Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
7fe4b339fdab8707ea5bf11c17f2f64e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7fe4b339fdab8707ea5bf11c17f2f64e.exe
Resource
win10v2004-20240226-en
Target
7fe4b339fdab8707ea5bf11c17f2f64e.exe
Size
4.8MB
MD5
7fe4b339fdab8707ea5bf11c17f2f64e
SHA1
4014c7c7bbf892cca448e271b7fb23548d4c420a
SHA256
9d57caba82184844fa627ec270f6b421700205361c5560aedebefde54e93a60b
SHA512
61efe25dbee5ce5cd1fab7e48c3c7eacc07ee954856549c159899b985c60a0c6e7bac15f496b08ca934a9b66a812147b3bcedbbec1bc95e059f1d80f7b932de9
SSDEEP
98304:/saGswP8ywT1kQMNS5lWjeRKg8SEKf34L9vqskwyQ:/sfsSkkxIfXRKp3GoQsd
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
_EH_prolog
IsProcessorFeaturePresent
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
CharToOemA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
RegOpenKeyExA
CoInitializeSecurity
VariantClear
ord155
WTSSendMessageW
�O�}t#���Sb���\ֺ�"n%nO6�qwo|3����kx�,�$�Oe� ɺ�T9�2��F��W+��! JP�#г�VR����8k��m���=��*a:���1� ���a�Uz��3��#�Z���dy�e���q��5e�ti~���@���wov�K5�ճ�er{�i�|&���t`���l�*F�b ��_���|Y����|��� ���F),�3��o�_=�٬x�f7L�st�?�mQZ�w����j��2;�]%������?�D��Kp�&�@ylI�z���^�����[� 2k�,�J�d���W��i��!���r}�Ε�Sfz��Q0��w�Ơ˓Ե�]��փCe��B�@����D ��Ŏq6�>��q0���?��n70h� �:�� �pJ��0sf����nW�oƀ��㈽UQ��N���sՁ��X.�H�O�8fw��5ҬN��u�0N�߱;&��ODK��@9@6�>fu��(8�) �8��ﮝ����R���IO}��� .~4.y�����VL��<g���5 \\�QCK�`��f9��O��i*s[��1��r��*����Nz�4���l� ��hKá䵛$�V���_����~닦���C��������/�x)�U��Jw��Tw�e��;r���'As~η':��ᤙ)�v�٘z�ZgfO�6�y���klI���91�A��3���DW�1�ʚX&78�r�W5�TGʐEg�@Lx]�|�M�,{�2��g�����6B)%��h��V =�,�� �e���D����>�)�NR����k��%���X��x�zM�__,�T]AIm[#ㅅc� ֪�/祮%Q$Sy���圿3�,A�U���/#Y=*�$�c��O�`�����#]����r���C�(�x��i`�;�ag�VIK�k.�� Ϭjݷ&��xn��a-h~L?c�{d�IA�ܨa���`RT0�F|}���$^��꯬�Ƴ���Iε�8x��v>��n��6d�'JW�F���~j��a��+o*»�hn,�[� Mb t�����t���\[ hB���%$n���_�x��yI���R��-_�� x%�[���:�������+%K���z$�������"^`��^L^W�䶟yɨ�f����Q��W�녩�Ŭ�$BE��\EsٚgΎ�f�?�_1�21ܮ��M�au٤u/̡���vΚ��[v%C��5�#���a�DF~�6��~a��U|R<�Bc���xf�7-L�o�",9t���Z�p��0�-������h���*�a秥q~:|f�&�������j�}'��� ?��<6�_�7���� �CqQW��,$�L8��B��Br��O^����P�7o��eL{�nDV�'�˙4�/���Jr�[=P�������j�c���Ff��}8��ن�����8x��5�Exmp�v�6IjXÔ�'�LS�|Y�N� |��X�d�:�/��eUy������{�Ŋd���V���U�˕9�)�F��6����|Ƒϭ�(]vD��+�Ԗv��Z�����ov��mmK�7�V� ���k�����я8�,���Mf���Ӭ���iQ�PϭS��� G�[���MNx���ba��b�Kp�Ǐ��F�h�x~L�~���`~�N���t�d"��D�3w�D��/�+��qQ�<E`3?�}�-��ي�kH{''���ѩO�B<���D�Y�X���R���ڦ�nr� p��l�|��U�|^�W �~��M�I ��/���Ĥ ���������D��R�ͽJ)���B�m��8�6Э[K��ej?�K������_p�A�4Q�LTږ��Ј羍�.g��7�<����iG�ڷ��t���([��hS� &s����r��+/_;*8���Տϔz!+Gu�:��L�Fp�ɋ�FCnqZ�����?�鼇������x:fS˒%��8����@(�:��WTlL ���$@nƣ�b��4Y.q��>��h�)k�5���0�R*>�Q��'��c�AC��d����o�eCH�~����V�����s���5�_ ��w�*�"B�f5ȴ@.����N��C�X�������ء�2��\v����5�2����N[�JS#�v�����u6-턛J�67P�זȮF%y�H!w\,�yZ���fm1�6P��-,/�s�L��m[���<�u0ODfSIːB�`�zCF�b����ƿ&��5�>�Z.��>ߛ: |hĩ�A�Ta�X"�Y���*��f���Vt����`��;y�2_��B1�I�䖫,j�\����6�Šw��Y��wP���bb��]��5�ۜ��~V&�&�+Q�1s����E�ȫ���@HmAG)z�#2/��m$�ݖ���v������|�)��a}Y�-\�l'�����f��zV��x��o����{�j � S�P����e$8.�*1Gc+"����媬z�Cq��"|(����� ��Z��j�~���PҴ4s�l�T���HݣJ �0:h�6l03�M��K�;����+����ؑ�B�Ci;H�o�NZ�ϻ��G�,y]�*���x3��ѯ�F E[�Lw�va�PE�|�WEF�|/3+jgl��y�b04���d�`Te]쳰x�!���� �M��D��1i��З��Ԓo,�z�[��n���C6c����Y"��.<��j�6��86��T�Y���V�Ǵ��e��f�����$�;$<���=�f�-X|���U����g‴��bL_��Pj� �"yo��_���NHNd�ӟ��wP��}I�d+� Dw��h��> 'w]�� )���za�O�~��l\����=�-h����u�t`�" ��.!S�bF�i6�p�j�l@[�@��"���3i�J����y�`�u2���G���D���RT������&�jR2��?�{G6܈�'>�.5��Y��~���2�ͨf��� �S5!�)e��3:w�ۢ���E���Z�'�=s�Ɨ��@��s9�6"�d7?q�շ��"���.�XƟRJ�� �!a�x��*�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ