Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
23-01-2024 19:43
240123-yffw1sgbck 10Behavioral task
behavioral1
Sample
aa.exe
Resource
win10v2004-20231222-en
Target
aa.exe
Size
651KB
MD5
b730e7b8f3eebd51dc21d7997313b890
SHA1
57ef7a2d07f3703f84c1d7ad33e34e550d23a6fa
SHA256
e4a87095c27219afe9c7a3cb01c13de899e201d2340748a5fc446207c8f99b2a
SHA512
05e87e0ac0e6c097cec3e3801c66752f1a69bd3f8b732062b16596fd4e46388e66eb2e4455ede69769dad62cb7a063849cc2199c140c6ba6a498173eaafe051d
SSDEEP
12288:caA9OKLSwaIN5U8xvFoRQMEoO2rx8ikfRtjIe9rtv8zl6mi/gQ:AkK+waI8JRQMEJ2rufRtse9rtv8zlBi3
Processes:
resource | yara_rule |
---|---|
sample | family_ammyyadmin |
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
WSAGetLastError
send
recv
shutdown
__WSAFDIsSet
accept
bind
listen
ioctlsocket
getservbyport
ntohs
gethostbyaddr
gethostbyname
getservbyname
htonl
inet_ntoa
inet_addr
socket
htons
connect
setsockopt
WSAIoctl
WSACleanup
WSAStartup
select
closesocket
SetPixelV
GetSystemPaletteEntries
GetDIBits
GdiFlush
CombineRgn
CreateRectRgnIndirect
GetRegionData
SetStretchBltMode
CreateFontIndirectA
DPtoLP
GetDeviceCaps
GetStockObject
SetBkMode
SetBitmapBits
CreateDIBSection
DeleteDC
SetBrushOrgEx
StretchBlt
BitBlt
UpdateColors
SelectPalette
RealizePalette
CreateCompatibleBitmap
CreatePalette
CreateRectRgn
SelectClipRgn
SetBkColor
ExtTextOutA
GetBitmapBits
GetObjectA
SelectObject
SetTextColor
DeleteObject
CreateCompatibleDC
FindWindowA
VkKeyScanExA
MapVirtualKeyA
GetIconInfo
SendMessageTimeoutA
SystemParametersInfoW
IntersectRect
EqualRect
OpenInputDesktop
GetUserObjectInformationA
DefWindowProcA
IsWindowVisible
EmptyClipboard
SetClipboardData
DrawIconEx
RegisterClassExA
OpenDesktopA
EnumDesktopWindows
CloseDesktop
GetDesktopWindow
MsgWaitForMultipleObjects
PeekMessageA
mouse_event
GetThreadDesktop
GetMessageA
SetTimer
MessageBoxA
wsprintfA
SetDlgItemTextA
ReleaseDC
SetThreadDesktop
keybd_event
GetCursorInfo
IsDialogMessageA
SetDlgItemInt
TranslateMessage
DispatchMessageA
GetKeyboardState
ToAsciiEx
LoadKeyboardLayoutA
DestroyAcceleratorTable
TranslateAcceleratorA
GetDC
SetDlgItemTextW
GetDlgItem
EnableWindow
EndDialog
LoadImageA
GetSubMenu
GetMenu
SetWindowLongA
CreateAcceleratorTableA
wsprintfW
ReleaseCapture
SetCapture
MoveWindow
GetAsyncKeyState
RegisterClassExW
DestroyCursor
MessageBeep
MessageBoxW
GetCursorPos
SetCursorPos
GetSystemMetrics
GetClipboardOwner
OpenClipboard
GetClipboardData
CloseClipboard
SetScrollInfo
GetFocus
GetWindow
WindowFromPoint
ScreenToClient
SetClassLongW
ChangeClipboardChain
PostQuitMessage
EnumWindows
GetClassNameA
GetWindowTextA
KillTimer
GetWindowLongW
SetRect
SetWindowPos
ShowScrollBar
IsIconic
ScrollWindowEx
SystemParametersInfoA
AdjustWindowRectEx
GetMenuState
GetWindowRect
GetWindowPlacement
SetWindowPlacement
GetSysColorBrush
RegisterClassW
DrawMenuBar
SetClipboardViewer
DrawTextA
DialogBoxIndirectParamA
DialogBoxParamA
CallWindowProcW
CallWindowProcA
DefWindowProcW
SetWindowLongW
IsWindowUnicode
GetSystemMenu
RedrawWindow
UpdateWindow
InvalidateRect
SendMessageW
CreateWindowExW
DrawStateA
DrawEdge
IsWindow
GetParent
DestroyWindow
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
SetActiveWindow
SetCursor
LoadCursorA
DestroyIcon
PostThreadMessageA
GetSysColor
CreateWindowExA
BeginPaint
EndPaint
PostMessageA
LoadIconA
GetKeyState
GetDlgItemInt
SendDlgItemMessageA
SetWindowTextW
SetMenuItemInfoW
GetMenuItemID
EnableMenuItem
GetMenuItemCount
CheckMenuItem
SetForegroundWindow
SetFocus
AppendMenuA
SetWindowTextA
ShowWindow
GetClientRect
SendMessageA
GetWindowLongA
ShellExecuteA
ShellExecuteExW
SHGetFileInfoW
SHGetFolderPathW
SHGetSpecialFolderPathW
Shell_NotifyIconA
_strnicmp
_strlwr
__CxxFrameHandler
strlen
isspace
memchr
_errno
strtol
isdigit
strstr
memcpy
??2@YAPAXI@Z
_purecall
_stricmp
_CxxThrowException
atol
memset
atoi
abs
sprintf
wcscmp
swprintf
wcscpy
_wtol
strcpy
iswspace
wcsncmp
wcslen
_wtoi
_ultow
wcschr
memcmp
strncpy
strchr
strcat
free
strtoul
calloc
strcmp
_ftol
wcsncpy
wcsrchr
vsprintf
vswprintf
memmove
strrchr
strncmp
mbstowcs
iswdigit
_beginthreadex
sscanf
_endthreadex
_i64tow
malloc
wcscat
time
srand
rand
exit
fprintf
_iob
getenv
floor
printf
realloc
fputc
_CIpow
_CIacos
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler3
?terminate@@YAXXZ
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_wcsrev
_wcsicmp
QuerySecurityPackageInfoA
FreeCredentialsHandle
InitializeSecurityContextA
AcquireCredentialsHandleA
FreeContextBuffer
CompleteAuthToken
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList
SetupDiClassGuidsFromNameA
ConvertSidToStringSidA
GetTokenInformation
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
FreeSid
SetFileSecurityW
SetSecurityDescriptorDacl
SetEntriesInAclA
AllocateAndInitializeSid
ImpersonateLoggedOnUser
RevertToSelf
GetUserNameA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerExA
SetServiceStatus
SetTokenInformation
DuplicateTokenEx
CreateProcessAsUserW
QueryServiceStatus
CloseServiceHandle
OpenServiceA
OpenSCManagerA
CreateServiceW
DeleteService
ControlService
StartServiceA
RegCreateKeyExA
RegQueryValueExW
RegSetValueExW
RegSetValueExA
RegDeleteKeyA
InitializeSecurityDescriptor
GetOpenFileNameW
GetSaveFileNameW
LoadUserProfileA
UnloadUserProfile
CreateToolbarEx
ImageList_Draw
ImageList_Add
ImageList_Create
ord17
ImageList_GetIconSize
ImageList_ReplaceIcon
ImageList_Destroy
_TrackMouseEvent
CreatePropertySheetPageW
PropertySheetW
HttpSendRequestA
HttpQueryInfoA
InternetConnectA
InternetSetOptionA
InternetCloseHandle
InternetReadFile
InternetOpenA
HttpOpenRequestA
ord7
ord6
ord2
ord1
FindResourceExA
SizeofResource
LoadResource
LockResource
GetLocalTime
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ResetEvent
SetEvent
OpenEventA
CreateEventA
ExitProcess
SetUnhandledExceptionFilter
CompareFileTime
QueryPerformanceFrequency
GetSystemDirectoryW
lstrcatW
LoadLibraryW
WaitNamedPipeW
ReadFile
SetLastError
GetExitCodeProcess
BeginUpdateResourceW
QueryPerformanceCounter
UpdateResourceA
TerminateProcess
CreateMutexA
Sleep
GetSystemDirectoryA
OpenProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
LoadLibraryA
FreeLibrary
GetFileSize
SetFilePointer
WriteFile
WaitForSingleObject
CreateThread
GetStartupInfoW
CreateProcessW
GetVersion
MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameW
LocalAlloc
GetExitCodeThread
SystemTimeToFileTime
MoveFileW
DeleteFileW
GetTempPathW
CreateFileW
FindFirstFileW
FindClose
GetUserDefaultUILanguage
GetModuleHandleA
GetProcAddress
GetLocaleInfoA
CreateFileA
DeviceIoControl
CreateDirectoryW
SetCurrentDirectoryW
SetProcessShutdownParameters
GetVersionExA
GetCurrentProcess
GetLastError
CloseHandle
LocalFree
GetCurrentThreadId
GetCurrentProcessId
GetTickCount
InterlockedIncrement
InterlockedDecrement
lstrlenA
lstrlenW
GlobalUnlock
GlobalLock
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileSizeEx
SetEndOfFile
SetFilePointerEx
GetComputerNameA
GlobalAlloc
GetDriveTypeW
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
GetLogicalDrives
GetFileTime
SetFileTime
GlobalFree
CreateDirectoryA
IsBadReadPtr
lstrcmpA
LocalFileTimeToFileTime
EndUpdateResourceW
lstrcpyA
GetCurrentDirectoryA
FindResourceA
DuplicateHandle
ReleaseSemaphore
CreateSemaphoreA
SetThreadPriority
TlsSetValue
GetCurrentThread
TlsAlloc
ResumeThread
TlsGetValue
InterlockedExchange
GetStartupInfoA
GetSystemTimeAsFileTime
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ