Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
489d2d94213d2e53648c4c7f7ee62cec.exe
Resource
win7-20231215-en
Target
489d2d94213d2e53648c4c7f7ee62cec
Size
6.3MB
MD5
489d2d94213d2e53648c4c7f7ee62cec
SHA1
c511f25ce0b6c7fef385c3ef58318675d8daee54
SHA256
ad6ad8f82f663e64855ebd538845cf3582dbcb170cb258882389e5993fd5aac6
SHA512
284b9832e6f6b7cf209d8d3491eda481ca84d9941a6c010cd0280eb4cabdb44866d899b60c10edf2ca6ac29432e32d5e5bfd67b4665c2298b027b6f3df1914e6
SSDEEP
98304:8yWH3bdOFwnHSXtUNI35D8wTzm7rY3ezN/63f4H4kg0hljXxFKh:PqnrNw8wTzyrY3S4SxhlDqh
resource | yara_rule |
---|---|
sample | vmprotect |
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
WSAStartup
GetAdaptersAddresses
GetUserProfileDirectoryW
CertFreeCertificateContext
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetSystemMetrics
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
SHGetSpecialFolderPathA
OpenProcessToken
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
BCryptGenRandom
__current_exception_context
__CxxFrameHandler4
_crt_atexit
nan
_callnewh
strcmp
_wfopen
localeconv
getenv
_time64
atof
_byteswap_uint64
_mkdir
WTSSendMessageW
q�N-Ը@�<�P���,��?�Weʾ+� �N̵���B��O�An��;�"�EQ�b��؉���@�+7ۙ ̨���ۙ�����A!6�MK��~�dͳ�|6�� �jxV�45:�v��r�kp9����q��b�iBhl������ �y��`�i�T�'Q�Nt4�j�ީ�t݇ȝn���z�!����*z}�pEgv-�3*#4~���]�:p�G�R�-�s渾v���*7�>@ Q$t���P����G �X;u;w1:)�t�Q�F2W���OzԣZ )֯�|�L���};a�W�z�ߒbG�,Q;��/<t�OǤ�k��w�~��h`u������{mʉ��Z��� bw�t �a��%~���+�W�����{���,�G2��H���07Z ĕ���oM�Dk�[�M YZ<�c��k�03�<��?�>W>���+I���IRl`њ�^ �+-YmL~���ga��R՚�.s1������6L=3xmI��z���t�'v�����bPH�w=��A8��!%��r���%A���<��Fu-t��Z�]��V�AF �Ip}A{��v$��_j��+kT��I���$:�$�[~)�������E�S�S�AW�z^XK���շ���^��Q�Fi�;@�<�<��h=�Z`�p��O�1r�O���|�#<ZGׅ�j+=EG�~�Ҍ[���q����tfd�b�{n�n@7rl�dw+�a^|�(h���#��&��S�f,n��F�Q�O��5v����y5��ᣨw 7V?Y'�UR�|%�S�WV���R5 ��V���_L�6B�z&�7L�����d��$�e�ES��G���A���n��l�:���A��U�9�6i6�LАk�s��c�SG1���E��e�c8��%�"q��#tp����'�Qj��Vc��~��^ <��)<!�.�LE��aX�Ǚ�,IK�{��(Gi�C�*�Y��c�^���q�X��1-��?g�?� �9��dok����7/w-����N�� {�X�c�A�g �0�hG�'D��)���'8u�O��M �#_\Bj�ƌ���\����ڥ=����?չM��,��>n4�#�����F~� -͓ud��LS��CϷFŎ��<V�.Wf��+��c�7`�����Ɣ!/i�J|�����A[Q�Ab�y�k/�k +������ȉ��&N�l��C�|3���ΐ'�;�����w����O�-�`MGqվD7Qd��d�nDv�������(�ܞ�ѵ|��\u»��0$ͧ12i��",-0.�k�-�����W. ��c����7��k�&��A��*��� yp�h�w` ?*�q�Ӯa1�I��1��ǽ�T����D�0�T�P�5!������F3�f��31�ɝ���K~t|��kͤ&،u?Π*�K'���ߓTN��L���T��˷�z�. �_�̆?A��J������g��uL�Հ��?k��o�]�uҴ?�BD%��0g�Y&7����i�0��L`}b���3�K��L��PBN� Q�K��0�ܣ=}�~����_�Gv*���Br�����a]'<�u�P�Gg�����7k����ؽ��U:S*���B 8�A5^�� �wí&�=����kD�DŽ�n��)���ϫ��� ���@�F蕜�=�����^R��@9�EW��.Y�)�*��E� <:�z6���xvZ��f�J)� C�� ���,�[>��n�}�*ʥV�7��&��Ân?�s�<"(j�@�%��L�m�I��Sz��8��?�Oe*5�zj�4�~��`&�"��as����'S�J���[�3m��̴�q`�����eNh�[z��5�;��A�q�?�8�7¹���Do���}wWg I��km�j�WWW���Zo�b���~ŗ���(��J{�/����?;�i5�ҁD��2�F~���l�z����Xr�Ng��Wڣ-�v�NIi�βE'_�D�_i[k�\y��ɵ ��g�J�g�s��5��� �q������P]�/7gc-���F~��nL\�kpl���X���9%�+�+�W�X�fO'��<����R�G��t��9bq�YDU�oH���n�a�³3�@�Cw�r<�5���k�t[������L�{K�"��rkj&��}!M��jL6��n �}g�f��0Ž�cJhK�u_ Y����qNI5�DŽ��Q�r�����o�-��]^�y,�Aդ!� �3��C�3��S�(�p��)�~���a@��,~���M��u�O�����RT�2�Rk�(Y�y� �wϵ�1�n�w��I�c�?��!��g�\k�mE-�N1��g'�j��&�gG��9��l��D-u�/��B 2�iS�[���1��Z\$8�<#[>�p:��=&I:�����Bg47����MP��ԥN����w�>SL�o���8?v�W8`��H�Ww�Z��&�%dd��HE�c82F�%�c���d<I3�{\�i2dF@E���} :u��~U�~Z����R��;��CL����<R����}�U�Q��.Y����i.c:��[ �E�Im6��ґͮ�P�)�I�t�5G�倆�w�!wQ��dC�1����U�z�����,��%����2*�� �J�<�P�,Vf�o��l'Z���Uv �&�(�m'��Zo�d�ψg6"Q�4�������e6P47��GBk^O��E+�Oa�;�Ҟ*��1h���K����ot��{�V~��sE��(������T���G9��k���/�w�{�-hT>83���<2 ��5�Z�U��D�E�N!������B���<�F2/<���4��@�� Q�~ʈ��WͰ�����p,CZ�=��~# $BW�O� ���M7h�k{��T*�Ѫ�E�;���e�g7y���AK�����K����%�J��+���xk*�x|T=��:e)�x-?P���1�gj �e��V���[{2�����1�!iLx a���P̽�$��I����GLAЪі�nʕ�,Aށ*�S��`i��w�+�N1C-��ސ�z��z�l#�VR������AУ���r��&D����<T�5a�Hx��L:^C�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ