Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
96eadce31407009cad28494f2715c2aa.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
96eadce31407009cad28494f2715c2aa.exe
Resource
win10v2004-20231222-en
Target
96eadce31407009cad28494f2715c2aa
Size
12.3MB
MD5
96eadce31407009cad28494f2715c2aa
SHA1
d23069e212e6977b7e54bcf5f1dc1414375c4c55
SHA256
1963c3f0514fd294d1a188a3c5c8fca4ec3d070046b45d6ac1b2c807a095c1cd
SHA512
7b21a594748021bf4b3f4c3f8ab747362ccba425905bdc2da83166d2f42c394d6b811a443c069bc52388cc23d2abc5c42eccfa2b87d36787487d39251dcad72c
SSDEEP
393216:Y+yuU7YnTQvO+f21w/9BWnjmt6TF998+P/0ZlKUoP8I/Bx:82TQv+wyjd/9bOij//
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
midiStreamOut
WSACleanup
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
SetWindowRgn
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
GetViewportExtEx
OpenPrinterA
RegQueryValueExA
ShellExecuteA
CLSIDFromString
LoadTypeLi
ord17
ChooseColorA
WTSSendMessageW
����#�dc�*��{��F���5(����N:��TC(�ʾ�ČW��f���L6:q�2Q�OQ;��Fg�s���h����Q�Kz'K�v�L�؉ZzU}������\�/ ��V�*�c��D���D�Ƨ4�NÞ�j��� �4嬤�����`����x�'lW��C��oQ���w�<Wt7�n�{y^���ƙ%[5_\V�W'z&!ƚqB�� y�~ b�y^�?4��d2s`�������D����1Id��qǹn�]/�¸7|B��Mހ��|BPP���F��˓9��Uڷl�w��j��Cs�f��-�F+�g��nI�m9�,�{Ĕ �GO�M�E4�U�q��v�BD}7�����Mi�}������o��y�� �>?ǂ���Λ�kޝ��=5���%��m�n���������ۛ��ws�PIq�^6�k�2��]��KyR���dȦ��j+���sR!�y���:���rΎu;Ua ����̐�i��A�X'�(�4���ۘ��w�NhWo���Aٍ��4P.l�vRO���F��m�U/�kR5��rfy�~d�����$����I�)'Y"�N���n���R�/_.�li����![�?U]���1��Zw�<C��"BЊU�.q�����L��w���Xۼs���R�1���:\{L�;��g����������*s'u�M$�?�!ٞyУ��1�w^��x���٬��¦S�Sb��:�GE�w�[�(������'9�ph����'0���i-G���7y%a��˻)l�����xeVS7W�D��������a�=p=�����]u�U���b]��vx�$p���5������g�W@�̼���e&ߜ���ː��2[����t�5���aS4�l�B��s�g&t9+gQ���p��Dʴ���}Xh�.��U��a��rX��F�&���#�O����.�Q=I�j!m4�N��z���Љ�J |o���{j��?iJ!�p-wo@76ą���a,��od���"��7�&+��@�@��5�Y�H���4%��C �V O��Y�i3������[O���o�R�I�_i~�����3��Vx�i�K���� ��(T[d�.��^��b���,��n��&�rt�R�L��PN�Z�UK`v��|���bĔ�m;Z�_I�������Br��m8k��!Y_GK�rUy�W�c@o@��ݰ��t�F!&>����A���@��5N���N!_9r"�ra��qG %�;T�\?Ȣ��pHl��pR|��E����c�m��J��4��ps��Dx�^�Z�M��H�MA���L秤�x���Z< os�N$8����b,s�1 ��5����C�I��8i��e�K2d�'e#� ��@����<�m��]�U�����ȟ�%ŝ��8���$4�X�����Ի�3�X��9�����|h���Ўn�>��X�QT?U3�s럡������/|؍h�&�)g���H����.��.<�̶��m�(=�t]��f80�c<��l։eQ=�h`�sF�!�[~_9o�y���-�_ ����$�0'd�%���%/���A�E%H��A��>[�9sQ� ������AC���}@yB%�狉�$����}��G��N)�� ˜sI�A�A�P��`[T�'�S&l5�̍e2��7�D�e�DX�z��� 2�\L�z+Q)�� |��@���j�t� ���2q+@�mQ��S;���]�W2�q�g�2����j?�]��b@��.��/���C��&�(�f�4-�ɗ��Ћ�+���Zq]���j���Z�j��+#r(1��S�vwtT����ώ��;Pu9�&��NЕ��<.��[�g�&���yXV���8Y�m��Թ��d�k:��0��&58����R��;�z����y�nH��^m��,��'<6y������K{� ���f���4�DZԉ���Ї��R��].k�3��"*%B�2������u鏨8��S��R�|T�=�]���^@����HNE��K�Ä���M>�KQ}���`a��\g�Ww>��SK'u%:�'+H �P�j8˽`'I�`8a�CjlQƙ����o3��=w��l(� �'��:�i��ty���=�]��^p�]}R�E!+n5~m�Y�m�{�%و����ɼ�M�aC��M�q�n����$<]�]��u�7X�����B\�����m����!E�YY��{0����S3�~���ܵ�}z5>�W��U�#g��9�d<ֽ_T*�ȿ���V��s�ּ���" w<�����*v� ���?[����$I�?� ྤ�O���xm��1�����e���d��AL��g����W~�Q@i7�����R�z�����ua�r��B�h�+��+-v��,��(�V~A���a���zP��k�� T�=oX�8��K��ih�P����ܵ#���������QOsX�$�/[U5�l��N9��x�A���v�V�����~��^*�x�1�%�H�5�& �����U���ٕF�.0�*���=3{�^Å����1�zX��O��z_K�D�~7��,I�᠙-�%�5��j�${�������Ra u"��Qh&�P����V��J�I�ѽ�c֓j�Uޅ��X??�pd��<K2���ه�1���]ȴr��8=/;��1W������&�}0q5R�h�3%��F�ƕ��Vf�x��E�o��/ u�>��t^�s�et �u��������&����#�2�[ub�������ʌ�ػ����s��,� N=^5s�㈅�`l��pj�'.�àR���m����X|�̧��A-CR�ya�7 WR]�#R����a���CM�ܝ�k`X��o�*Q��2<P������K� ��<�vл�b|Úv�������F>7!����P�T,��O���ODq�+��b�idž�)�SH@�<֚P/>W*��ȣaj@x#���x���o eǴ�#V+�3KRJ�t�2��T� ����Bo�)<8�����>Yu��u~t�65#=����z��,E�)�v�k]�s4�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ