Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
46dfc75901ed2a959e1a1b87226cd35c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
46dfc75901ed2a959e1a1b87226cd35c.exe
Resource
win10v2004-20231215-en
Target
46dfc75901ed2a959e1a1b87226cd35c
Size
12.3MB
MD5
46dfc75901ed2a959e1a1b87226cd35c
SHA1
09bb42b01803d67e0ced3d0d1d8fca9d91d01786
SHA256
be015fb2f827749587ab950f6b81736b8e780c10a915b83c41e1abea4a484815
SHA512
30eb794a014c424136700e89026549e8bc307b5242e6b448908e75a896808f6960acbb3e06ff15bf1a7103f448b3977d89c0ff21189f62d487b2a48085e70fd0
SSDEEP
393216:LH1NPviuaO3KEsUFP2Se9fjK4RZuC38H2wWgNcdAp:r1NPtDxxdRe9LK4RkC8/3NkAp
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
midiStreamOut
WSACleanup
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
SetWindowRgn
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
GetViewportExtEx
OpenPrinterA
RegQueryValueExA
ShellExecuteA
CLSIDFromString
LoadTypeLi
ord17
ChooseColorA
WTSSendMessageW
��x��&徎��b�=:���aS�.��J����'� �F��ۃ��)W�]��swy��Es �Z�h,����s�*I7�����z����:�^W���֩�� �g���sw��F��M�iDM{mB �慹p�P��I��S��Whx�*��������B�JS��@�#;3�#b����6,X6%�G��*��s�� >]e����K��i�����a����;����j���EAݏo���g�-��@m_1ãTI�чx��i��P�л#f�>&�0�<�#�b�����3�P5B ՚��^��#�м���U��K֝Q��j3�~}�-�j<J �v�CFT��/",t48��N�rS"�l��%��%!��J<�)�������AF������^b����f=#�pM���G��vCztzH�-E�O��c�@�Bt�|)�& ��/�~H���5���7�uz|R�&N{q�W�=Y����| ����pE���k1�,o�V8$,�D�������]���Vޱ�(����� 0�n3�)�'aJ10�|A&-ʐ�U+ӵ?���a6�l;��M�~V]�.u��"+��iK��u3V�Ŝ&�{�z �gRS]�>�w�9�<Z8!$�u�U��A��6�!��J�ہ���Sc���7��U������iv�8�Ż��$5ѺvyM��6-o�c�|��s({W���i�d���,���Q�=Gϫ5F����Բ²bj �.m @\�:o �0L�3�� ��:�1�D�I�Hl�>7O���^��V����"(���B'%vI�솋���� %0M�Vd:��-�,��KDn�]__ղ�T>@Z:�W% ��F39&�s�/���,��5Sn�����sd�7��@��__[M\��h�IA-���$�7S�<�g)V��~�w=��rs�ˌV.@� �ɖh�0U�A~�a$�j���N�}�՟e��kkRz���8ө�B�~��9^�y�w�ell�)eEKiQ�]s���i4b'Rg5��'�L���Mb�Zp�8���dSG>����`F��>��-ϕ���R7ߘ���Lh�g�M�����X,�جه�Oz2����tAW�w���u��s��_l�Ğ��� /~�0|�Q�� �!?��gg�B�$[�ce����Z��08���N$�@>�i�`ee�v���/�Ov_�ާ���?�/+�8)�ǰI�W �O�"��@��� #�+��@��1�h�M���X��f����@����� ��|�;}�>X�������P�G5Y��0f�����O��:�WT��4*�M����6˹�u�P�X��'^����J��G������s�����;��a61_�&�+���?t[���SY-�_�ӗ�#}߬ؑ�.$J��y�������ut�0D��B!t*��������y�?����+U>_��f�d��ܹ[��֛��Y��:�]���U�d���h��j^"����z�Ο���N�0"����}jnt�*����2c�k�ή���7�G�xMg������o�v���Ip����=*�����IaVz���^qO��X�l�.����9�|k o�-7T. ��<{w���KCv�z0��]9�8����}�ȕ�UWٱ�18X�v1�^A@�@� 3D�)v�,Z� ��ا��!��b�YT�XJ/�J�� ���3#5�agK�m�$��/]�ܯ��� g�o`�� �6E�s� �z�c�i�����G�t��4#]�z�O[5�|k��#Կ�U ��<:r�����,1�G�˨&dtXBS�R@Ħ�'V�{~�Y�։�k>A�9]��I����$��g�=q�q���ą<Z����`S{?�2o~���SWy ��.5WEApd���O�#��<�k�_��cw�n�P:lb����+�5Q}6����0fV�(�i�����Wz?�P��sw���P�������[���]Q>8{=��z?��G�:F�ֶ4��\3���;�5 EF!8s�c���uF�}d��+��+Ԃ�xY>��#��\�R�֜v��v��Õ�9_�4��j{ �<�Wۑ�� ���/k`�k��$�8�?ۉ!��@� R�yh�ql���[A.��������n� �\"&oC^$ĢB ���#~w��JF��q���o���҇� O�b�h3#�iM��:D���5�8m��A��D��s��HC:���5���]bln�F��&�n��,G�A�fe@�G.�f4��ݞ��������%zaU/���@��X�;�}�אY.V=��{� y̬F��z ���T��˛;��ugK�;a죳� �TzǪL�iŮL����]�Z��o{���f�|le���O�/�P��GS����xtS���˿�ظ~<�}6i[����{�����r�t�5�_�Y��M���@�X�ߑ��k���Q�T�.��{�("����yl}��Pn��<<onC��9��Vb"�ړ��Z��1�*1|�9����?�D*�ԜI��[d�X����6Zu�aF�����*�f�G���f6B���p����8|H�+�o�&��տVl���-��FH��*����`��z�i�E�Z��U �2!7G���t#�W��E�[���$�g�3&��A�;d����́�pc���f!� ���Q��Mc-+��B�D4Q����iv~�~��րA@Mg�/��S���=��Å��9b��`*c� 40��&��z�q�ik'2|��n{/�¹�� ��!�,kHĜInE�'(|���$D&ms�Z�_h���t&W��rJwX@��D��[^�lyO��[�~�x�.������5���#�=��ݪ�.�P�{���.Bt�^�a��Z�N�,N&-c�Q�@��u�9�j�״�ξ����s}�A^�J ���|%���*Rzp�I�3`��}�vkĿn��A�Z�����h�!K��� 䉂������#%�,c�C x����mZh��s���WW�"�|_+��&K��W�@��Ã���-� �1>뤢�<�g���Jˬb��Rf�He^�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ