Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
dc9638797945d14e2c23faae542dea99.exe
Resource
win7-20240221-en
Target
dc9638797945d14e2c23faae542dea99
Size
4.9MB
MD5
dc9638797945d14e2c23faae542dea99
SHA1
17826b49f13863998448a5895ed70e207f388e75
SHA256
2a89f870741672e607f4ca012d62232a0f01f3118ac9c7806350bbcb66aacb63
SHA512
5b8cc115f04ffdc3c3715b8f2cbffa1e45b37ca9c79cf8a5781f971faa92ff27a15d22331de59633afae7970672431d272cee05bcca88cea518a07b4e5c1e555
SSDEEP
98304:JYzevfLqT5D1UHNV8FfZodptWb7/uJop9QbULSeqSbFDTSQztRBGhnmCTKcZR9Cv:JZa5D9z6I/uJgRGXeFiwtRJCTKcZR8sG
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
strstr
WTSSendMessageW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
����s���n¾ɵ���e��Nd*HF� �6s�̛18���bj?s�HWù�̈́M�����5� P�`^�|�={+ww&��� �e���|�F��k�w�(����C��c<��W��%,ޡ4�2�A���������V9� IT��"P�O�� -�Z~-��t̶�Yhw9����j�/q&�m ��@6P.uz+=9u�u�,:#TL$r<��"��m�����<�.��0�~L#�0�]�t��9YC�J��} T���9c^�jd����l��~Z0�}��^rc�B��-��h�Y9��G�u-�{nˡj:�����������:Z7mo�uŤ֙��@���fGወ96C��u�o.��S#��i����4:�!`�l�ւ�1���T�y�p�&�kќ�/��K�ฑx���i(Z�0ƪc0� )�{��$d4|�*j_�����`.����w����� �li�c�^ > ���Ad��~ �����Q�lm8S��f�iM:�*��/�E�|��Pscв�v�w���dH����Z?-����`X�Ox5"�l���j�<#~��h:�'{G��p��hi�Xb�i�����{�����|�U�o�V�\�B�E���Y�7��O�Mk)FW�h����}H�������U�7���nCW4��3 ��ܩ]�?z\{�%�Y���%z)��TWJCS��88J��*��7�u��Ә����������� q�8�0r���E���X+*���iYE��W�K�/�HM��O�ϡ�T�znhv�W�� 밃���7t�����]Ӌ��3��hPpQ���VA�z{���H�qBR`�%�S��Q�����+�������P˕z����6M�`��٤���fIp�Z�5��:iׯ��"^c��s0��"z��dh��ƶ@`>��`�F�97�2f[�`9T*":��I�?��ʻb����v� rʹ(V���Iy�<�X��J�ׄL#Ί �A��i�D�mժ]ki�?g!�k[�c?PAʐ����Bh�EO�������װ�Is���&d4��D>�_�"�J� �4��B�_}1P;lp��x�=�l1��v9ӕ,߃b�f2̷���~�Ѧ����[q ����jk^S�yrk�Y�,�+q���r���-�~��lb`A�8�@ �����ͥ�Ą�i>�(X������bꔽ���ˌ>;��O��/'����gʬ���C�^��ė�\��,��ʊ��汰����s�!rO���zF�C!�5� ��\�L��&������sY�ac������Ut̞�x5`Hk�I���~�9$bl镖Q��L�4��s�bfC����ճ���W(V�c885\��>���ا�l:��~Ł�8�R�[�/<�r��!�l�Mx��)�i�#Y�q�"؞�r��i��ׂ �)�s; �̙9����bb��_Ǽ�k&n���!���-�}(�&���D����y�`u��y k�AC���� sH���>�yZy"z�(����,~I��4��V�[z���bY˅%,8��i��4��h�ēXP�f9;#�\���]� �ͻ����~KA�Vk<���R�7~��[��d����嶀C�Ԩ�B���|��F4�3�����MU�Hz�>6ZBt�R��0!��;�t0O(��n��ny��T����] A���X��@5o��Ȏ���`�e�g�{��!�d�zi��w���� ��\1*����eK���I)|Gq��-8��D���Ul����Q^Aq�.���0s>#�H+��k��A�G+ȴz��c���A�+�u����O��9y'�F���nt�X"���,_��t#� ��h�Դ�<FG���#��_���T�Tv�{[�U��, r �5���C[�QWϞN��e.�J=��B� tU���z��e� m��tc�IwT��.b=Y�ǐZ�F�=��Zg!ۙ��#Va^��0�~��ŝvW�3�b��4c��-־�Jq">�,#�Ȣ� d����σp�)��{�;��m��w�<�u2�oT�,�� �28��CH�3��Cq���������n�ժ���h����p�O��#���S �s�m����P�����r�IgjK(&�Yo�Q�ߍ�[R,��Y[?t��J�{ְ~�gQ�X )Fgk(��c�z�x�j�4J���"\W �D7��$�����J��@RΘ�<�f��$�o�zk�#������{s��r�-ij,P���\o��6'����+���Ŵ =֯i�Z ��le-A����f���;�6$UA�50�n��!)��Ko ��Ii0져�GAE���=ή�����~���� ��q�NS6Bu��&��9DTO�<8!C���94D��G�d��4Hab�a�bݭ\��N��4|�@u�"����q�G�U �������]����VT>Asw��Y���b4��������>y|��\��#�������x��&������N�Rj_P�_�H'm#�51 ��Uz���Q����a��5o�Tf�5bBc�{�X��Ѭ�]^� O;�\ޗ?��1M�8�S�*_�6c�i�N�o����W������V��Z�d�k$/�O�%��2ʭ���P� ʤ�?>@��'��!5z�m�H�_"�����'��S���'�֓$?_z R��>���N|0�=srf�J����/ ��S>���d��H[d�������F�|M�麔��<��B���(DCǷ���[���4��k�K�c�"�2�q��?��Y��l�Y`ljG��{��e�����Fnߌ�r��t���A3��S�N�����Rt����T�˞X%Y�5���wŌr��xT��-O����� kg�a�Ke�����{9Y�O��=�S�u?��Mf���+���6L0#jꆾD>#s�W���#1���L�#: <�O?{� ����Y.�{ap� Yd��FP����@��� �3�r�(^��m(�������8�>�U"D}�s�X���a#n��w7���:��$C䕻tz�"�* �$ge���"���Rc ̹��%'�#�ș����}���cr�1����0�}L�VyٙE-�z5
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ