Extended Key Usages
ExtKeyUsageCodeSigning
Behavioral task
behavioral1
Sample
0330042.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0330042.exe
Resource
win10v2004-20231215-en
Target
0330042.exe
Size
302KB
MD5
363dfb0bb8f4341362ed9f00b3aa8604
SHA1
9aed8dc52684c8d5e607ae63ae6b017c5444010d
SHA256
4d625b4783af22d7e421ad6ef1596a0fef18ab7636776c93212201add00df162
SHA512
faec352f15eb5454201a0805efd5aad627a9fa75e1cf389efe7914dc08861037795048f096cdde44cc8e989c13f85382aaadf6aac6d7ce465123c2b319112f4a
SSDEEP
6144:booEac1YJvP9/AV6IHXW5ISNNr6oNCaAbG3Aye3o:XEac14GVnXW5FNrjCaAbG3Ay
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource | yara_rule |
---|---|
sample | agile_net |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
C:\Users\Administrator\Documents\Visual Studio 2015\Projects\QQScLauncher\Release\QQScLauncher.pdb
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?width@ios_base@std@@QAE_J_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?good@ios_base@std@@QBE_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
MultiByteToWideChar
WideCharToMultiByte
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
GetProcAddress
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RaiseException
Process32Next
QueryFullProcessImageNameA
Process32First
CreateToolhelp32Snapshot
SetConsoleTitleA
SetErrorMode
CreateMutexA
SetLastError
CloseHandle
GetSystemInfo
OpenProcess
VirtualQueryEx
ReadProcessMemory
GetLocalTime
LoadLibraryW
LoadLibraryA
Sleep
lstrlenA
lstrcatA
lstrcpyA
GetModuleHandleA
WinExec
IsDebuggerPresent
__CxxUnregisterExceptionObject
__CxxDetectRethrow
memset
__CxxRegisterExceptionObject
__CxxExceptionFilter
__FrameUnwindFilter
memmove
memchr
memcpy
memcmp
strstr
__std_type_info_destroy_list
_except_handler4_common
__CxxQueryExceptionSize
__CxxFrameHandler3
__std_exception_destroy
__std_exception_copy
_CxxThrowException
__vcrt_GetModuleFileNameW
__vcrt_LoadLibraryExW
__stdio_common_vsscanf
__stdio_common_vsprintf_s
__p__commode
_set_fmode
_configure_narrow_argv
_initialize_narrow_environment
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit
_exit
_cexit
_register_thread_local_exe_atexit_callback
abort
_seh_filter_dll
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_controlfp_s
terminate
_seh_filter_exe
_set_app_type
_c_exit
_invalid_parameter_noinfo_noreturn
__setusermatherr
_configthreadlocale
malloc
free
_callnewh
_set_new_mode
Netbios
HttpQueryInfoA
InternetCloseHandle
HttpAddRequestHeadersA
HttpSendRequestA
InternetCrackUrlA
FindCloseUrlCache
HttpOpenRequestA
InternetConnectA
InternetReadFile
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA
InternetOpenA
DeleteUrlCacheEntry
WSACleanup
gethostname
WSAStartup
ntohs
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
strcpy
strtok
strlen
_stricmp
strcat
_time64
_mktime64
srand
rand
atoi
_CorExeMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ