Extended Key Usages
ExtKeyUsageCodeSigning
Behavioral task
behavioral1
Sample
b545c963981cba60cc71a6968ca5974b.exe
Resource
win7-20240221-en
Target
b545c963981cba60cc71a6968ca5974b
Size
6.9MB
MD5
b545c963981cba60cc71a6968ca5974b
SHA1
adc3c2c4e62b81982978fcf6dc2881bae9081e3d
SHA256
723f13bd08f72fd473b2283f99c2c1738b0e8bc7d6d3c269e9de52b0acbaf49d
SHA512
0b1299152b97e7e5f0493cddcd3e533d5e7245d3a373d37bedaad9e1e2e2ad13175d62ef1f65e7fe54ff10c86245e118998e08e0b615853784e0516fa1e02dc8
SSDEEP
98304:7RYC/bcQox6lVUAbbG3HNd+sL3HPU8Pq6EhYmw8/xQxfqJllsQOZA/qC3gObmY:7RlTfltbK3NdXLXP4hQa5JrsHZdCQOmY
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
WSAStartup
GetAdaptersAddresses
GetUserProfileDirectoryW
CertFreeCertificateContext
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetSystemMetrics
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
SHGetSpecialFolderPathA
OpenProcessToken
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
BCryptGenRandom
__current_exception_context
__CxxFrameHandler4
_crt_atexit
nan
_callnewh
strcmp
_wfopen
localeconv
getenv
_time64
atof
_byteswap_uint64
_mkdir
WTSSendMessageW
��-���*0�R��0=q��~�F����&�zM�^4)�"/��'"��:��]��03�Q�i2Z�e|T����4��tWt*ep�<��/���r_�_�Y��r'���T?b�Z�\j�#6Q�5��)8��7.���.s��U��G���siW(�s��,� �����ǖ|9�C�wpy!FGB��h�%>){�x.j�Ϸ�sT�&��e�V/�Rr��8bQ�їG�����d�3��C~� l�(ٟw9g ����\�S�`���rBDzK� �/����z����EC��eZ&�|��Ek��ė�y��O�4�o���!yG���U��䙖�%���z�F2���]�^���R�.,R���zp`J�i�g��Sʵ�%?d���m�s���`F���ɿ5Y�G�O�������т&F�~�U�w��1��~S��p���U{���?b��UsM���ʦ�}��K�I�~@ ��ZJ�����g�0��_���DT�wL\��9�E���I�˷t�2k)3 �C�mwe���.��+�����Lc#C 2;�F�˩ݾ�P���t��s�Yu�+�������h�=i"�]��2c�������uZ�]�T�]&X?u���g�@����K�F֛/�no�t�Ny6�D�fh�Z5U�v3�#s��+�Q��c�\b>B~�hnP��z�/�7��5�V�l�b�5�ޚ�m�_��r�|��m�K ��ȭ�`:rp�$���xv���X����������N��ŷ����%@���\�W֞Jp@��Vo��Ue�Y�1g��@�� �NF&@P�)����~�܂}���;�����m ����5S6��s��� mU[���ѧ�Ӯ��B��My�6���6/���w����[u��%m�.eg�$P�~�G�!SQf�Z"&˸�0�=�y7q6��r��u7L&m7���A@�����c����a�>(T<*p���!��sƐMй�L����Y���dg����@|� 9���� x���� ����������N`w�H(@.|R���,~�S�K<RI��9�˚-���[��Ƥ2�P�Y!��3SQE��\7�)2��Ǽ�9M���m�K���7%������^#F�L�Zp2�-��)Ȣ�K�T�P-�nO�q���N��oi9��QF��@!Ǧ{�=��tkB\�P{�Y{6��H���#��23*�x���Ml]n-{�&<����=�V!)�e,��\�k�?C��+��$��h�����3t"�k�O{4�Xy�F��Nҕ�# J�1"C�V��S���t���zv�?��T�E��>V�`Q��y�;�b���^�ɴ^'7Ͻ�0�fX]��v�A~��V�6J��E"M��Q"j����6?��������A��p/YүbG�1N�[͜#���0��[�:�`��\D��<���c�g�Gb�v&��,�RQ(N;!��`�>d ����w���_�Zf����8�)�;�4���<�R?T�o�ԇ�ӭ���OlҼ��%�_��U�i�������wq��c���RH�����qMD6˯#9 "�U��H�K"�W�]�g�J�#�������L�V��m����'�I�n�S(�O�����P�� �1)W�� rv�o�!:\,�j��Β��z �D��������æfv}x�+r�j��@{e��%- �n}��M�)]��$-��~�Ah��䯊����X�$�kh)� ���"oM�n!����[�D\%���f��F�x�����/fI� ��^6;�c���&�� 杰 ���u�*�6x�C�q[��w�F{�,c����2��;�*���8�ܛG���fa��k=\��C[�����4>�NL���ʻ$�4�����<���ZE �Z}?�§| ���ݜ�q�ӫi^���qAa� i��Y���Tg � gV�zҞ��'�_љ�?eY��'p�����dC���G!�'9��,�����-p�!�]�L� �W=����<�*�4u����ے[fȧ����`T���m���/8ٶ)Z�M#�������ď����N��"�r*��� �����c.���]��1dW�I�#Dl�~�=>d3 w���g�$@�]��R �5��9o:(�Ng�����]G��4�©ź�vf�Z� D����mo2v��nR�� ��j����}�_�w���7Re�@�#�9����`C�x�BB3.::4��!q^��K�Z�ye�����BK־u���N�����p=-m?�ޭ�_��qwؒl)�*����=i�\bQz�qv��6g�QhA(��_�H�Y�#3�u��sCÒ���΄RZ�n��$*�$����N`��<5us�O���-����/O�3Z���F�� ��)��U�X�*��b��C��{� �jj�Ǒ��ī���Qb~t��kY߶�G��K~����N��6�� N��A��=Vr��� V ����W6ք9Y�XQѶ&�of/Jk������C?aߤ��9ɭ�h�3i�M�6�&1�e=��,X*X�Hg����/6�,>�0��>���5��������c��@�Vn��<O�.�ei-W{`e���b�3���as�l���#D_�L�O!�3��#k9w�Sh�qg���n�0к����ړB��e*�����1F���5 �x|ޥ�Y���D�������M>9Ƣ�����֏���G�S�_��7�Jw�����ͬ�y"eշ��du������)b*X�r�G5�ߪN�y�6}MQ������~u�ZATi�,'�n��B���z�7O��� z�*���\*5�z��,X�?�����5������2��ݑ����e�N�|g�'"dǝ�獬����q�o����jjd�Io��|Qn��l��xQ��}Ơ#��� �g����e��z�[�/�����*�w�>�$�E���aGn���_��H�z�q_��(h��`zf��ш�����ˋ��������㶲-Nc������M��`��F`���3<�x�)я���B*��?ےp��%;��������Ez\�0(JT���$sN��_�/h1�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ