Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
deda1d956e782bd2a9ad7d7d993af180.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
deda1d956e782bd2a9ad7d7d993af180.exe
Resource
win10v2004-20240226-en
Target
deda1d956e782bd2a9ad7d7d993af180
Size
9.0MB
MD5
deda1d956e782bd2a9ad7d7d993af180
SHA1
a3b485489990a2bd547a25004de71b5147d133c3
SHA256
dd87d04280fefdfb88cdafd3e8e44ecea87cca47c9de703ff10301fd4da3e36f
SHA512
75eb384e2a6973b901268ebee9e186dbf2c62446010ca9efac4f2fa888fd764b1540ec3955b2f9cd5cab64df644c7d049234cb8a21dcc36b5491b591c45e7df8
SSDEEP
196608:p71+KGoUDzdVgJ06IcO7AeqSjh2nIilB:p71+q+WqOO7bqSjIlB
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
VerQueryValueW
timeBeginPeriod
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetMenuDefaultItem
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
CreateHatchBrush
TransparentBlt
GetOpenFileNameW
ClosePrinter
RegQueryInfoKeyW
ShellExecuteW
ImageList_Draw
PathIsUNCW
IsThemeBackgroundPartiallyTransparent
CoInitializeEx
SysAllocStringLen
OleUIBusyW
URLDownloadToFileW
SetSuspendState
InternetCloseHandle
WSAStartup
CreateStdAccessibleObject
GdipSetInterpolationMode
ImmGetOpenStatus
SetupDiGetClassDevsW
GetNetworkParams
WTSSendMessageW
ɋUO �?CE��t_a�P-���C|����u��v��9�&�?C-������R�磈��Z( n�؊b�<�o�Q{�J�-C?�:�����$���Z�%�{~�g�߹�.��A�욠ȵ��ktfb�DV*-������~�w#����&��0ť�1 ��5�yz�� ��2 �.º�]9Cci�a��N�534#��z �b�P��E��n�q�r�~_yK*d�T���?�.C����l�6�ݶ#�ϤPD\[K4��nN�F~�7J_�.���f�; �m=�`��(���F����-�}W%1WP��gJ������7�pR�T5[x�W�%-�eE�#�X��p�G��Z�ޯ�ݜI��dL����:�\�A�� RXu{2�i[�� K�oF� �H�S�a*D�0ݝ��t�s<�S����3��O9o�fI����;�8��Cq�RL�C��(��S(~���@:���ɓ�V�����u��T Lw��h5u���u�:Ⱦ������b=&����d����������G�+{�f��S���p#h��{y�'PŤݫ#@�&ɦ!��T.��R�K^F��&|��\��z��a&�V�N���D�c����L�?Ɵ��M��ۃ�7���q�:xJM�~ڣP!�s�����J=,��@m&�.��S{F�s�����������m?��<�b,�N�oD���'}�kw.�G(>����?��j(�%3Oe�lDZF�-�Ϲ��D���1=d�� ����bo"z�E<m끁��Wh�sIan$�eƶ<:.���;�^0`�l7��~�!�:�0��l'��6��x!gk�*��Nugl��W��U�7��0��kD����R�teVX�t4\Ce�HF9G�af,U�h>��fqo!b���s��&'m�x~`�52�E��q5�m]�(���+h?7��4S?I����TE%�%X7����>/4���)�9oz0��ChsP5v����ü+�K��LB��eR��Fc]�,�-h���g���ñR���pK�����~T8�.����ɀ#�E�������14��2�#�|�N���X�;l����4�k�p���K�1����Ү1!i IP-"SN2��sO�81�s/�B�`�NLxܥ������ ��P���3<��� Ж���~q��� �]�p���隃3���4���ƒ���z��|�5'u�T�qQ'&7e�Q1�l?��ΰ�����0h��Q��y�m��L+1=^�bs5�`���;v�Q�@'���)qT{�C�U���cX�_���a���g3�8�e�a�J�Bz��@d�tr" 9S��u�� ��َ1�[ 2Oc��q��������{47��ƒ?�c�$���?�Uی� x{�ԥ����P�_WKI>kqןw3����c| ��r�����QK�1;�8�eWZ���!Oe�;�c�Nm�~��i'!��Yi?-�f��]����ļ@���z:��vbMw�##e��F�nI���I��Dz��b�R��:���:���O���"P���稧�Ѧ���y�H�d������/��/��eO�%�p��_�v'pq��C��S�̂����*;x���&kO�غE �o�u%�sR�y�|�`�4b�\a���7�n�%-f�8�ȫ�*l��&~��.�4p�E@�/'q�������4���k�V��h�Iŷ-72$�)�\l+�f�!����o�� 8�����.��D�s����m��:��P�4��.�Q�ι�$�4��3e]fR�y.`�"��m����� s����z}T��] C[�^и��&ƛĂD��YXi���/�B��8][�rh��O�'h�q�I/;I~���xH44�R(���E`�� j�c�I�qm9�J�\!���XW�N���W���Y;/NM13ӡ����H�ML{,��C��w���;p_��;�aas���qO ~>Y0�u�jYM,�r�������b��˾�>��h�XPY�p>�@X��h ����*���������_'{�E|}v�dR�i��`�r�'En�P���#�;�y��=f��rR(Ha�(�m`-�n�c��>�l�Y�ع�[�2եNt-#������ⶅe����.x}\��9�7*���n��e]q�����t�K���ro�a�Yĉ�m���ƁM���@Œ����,;�5�Q}J @#oL���/w�8��/6%Z�:U�-�P<�Yn"t �̋��:����n��B�l�;�-CC3�j��M`�l~Qg3H{�0x0YX̡+[�'2�{�������M8\,��(��B��-i�s�bx^�T����F�B���:#�^���K� � ��>p=�D���m��k����?�K��$A!��i�����y���-�"��1ȍ"z��A����,I6�~���W����[��m8���UCʍ*~�1J����!(FX:{=fܼU$[�b ��D���[}A�Ջ�X��ߢ��������K�^.��_�7{��p��HM���.������5&��k���_5�4�%yӘ��2:�ٞ "����z++d8���"[��TT�Bk)v6�'�L�Z*&J<�5 fn;f9��G���%\T��B�TMk������g�R��t�cI&k@�5� `��QL폚�C����y��ؾC�oa�����=����`���edH�����j��<�<#�3�٤>w��+k؆�K5���{`t�B��%�?E���[:�n�j�o_�tܥ� F3��>0r��ʍ6�Bx�`0ܺa>X��*�d���O�k1{�-���0e��^H��+��b� ����;�ޔ@���6�6P���jl)W]�P��SJ4Z��a��%�~�U�>1e�{����ƻ!T>}�� ]W��w1�(!�D�=���P�P�U���lMQ��n����&�Y�hE�+��(�E��̰?��e�٦�%�����#��E61�b��� +A��Z!����+BD����i �O5p�?>Ƥ5�J�k�L��εt���q�ڧ �pRI�E���ĮFL9;�bЅ��-�ܺ�Z�ҙ/�6�$Fw�c#��U��k�灦�h���fF5h�-���
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ