Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
4f6c85b1fe3b69d8e187779ed68f38e1.exe
Resource
win7-20231215-en
Target
4f6c85b1fe3b69d8e187779ed68f38e1.exe
Size
3.9MB
MD5
4f6c85b1fe3b69d8e187779ed68f38e1
SHA1
51bf48b1dc262a36a48243ec422a67aa7389b042
SHA256
b852a910668d96c99c4871a22e8f12f83c120949e2db5a2daf4123dff6929553
SHA512
4e78ae142fc65b11cef6443ff9523cb05bd65e50ddd4272d6dd0edbfddee886fd71b05157dd8361004cd0e8a65a89b8a3b7944723b965dbd75cb9045f2d24976
SSDEEP
98304:QeXhev9Pmf3br2A1qwd59GORXnXbA4suHSIB:3Xi9Pmf32RwXwAXchuyG
resource | yara_rule |
---|---|
sample | family_zgrat_v1 |
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource | yara_rule |
---|---|
sample | net_reactor |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
_CorExeMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ