Extended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
e193300c5fb92d3991971809d996b03d.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e193300c5fb92d3991971809d996b03d.dll
Resource
win10v2004-20240226-en
Target
e193300c5fb92d3991971809d996b03d
Size
195KB
MD5
e193300c5fb92d3991971809d996b03d
SHA1
d64aceb74715f0cc7981cdc2747e4d4b2ba287e6
SHA256
1a1be72205f66ec1901599b9af0dc6a866d08e5b581a587bebf3eb0ef6db1b88
SHA512
5eabb0b4db4cb1285a075316a32b716bf8c166c4509287e081a6494745a54cb56b82bce4492aea5584dce23394a65c1533c4e903a604e11d2ae8b6307ff6dc75
SSDEEP
3072:J1+v8PAQaUKf71j/QpwLlBK2ZEycA1RQPy7s7EOMgO4iszr3kuMK:J1eQ3Kfpj/iCZFc27s7msd1MK
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
StrStrIA
PathFileExistsA
FindResourceA
DeleteFileA
WideCharToMultiByte
TerminateProcess
OpenProcess
FreeLibrary
GetProcAddress
LoadLibraryA
GetPrivateProfileStringA
InitializeCriticalSection
CreateMutexA
GlobalUnlock
GlobalLock
LeaveCriticalSection
GetCurrentProcessId
GetCurrentProcess
FindClose
FindNextFileA
FindFirstFileA
lstrcpyA
FreeLibraryAndExitThread
GetCurrentThreadId
GetModuleFileNameA
GetModuleHandleA
CreateProcessA
GetLocaleInfoW
SizeofResource
GetLocaleInfoA
FlushFileBuffers
SetStdHandle
LCMapStringW
LCMapStringA
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetStringTypeA
HeapCreate
HeapDestroy
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
MultiByteToWideChar
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
HeapAlloc
HeapFree
GetOEMCP
GetACP
GetCPInfo
ExitProcess
EnterCriticalSection
DeleteCriticalSection
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetVersion
GetCommandLineA
RtlUnwind
LoadResource
Sleep
GetFileSize
ReadFile
VirtualFree
GetWindowsDirectoryA
CreateFileA
SetFilePointer
WriteFile
GetLocalTime
CloseHandle
GetLastError
VirtualAlloc
CreateThread
WaitForSingleObject
GetExitCodeThread
TerminateThread
GlobalAlloc
GlobalFree
lstrlenA
DialogBoxParamA
EndDialog
wsprintfA
MessageBoxA
GetWindowLongA
FindWindowA
FindWindowExA
GetWindowThreadProcessId
SendMessageA
IsWindowVisible
GetClassNameA
GetSystemMetrics
IsRectEmpty
ShowWindow
MoveWindow
GetWindowRect
keybd_event
mouse_event
SetCursorPos
GetCursorPos
GetKeyState
PostQuitMessage
EndPaint
SetActiveWindow
CallWindowProcA
ScreenToClient
SetFocus
BeginPaint
PtInRect
DefWindowProcA
TranslateMessage
DispatchMessageA
GetMessageA
SetWindowsHookExA
IsWindow
CallNextHookEx
SetForegroundWindow
CloseWindow
DestroyWindow
SetWindowLongA
UnhookWindowsHookEx
GetForegroundWindow
DestroyCaret
CreateCaret
SetCaretPos
ShowCaret
DrawTextA
GetDC
ReleaseDC
EnumChildWindows
GetWindowTextA
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
UpdateWindow
GetDlgItem
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
CreateDCA
GetCharWidthA
GetSystemPaletteEntries
GetDeviceCaps
TextOutA
BitBlt
GetStockObject
DeleteDC
GetDIBits
DeleteObject
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA
DnsRecordListFree
DnsQuery_A
setsockopt
ioctlsocket
select
inet_addr
WSAStartup
WSACleanup
socket
htons
inet_ntoa
connect
gethostname
closesocket
send
recv
gethostbyname
EnumProcesses
GetModuleFileNameExA
EnumProcessModules
HttpQueryInfoA
InternetReadFile
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ