Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
bot_start.exe
Resource
win7-20231129-en
Target
bot_start.exe
Size
2.4MB
MD5
4ce4c115dc875d988cbfc5bd2ca1cef6
SHA1
fda0b1ebd5013ca7a3ebe2d82cc7a1b186214f7b
SHA256
4435f8ed9e3b7720789ee521510f0dfa0cea001df4d127b4e2fad711d4d0f176
SHA512
21b81559b9a11289d26e0a39df74ce38ac2084897cc404f4fa36975386c799fb69616d1d86c13c46697339a87ef9fd608798eaf3189d2c5cb3a9f1ae90859946
SSDEEP
49152:904WQqJ4xO4Tqs2HI4KzMlDtKESeiZ2k1yeHq2ZLjJEiVL6R:GQX/uJo4pBtYeiZZKOLVVL6
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
^������������'��q���s4�$F���y�ʞ�I��:b*�5L�%%���l��v1��I(�,��IC�\��XJALu����}��tl���5G-QaL�mI�M]Ȍ�K�ayz�>W,z��:����Y�2�)�X������4U�(�f/�ѭ�jݣPy�p?��-������)�T��5�4��'{�#-��£���K0־q�/�֢ ��jf�E��aЗ=�4b�� D����=J�19ψ��l8HLh<W��D9P�kg��/��gixH,'�NKk�Fl�֜��ee�p\�$d�"6`Z��=�o��&Gl�]]�;�:�tDh�{�K��\�ID��d�i;.�g�]���Sd�~Ƽ>U��f[~C0��i�R��RQ(>���בs��V��'iS|!�qy� [Kq��O,^�[]�ӊ����(�D��A�_�x�9�u�I# �a%��nAg=�s�B�]�X���7bh�d��L��&��Ҙ�P/o�� �B����C� z�"`"�h<����S��-̣�\CP9l��G��A>�!�i�����DR��5�%B�@sbp�&����������Y���[[�X�6$�d��o�S�\Zxn~I�-D��e/[�cy8fIg���L���ڬ�85;��$��*�-�ֶ�f*utVӶ҉�ic-k0�2�Q����5��kx���tR���#��X�����9>���-�t��/��b�q� ��Kb1%ׯ}�֛���\���fZrQ���+�Zap�;z�閫\7�9��c�����{�/;S��<�t=�g��h1���I��{T��0�l�{E���.��!}�;Q�h[����<1���f�@(z��q�<�ch^q����8�w� �����n¨㑿іu���.@�æ��������`��~M��f��*w��{ �:��|Ը��I5,�� �ͤ��FC �Q0��B):��&�kH������oF��bZ�$���25q�: G�R���F��la@�{��U����˥V��0_ �_�.|�����R����ˈ ̝�+�}��n���g�{�U��Y@�W�s5����G�]!9}B�7d"gR��Ǿ*�ũ��e��� ��Q��p��]�6�;��'?+�5���(�ZWy��5��W)���P�Skp��{e��ɵ2��UR8�a�D �Ji�+�q�p�l�X˞�\�R��V�`I(X�;JqF��#C�`�����{Ks��Էؔ�riu|?�t�v�7�Nj� �П�2�����O]������kt]�Ae<����(�&2t��d ���ɱ_��4�*g0mHef�<a��]CQ��τ�s�f]i�Py�L��5wCѣ��;|��rR9{��_�6�Y i����϶����Cq]x!A��'1�-�l� �J�����f����CTbv-���8i�^����7�<�s�KC�c��q�#�Ξ��7�(��I�iו��!�[��:sl�� >*xL_p����B�2��|�h)M��7�XQ�˼��!�eN�wCp�-�c?/��b,U)��CD�����n�{�O�3'V ������P8�<��X��L���B�me?bv�B���`�6mZ�@5z*I����#M�"��VKס�uo{:��}*�C�ܫd�+�i0$�8T v����^L�H����$m+"1�t�鈙wq%R���/���WP![�X��xZ��=Y9�P�L%��N"y�����rHmt��?�+���1<�%K����!�?㾞}���r�-��w�� |<E0�bR�[ e�a�V���l[ � �us/+O=�kV��]���(.���\X�L��y��&��ƺ����r��bi0 ཨ�lj�<���A�+���qKs����;�4)F<[��?��A�*ށ�2�\�[PNx�t�ʿ-r<yZ ���S���;��u�Fǁ}*����x�l�-cc���ĩ[ z�@���돳�VS�y��\#3B���� �*ݮ>��H������a���5E�S)�|����������a��Ү=w|k�9퉯�'v՚^��aL���*��;����,�㍠�x����}o�� Ч�V郞T*����]��E�O�'���~�� �'��'����0a#����0td{9z���i���# ?��Q �ݷ���5�V6盾�y\��j����:�X���n���t��B��[�]"a�=K+z�����k��7D0��G��Uٝ�L���o���R�\��Oe���C��������K2`�4�����.�N< a]���N8#W`����#m�1����(�D����AB�d��"ڝ�K�;$A�u!dE{#�zËOq[,�,QP�uєi>�rÌ��c{"��������+J3�G�*J��c�s�N\�� ����7`�Q�Fۑ ��#��Tm�MCTh�l��,�� �L�vM�'D�D�:\2c�1f*jY8����jW��ΚWh����ss��Q�Y�0���zm��X7�T>��&ߞ���D���A��r��G� �hr}�m��|^l��'��R����2� e[FI��f]D�GF�%�W{�@�҉��D��˙" ů#лW]N�eOs�C . +r�R��d������j}� o���8�UD�f��UyC�L��w4�µ�����'� YH��M���@���|���6��vCl���5sI�m�����a#� ��8D-L HA���m Od�9��"T�T�9���Fᬞ�;�~hR�3Nd���±��TE� D���~�<V�#n5����s�>j�H��������A�d��Շ��][\_J�����ī�J̃�#���/�S�zm=��=���k� ��!Z�u��b��#/( !�f���!S�dž )�Y5�2>{vW0*�dr뀂��]���a6�3@��Ln'��K7t�JϹ�q �T�&̇]`��UN:�o��g���D��m�O Eƍ�����[8(�Y4P?�1�v�PBވv��o^i h�����SIB�Mf)����ɼđI� +^Q������M�r|H����w�)�_xvm�N�$b6SJY�̷)u��[��2Y]���ڱ���L\�S��m�%�\������ڛ��8w0��L&���Lt =�p%e����{�ȈjIL�۷{U�W�zFt�8Ϳ/� L�] �`u$#����q��I���oˀ����>����������&ɼ�DI�z�֛-����A�+>]�Q�7�T�W�a��q�����ďS �]��w��2��z�bư;���E9�����?8�9�B �)��%p�*��r��d��sS+��!�"��as�ͻ×�����K���*�8�s-FJUd�"&^���\lg��uf c2�����+���옍n�s��ѷ��mqt�Km1T6�O�+���
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE