Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
d662dc61e99cc3394c41fc7b1984289c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d662dc61e99cc3394c41fc7b1984289c.exe
Resource
win10v2004-20240226-en
Target
d662dc61e99cc3394c41fc7b1984289c
Size
12.3MB
MD5
d662dc61e99cc3394c41fc7b1984289c
SHA1
f840ef9f071eef54e3042a83dc5ddeab70fff06c
SHA256
cc82a9d32ff3f2bd439c9e7888563c0a8c3de8a0e276dc34958e0b94d4c12489
SHA512
dfc2dc26ffa738b8203265a5b105f2ebcc6ef00df82918402bdbf911b64628d5f5233bad242f06df68d10b5259207c77c66c8dab0272919de56ed1f793921c08
SSDEEP
393216:dTgAra91FCXJETs2dUv/OkmY12/fI6+tY8YlE7r:15iFC65k/2/fiGBlYr
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
midiStreamOut
WSACleanup
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
SetWindowRgn
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
GetViewportExtEx
OpenPrinterA
RegQueryValueExA
ShellExecuteA
CLSIDFromString
LoadTypeLi
ord17
ChooseColorA
WTSSendMessageW
v���Ol�b��A�8����}���(�MLy��|�^c- �-�ύ�"�D��,�N�uF��Ϟ2q�)!��x=]T�{xA+T��ɝ��C������PKj�K��8�����-o��`��m�fC�|w������X,�VS�OS��u=�$�,��V̓V{����;�OSR|n^4�����.ryP������\I�f�Ӎ�餘����)14i� Ba�Qg���TT�.�{���qr����;�2���/��������#C< 5g�.=!������@�Z�v������)Y�;�\2��H�\��ӑL�W u�:f� ٷ�U���`0|��۠ ��.�?$��]����I_ksŋ�[��<$k��W�Q;w��aj30f� �� �;u� &��ōT�ʫ}~k���������P��P���Gl��d{����v*��ZJ�/��J���8)�� �PD��=��g��/�U�6�O�#B�M9������ah�Wf����4`��ȂRHuO6��fزr�Q�y#�=�2��}�<���@��$Ny������o�@�<���s��4ر�g�kM4��8�m�d�Nv+ux�>Q|��ۘ*���������BE�,A_d�E�A*�R�5C����VA�_�z��@[)3���q���gĪt�`��q�Tt�T/&W��6s�W �e_^�8^@� g��X5;>�S+�h� ��jr�ѹ�wɛ���;w�����~�(،:Q�TS�̐;�%����4��%$t����hNS�u�%�QT\�A��X�8�w�ID�jdѥ&Ji0�n%enQa0���{ F0��Տz�����u�t����T2�R�CZ���@�KX+ ��dz�ޱ�k�V��yKt����Vm�4����+S��%����-7�֪���/f��I�?Hƍ�T��v�ֆ�D��o!f&�Z�I�S�g��G��k�����ןDy~��m>����_����W˜J����}���N�&S����Ew������ҁ7f_�-��j�$�nL�]D'^G��~�n�}VU1x)v�jf���9�l��FmRtC���C�< E�(VR��K�F2������p��i�\/_:깓�*R_����ya�:��G�ac�ŗ ��r�`�����p?z���U�҃�Hy;-Oi&^�l��m�_|�{���{�� �xm[O�u���w������R��>3.v�`~�~q.m����C�詻���;g�Ve�M���u�u1�����'5v��'&g�F�� ب���R�.l_�s��>B����ը~�%W�#���y_�$ �DT0�6UZ�V6/ʨrQ���p��(�䥩/�+Z�T�0��-�7�v��uk3�f�~�)�>|i��!�`�HD�}��>\���s����T� m��Rmu�?ำ�1 !�n��@�f������*kb�܀�^2��������Ͱe�9��\˺;��O�T���ݧ�v�a�l|���UN�1�O|�5�v��r���m�vg?�mŐM#��@��ʓ?ǀR�>!"�m`��%~��s�i] hk���w���|�����I�K[��Q��3�~���z6��\"y�>�t@s�p�o�T_�,�Η��@+��`�@3��5�,�j;��qL����LuC>�}4�~Nat*��NC)F�7B.Z����Cy�x�t��2��$���,P�&�!=+�4�Q�G&�M/0y ���ݴ-2l�*�o ���1�|��`�F�̉�����D�,�/��X$4NzH��R�.wA3�����d����Hc �����l�A��A��w�k����x�$z����O�[#�)j7�(8��:Q��\ئ�4�!�ژ��:Y�ź-� �,A`1u8�=�%�yG9Ω��������)a� qGgX@�N]�!��'I��4�\}a\?��*�d*Y�� �[R!����p]�f�Q�S�MGfya1)�!e����HC�P�Z�^a1E*\��d��,yI]ٹavɶV�N]]Al�>�`��m��\���惴���)�8�&��-����+RFR ŷT��Ц:���]]������^�{���� �x`�CLR(߇�7�M��`g�D�[ٷ�����C�h�;*˪O)g������&;�I������1��e�����e���F ��<exc��M���a��Da.���FU�\�BLt��p��@ե[��3/f�D�ʓ�����EҊ�W���9jdLP�<hQ���m,n#w�d�(r�eecB�4 ��co��g��ҋ��;��tDH}Di@�L�Џ��~!7�!5'`��F:��_�6M�c$�������?�5 P~I��d��4mY]2#u���ֶfr� �[��� P���o�vJ�a<e��0��?�oDf6�,!1 ���뭀�����y��*�f�F��9+�=>y�F��U�M�Q����>�xq9����UP�L�-�c`���F-�:�����q]=�B6X����iRA7{����$!,� ���=��4� EcXo����[�����ye��H�Ȓ��% �_���B�!:��G70~�[�6gW��PZ֯��bZ%x�J+��1����Ԧn��F�3H��Dvv��^�12/����r�䤧�������������>z ��%�頾y����8Y�M�o�e����$�z��JOf;ٰ��s�����c�k���3�YO���vH���`1_\�Y�}�ɾ�0�����R��:k���1"ߖ�}��Z�;[�c���E5q���oĩ��֮��0�3q��5��B�M��7��*)qz�Nv�s9\��k��&�(R\ܚ�����2�ֱ� �)�zde�d<e�VL�O?-S�+��@�M�G>ޑ�y��#��K �����Z*�d<����M���:A0r����0�����_� ^Rn:C��Jυ��T�o�Q��(*:�WU%�����r~��Hs�}A!j���`�~v�״�. 7%�ù��c�s� қ�*�-�,ꕢ�*X�\9QWh���${���Dp&e�7 �~�ޮh/m�����B�U��e���
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ