Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
310faf3eef2180dd6cb278e88c6f22229a3493904fcddadff286b59378aa903f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
310faf3eef2180dd6cb278e88c6f22229a3493904fcddadff286b59378aa903f.exe
Resource
win10v2004-20240226-en
Target
310faf3eef2180dd6cb278e88c6f22229a3493904fcddadff286b59378aa903f
Size
3.6MB
MD5
6265b18fdf3873c3f7eef606ac9d7c89
SHA1
9eccfb0437c8575858a0065aae6d75406c32046d
SHA256
310faf3eef2180dd6cb278e88c6f22229a3493904fcddadff286b59378aa903f
SHA512
748c6fa1af160336d7814d378168b2fb2a36ce7367f6979df300a182e31b325781bca041b47385ec7df9c46570be352870f52ccee68827a269ba1960955041e5
SSDEEP
49152:tN/v5nIvh0Dxmy5zvDz3doh6LgP7AJSIO9fks4VM9t3qwz6eb+0M1:X/v5IhAxfl3Gh0KAJ6fk83qKy
resource | yara_rule |
---|---|
sample | INDICATOR_EXE_Packed_VMProtect |
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
H:\baidu\netdisk\pc-yunbrowser\output\YunDetectService.pdb
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileA
GetSystemInfo
LoadLibraryW
HeapCompact
UnlockFile
GetProcAddress
CreateFileMappingA
LocalFree
LockFileEx
GetCurrentProcessId
SystemTimeToFileTime
FreeLibrary
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
OpenMutexW
ReleaseMutex
OpenFileMappingW
GetTempFileNameW
VirtualQuery
GetModuleHandleW
CreateProcessW
GlobalAlloc
GetVolumeInformationA
GlobalFree
DeviceIoControl
CreateEventA
CreateSemaphoreA
ReleaseSemaphore
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
InterlockedExchangeAdd
TlsAlloc
WaitForMultipleObjects
TerminateThread
QueueUserAPC
CreateEventW
SetEvent
SleepEx
PostQueuedCompletionStatus
CreateIoCompletionPort
SetWaitableTimer
GetQueuedCompletionStatus
VerSetConditionMask
VerifyVersionInfoW
CreateWaitableTimerW
WaitForMultipleObjectsEx
ResetEvent
TlsGetValue
TlsSetValue
TlsFree
DecodePointer
OpenEventW
OpenProcess
TerminateProcess
GetPrivateProfileIntW
WriteConsoleW
SetConsoleTextAttribute
FreeConsole
GetConsoleScreenBufferInfo
GetStdHandle
AllocConsole
GetFullPathNameW
HeapCreate
TryEnterCriticalSection
AreFileApisANSI
WriteFile
CreateDirectoryW
ReadFile
GetFileSize
CreateFileW
WideCharToMultiByte
WaitForSingleObject
DeleteFileW
CloseHandle
MultiByteToWideChar
SetLastError
RaiseException
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
CreateWaitableTimerA
GetModuleHandleA
ResumeThread
OpenEventA
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
GetEnvironmentVariableW
ConvertThreadToFiber
ConvertFiberToThread
GetFileType
GetModuleHandleExW
FindNextFileW
FindFirstFileW
FindClose
CreateFiber
DeleteFiber
SwitchToFiber
HeapSize
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
GetCurrentProcess
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
HeapDestroy
GetProcessWindowStation
GetUserObjectInformationW
CallWindowProcW
SendMessageTimeoutW
MessageBoxW
LoadCursorW
CreateWindowExW
SetWindowLongW
PostMessageW
GetMessageW
TranslateMessage
DispatchMessageW
DestroyWindow
GetClassInfoExW
RegisterClassExW
UnregisterClassW
IsWindow
GetWindowLongW
KillTimer
SetTimer
DefWindowProcW
CryptGetUserKey
CryptEnumProvidersW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptSignHashW
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
SHGetFolderPathW
SHGetSpecialFolderPathW
StringFromCLSID
CoLoadLibrary
CoFreeLibrary
CoUninitialize
CoInitializeEx
CoCreateInstance
CoCreateGuid
SysAllocStringByteLen
SysAllocString
VariantInit
SysStringByteLen
VariantClear
SysAllocStringLen
VarBstrCmp
SysStringLen
SysFreeString
SHDeleteKeyW
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
?classic@locale@std@@SAABV12@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?id@?$numpunct@D@std@@2V0locale@2@A
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?toupper@?$ctype@D@std@@QBEDD@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_BADOFF@std@@3_JB
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetOpenW
InternetOpenUrlW
InternetConnectA
HttpEndRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetOpenA
InternetWriteFile
InternetSetOptionA
HttpSendRequestExA
InternetQueryDataAvailable
recv
send
WSASetLastError
getpeername
getsockopt
bind
ntohs
htonl
ntohl
freeaddrinfo
getaddrinfo
WSAGetLastError
WSAAddressToStringW
setsockopt
WSASocketW
WSASend
WSARecv
listen
select
shutdown
ioctlsocket
closesocket
WSACleanup
WSAStartup
EnumProcesses
GetModuleBaseNameW
GetAdaptersInfo
AcceptEx
GetAcceptExSockaddrs
memset
__CxxFrameHandler3
__vcrt_InitializeCriticalSectionEx
_except_handler4_common
_CxxThrowException
memcpy
__std_type_info_compare
memchr
_purecall
__std_terminate
memmove
wcsrchr
strchr
strstr
wcsstr
__std_exception_copy
__std_exception_destroy
wcschr
strrchr
__stdio_common_vswprintf
ferror
__stdio_common_vswscanf
fread
fseek
fputs
__stdio_common_vfprintf
__acrt_iob_func
fopen
_wfopen
ftell
__stdio_common_vsscanf
__stdio_common_vsprintf
__stdio_common_vsprintf_s
fgets
_wfsopen
fclose
__stdio_common_vfwprintf
fflush
feof
__p__commode
__stdio_common_vswprintf_s
_set_fmode
fwrite
__stdio_common_vsnwprintf_s
_setmode
_fileno
terminate
_endthreadex
_invalid_parameter_noinfo_noreturn
_c_exit
_errno
abort
signal
strerror_s
raise
_controlfp_s
_invalid_parameter_noinfo
_exit
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_register_onexit_function
exit
strerror
_crt_atexit
_initterm_e
_initterm
_get_wide_winmain_command_line
_cexit
_beginthreadex
_seh_filter_exe
_initialize_wide_environment
_configure_wide_argv
_set_app_type
isalnum
strcmp
wcsnlen
wmemcpy_s
ispunct
_stricmp
_strnicmp
strncpy
wcscspn
wcsspn
isxdigit
wcsncpy_s
isspace
strnlen
_wcslwr_s
iswspace
wcscat_s
wcscpy_s
_wcsicmp
strncmp
strcspn
strspn
_set_new_mode
calloc
free
malloc
realloc
_recalloc
_msize
_callnewh
_waccess
_stat64i32
_atoi64
strtol
_wtoi64
_wtoi
atoi
strtoul
_localtime64_s
_gmtime64
_time64
_gmtime64_s
wcsftime
_mbsicmp
_mbsstr
_mbslwr_s
_mbscmp
_mbsinc
_mbschr
qsort
__setusermatherr
_except1
_configthreadlocale
getenv
BCryptGenRandom
CertFindCertificateInStore
CertGetCertificateContextProperty
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
?$TSS0@?1??get_instance@?$singleton@VCRequestHandlerFactory@@@serialization@boost@@CAAAVCRequestHandlerFactory@@XZ@4HA
?get_instance@?$singleton@VCRequestHandlerFactory@@@serialization@boost@@CAAAVCRequestHandlerFactory@@XZ
?get_mutable_instance@?$singleton@VCRequestHandlerFactory@@@serialization@boost@@SAAAVCRequestHandlerFactory@@XZ
?instance@?$singleton@VCRequestHandlerFactory@@@serialization@boost@@0AAVCRequestHandlerFactory@@A
?t@?1??get_instance@?$singleton@VCRequestHandlerFactory@@@serialization@boost@@CAAAVCRequestHandlerFactory@@XZ@4V?$singleton_wrapper@VCRequestHandlerFactory@@@detail@34@A
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ