Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
b443aa0b52bd2cfc6bf13c007b9753ff.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b443aa0b52bd2cfc6bf13c007b9753ff.exe
Resource
win10v2004-20240226-en
Target
b443aa0b52bd2cfc6bf13c007b9753ff
Size
12.3MB
MD5
b443aa0b52bd2cfc6bf13c007b9753ff
SHA1
21d58a5038ae7d72183a7dd72395cd645b2fa4c5
SHA256
e06cd01976f49892d4d735ee1f82bc45f4cf24c60435e1053e6e073a3d6c98f0
SHA512
7f6a7e69f2c98c334ed3d1044ee42113f2636690a9032b1db6c950b9fbcb020343397ba38550fed3a37fdcf75f0ae1984e84c490f54ffb4e177adc02fba6d2c0
SSDEEP
393216:T1IfOrJRIeAq5FpoqapGWoeALVTqEkwBzzxr+IVfvKu:yM6mFkoDLUOzh3
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
midiStreamOut
WSACleanup
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
SetWindowRgn
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
GetViewportExtEx
OpenPrinterA
RegQueryValueExA
ShellExecuteA
CLSIDFromString
LoadTypeLi
ord17
ChooseColorA
WTSSendMessageW
��Bm�}Y+����b[�.��5�$o�V蚥ϛ0%���| �B6��� �����G�;�jp{J�k��! t�B�G����)� 0g�W1��� �l0S�e<�b���~D쩵ə�Z����6xL�M��I����>\(����}�J�R.Z��v��?��a3ʎΖ��?>#CE�����������R�4��-7�wd�=Z����F>�����ل�����=�5��'�{�֪�S��)L�r#��f�1L;�R[��w��Ll�P;�mA�r�:�)ȰQ���s��g��"�dLw~���rb��%w��2�hػ��0m��Zn��������7%X�X�G�?��A�{�?�V�J@�I�s��l�Ǫ��Y�y����+��H`5�I�K��n����Yn�Ɯ�O��NC��&A��ߔ��T��M�Hmx&%x�wdc���H�z�܆t�̑�LD�Dz��}]r�g=.�����V?BM�i�w��Rb��^빱��z,�n5�L}�䃶����>����0>@ ���o�ܶV+��'d��+r���]�Y�X����SU��.u���歜��`<O{rQ`�m�A � �K>|^�jmC3��?-�2����嵈�κƵf���\q��z�����0*$ ��|K7��"��]$�g~R�dK����{%*�� <��/���2�z�m����ؽ�<��-*�Щ*�9?�^�����&��n嚮F���P������o��~ҮC�~H7�w�ˎF���íI���kK�� �����܍����Z��I����O�Qra����Q�|��8R���E�f8$�-��A�|a_���k�Y�V6�k��{�t���n�{X|F�0'�`)W]�Q~�җ��ֽZ�q�Z1_��7h�K�Zu� ��І Z�ӏ�37�������~��"�g�)MdQ{�w�s��H6%�A����^��Ċ��膧�U�� d�ݸ�r8���ocwc���Т��7w�J�s���C��_���x'+���U���ЇILA�Nwam�H���eG���nA��e�& fRu+y�ڤ�P��`�j�x�A��T��_��x�Cw�u�*�Ƨ�����d�<��&�Lp�6��qz<>r��HM���찲V{�������B�������sʻ ��c �#G�ǃ�����>v���3v���A��R��˄�_��C4He��+�����ʎ��(SZ�ߌ�M�$/j�364�ߖ�?8o�a�~�\��d�Kep'�@��=Ց˘5/����eZ=Ѭ*��U{��qʒ�26u��:K��7�m���m��#8��G�p�%%PV�,������=#y��Ը���X��8C��� ����6��qeq�c�u�<���J��c�j��;�c^���2BG�L�ov$�(-��ˉ�;P���T�����G����q 0�8������F|��e� -�`<f�FGj�m���!�!�e��yz�������"�g���m�ǤsGz��ϑ��*??�Q�dz��K��]��s�=��^�f�.�m��l|� �r@�58Aw5 N�=��)��j^a�̸O!�Lؐ���p���U� 0 |� k�wR�'���x�~�-| 7(GFGA�R��C�NV(�{�d�H���]��q�4sb�̼�������u��L�W��"F�4���Lϕ��-�z9�T{�/E:��P����g5�$�uن�����n,���:�e�c�q���-��v��%��ᷗ&��{6n���w:��3���#�^S<�QY�V��k)��m��ؗ�\��>b� �}o\PsBGSN���و�l�̀G���o��Yc#V�c)�e� U�G%=w~M�F_��E�i�;��[�-6p�9�LAb(�Ǥ�/�O��$�B���nHu��SaQ�>�Q�/�c:r����re�UP�Iώah���תHi Y[�عS�(�m�@&�Jma���i�S�/4��]�u8�w�F�M\J3&�����:ɬ����{'�SD~�Ze�^��-r!E����Ǭ�u�x��͞��x][��NJ�tz����~=a�W+��t���j.6r�^Ybj|K�7�8���>yV���\{��y�ED{�7��}��9\�L��zb�Y)k��9���cKOM�S��~l��^���8G�9@�w:��|@<���$��Pq����f:�%ԟZcu�z�Z���u��owߊ�Vq̵��.Fi���A�I:�yG�Գ�!^(�����9��Qe�H�ܩ��w#�K������y��,�q�;���IoQ.P:e�YL��$ª����-�= ���Pl�um�R|o� ��٘ .���cQ��cd#!��,59��LҖ��R�̋+�$+����(MY�F�a�PH�]����I�S0����J57���\��c��y�" �.$�7 cxH�Q��[)��G��f�g)��[��{�f�o��8�Fׂ��k7O����]��A��C����ۜ�P�41�d(/��]=� ��)i\����% F�Lh:�`��*�@H��qn��^�\�V���8�I�C�[\�l��^�b)up�g������DD�,�ʜ.=���� �M���f'��1��H�v�A���i!�/q����)��IA���K0Q&������<�jv��\mϨ�:f-yl e$l��D���N�.r������s�c�!�ӿXÐ����~�n��v��s+(��x��?�ď�M� �1����]�LF���-]5��J�'�����"�j�����q��c��S�B�q�"��,����+��ed��]�^~���Aç�}�gH� �í���&3+��C���@ƪA�p�I�v��.4���� x)�a��&�z��**�����ή��Ѻkr��w��j:� ߯�E�Y5����_Lc�+K'�(�����X!W_Lqɉ����`a�?�Ν�Q���_��Qp�m�aDJe1@=s*�a8 Gn���nL���a��C��k2��%�Ч��W�-��͋�� f� ���m���]Z:A��L����s(o�^�\����ܕ�����%ô����
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ