j��!�Y�3�����|�\�и+¬�u�]���'����"'M[�^� i<m��ܫI�M�3�v�T�Ɖ̝e��.�ؒH/�+��Юо2�t��u�-qi�/����P=��h�-���N���=X�k������)��k�����Sӊ���P���!��C�#����`����4^4m��Ǒ�Ɖ����bɡq�yn�zR��_���WJ�����m����[�w5M�Y£Y�#�}ݼ��)s?�a��M ��"V�t���f �1SO ���N���W�m�����Z�,d���ݛ�C�|iA������-�PC=r��m���`����?��-�Ng�gʋ{�.��H�i����TWMJ���h�C��&I~WW�Sp����S=�5�f_���Zk��wግ*Q����ѵ-�`��z�Q�s-�yV���J��s)i���#M�����W��j�}�)1��I�+4M�������y�$����k�C������ T0T��1Ϟ�1vѩ��˼[ƃ��Hy�Li���4��0��*Grx���,����}@=U�u�K��@�ś;3�R*�ÓTf��Ԟ��t�PW��~(H� o#�GL@狭�.R.�(����%`;�.9��BE^}�a�f'��qe���z�J �n���
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ