Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
8d4026927e63b4f57f0cf29c9b533eae.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8d4026927e63b4f57f0cf29c9b533eae.exe
Resource
win10v2004-20231215-en
Target
8d4026927e63b4f57f0cf29c9b533eae
Size
12.3MB
MD5
8d4026927e63b4f57f0cf29c9b533eae
SHA1
f4cf91a6416fb107e18df48b467ed188ad058db9
SHA256
069ff67f9dd8ce03ffe71958852da3cfd59adbb5d5094f499d155f9e7b61d62d
SHA512
5c3fb03e3e566936d173fe3912e9c01003cb1cb635d0b4d6dc34ce29d3a865016d759a25a8bc4e39d75746f1ec70fc42c80894cb598dac057dc0597f750d20fe
SSDEEP
393216:uoJcTniUayxkDMBswCdv2IxqT3exAICSIO1:9+TniURGYwRYD2
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
midiStreamOut
WSACleanup
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
SetWindowRgn
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
GetViewportExtEx
OpenPrinterA
RegQueryValueExA
ShellExecuteA
CLSIDFromString
LoadTypeLi
ord17
ChooseColorA
WTSSendMessageW
�����_����p̤�������A7��2��駢q�0w�=���VG��'�їf�L�%]@�{c<�M����I��6.OC� �F&~䖃�`���O�ukjUr���r�.\� c���ȗ��-���7|���:�G��I�ೠ�x��]�A��ROs^eP�Mw��B�֑R}�ڞ����l*{��Cҳz����6/P~����0�HS��v��9�tT�r��J>d�Dh�JyG�$S/ϸ�������H7��"�H��7Y���\0��T|2��h�I!8���7~'�z =?�s����ʟ�w ���$�$�A������I������f�@,�d�2�eG�/J.�%m���:�����WA��9T���Uz���c,ك[F�X�ݬ����VM���V�P�w>\b�0�\n��w�j�2y����!��S�b~��6�L�j�~�ȳ�m��.��v��xr��PVb��S{]�RN �)[lI.���� ��B$��k�l��sL���7�����i��*qB̸۫�r��� A���p��#!s���\��;���Gs��ۣ�l�{h���mj��N'@��ʘ�q�`�1��BE�|�D�ъU�м)m��Q�1�2�fL� ~���*0kS �k�q9�$MYg��F�nTߝ� ��4�M�q��6,z��F��;;�Nnd�v���1ou2�k�׳̒��v-?�R'�V^��@��_ձj z�*���x(�F�������c�C��M~�)�rwD��Ma��1~y��'�>�>��`z��d����0���he=���V���(�N��gw"Kl�<�����\�F��:��߶�:,@��*C��uõC��|�L�e�S�{��$��տ���N���G�Q .9RF�������������?͝��\�Pq�5CLI�%���P~��$Yd:<�(���r3���.��(f1>4M�a�>?֨��'>]���-�"�9^K�5K��K�X>�DDž̴5�>�i�ԯ��/e�_A����ѽ��Y�L��ό���p�������5�^�F�!�ief:�@X�l��EZ[jv,3¤�����u/h�1D4Ɨ3vrS�[��k��g�rD��������8}���z�[��W'U#dB ��Gݵ~yw)Z��n��Qd����#�v�ѱ�t�{gz�����G�]�jR�dKaEN}'�q�a�L�Lvx�U%W�`���/[u��#����pd���A��(� }���Fǐv�8��3��j8�����4�i��ˠp��-��X�'�~uO�d�DD%���>v�!3IÑW�?�,�<�z���I��F뾎8h2_'���i՚U�D:�0/�KoKm}���:�6���W1H����x�)[�Ϗ�� @�t�U0w�t8Z��VR2�a�Y�]�F� � ��9�&I��tY��~�L�0y�-'-�dX���ƶ���3va-��OAy�/_K�n�ِ&O�c�p�>�y��P~O?-�y)���� ���M.cx�U?��@3-�2˞������BI3Z ό8��D;���>�MK{Jq`ʉ���~���9;��h,!4Q�L�a)A�A�/!C˛�$�;��`�K7�O��*�C��unw�~y�C�z�ٜnfJ�[��3�� �_<�х�Z��l�����RR _5�E�����-E��'� �<���5O;���c*���b�#g'fA� �C8���&��M��R�� VD���ib�6�팅.��=�����O�6���q&C<��Jk��3V\9v���=���z)*�?�Y�yP�y��hxv��JR�u�ԇ/Y��cqpŰJd@��2o� ū%X�[�����h�"��F�|w#����S:�B�!͎�r�Q�����܌�kr-��M�$_��Q�߯�����NE�&�.��y� ��QK�ʤJZ,i�پ*ok�8�Ӄ�GVi�:<��Pr:�o.��D����}�)&o���b�[8��|�BI�z'3�C����,�Izt��]���l��a#���@d��3�S��x�uIv։z���OT����8�l6�wQ��gH�Y?+p��^�}�Yw ���_�!�Kg`�|h�a}�%$D�4jr��_�cI��Hi �w8ڙ��bK�38ֵY���~��v1 �F'2=���0a�>!��RF-pӄ)�Y)�[�f~F��i\g�i��7R������9�ɉ�A���T�&, �<�q5q��)��I0�̂�A�?~<z��l7����J����~SUtz�R�Ye�[��_']�5�E���RY~���[��{$�&aQrq��ƵyT=y��Vp��Z�}0b)�M�^I}�0%iH�<s�����-�����q_�;ܼ��b���f*�*�}�w���Ű����\C � ��~ �(R/*`�Gn}8����k:����k�Y��`��ԈQRt9��q`��"��6����l��`�<С,�c_��r��C(=��r�w���B��h��jG�Tw��PS�~[C�<̮�c>8��y�6��m��!����l�]8��z_;��xvH~�;re*����Y�g�$5<m- �%�s�������P�~A�/x�\��9:���sp�6$&�aug�}�L h7-b�Nn9ރ��"h�wMk@T-8,��^���y"D,������bL'}n��eߟcV�htP��oC�/8=!��z�fa|$$�?vr���i\��JX�P�/5vO|Zo�S _���m6�f���� �fI����vE,�g%w�-F2�����L�7�Jh���뚛,>��S-N/� ݃ jI��M*�tH<qU?�� ��.���m�����=_f���{�[�%�q��;���xb�����^z]5��%��j��m�mݤHY6_>���ƈV��P(c�`���j��p ����$���ڔ��]b[⌷E�PH ����S���e�N�>� �J�!�A^5 �R�V8���̞=��N+U�`����&ˊ��E*��QW��o1�L)I|��l�\��#���)�e���ԯ�F[v�<r�����_�<���N|%T��@���{]1�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ