Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
SubzeroFree.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
SubzeroFree.exe
Resource
win10v2004-20240226-en
Target
SubzeroFree.exe
Size
16.2MB
MD5
6941b02bd3846caad086353b70264f09
SHA1
e1c7389d804a9ca7d53ad9c1b60718d0e258900e
SHA256
9fa02f23b5a381b507a923bbd93452c20a3aa12f585ac04095a383f9939a214e
SHA512
65554334dfd1c504ee087356b9d58aa55f376276f957070f1f03a27e1b38ae633934a9f726de394c394cb22581f23f8e155a48ff76549e36910a9b3b95b9daa3
SSDEEP
98304:FHMwajbQfcYf2MUzwcGD7eFRGYmm9sb9kHVc5XzVIhGn4+InpYY4cTVw4k1uAn0U:FCj6YMe6AsxkHql3ypBxk1u6f/yKseWi
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
D3D11CreateDeviceAndSwapChain
URLDownloadToFileA
DwmExtendFrameIntoClientArea
RtlVirtualUnwind
GlobalAlloc
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetClipboardData
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
CoInitialize
ImmReleaseContext
D3DCompile
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
memmove
__CxxFrameHandler4
strcmp
__stdio_common_vsnprintf_s
malloc
qsort
fmodf
__p___argc
atof
remove
_configthreadlocale
WTSSendMessageW
�B��|/VY��溚�����W�\�Z��v����xiw��\�9]�,�_hM=�����r}!���f���������� _��mfP<XSX��S���Zצަ�_�&W0~'G�WEw�a�*X��S�����M+�E�p�@�Kb��l48KqU� s�MdV����:�|�K�_T]����z8������]N�d�3rZ���]�aI����Q˰�~K�O6�\R�F��g���<*� i*}�aeЄ0���)��3d�Lp��Dh`v��02�0&oV�0������ 9e1U[ ��cl�+[͍h�)��[��6��Q�W�!�1^���t\W<$#rxCcw�>FB<����e�a��q�:�?J�+�KO��%�p.�]���M����c���-Y��]< �Q��oF���� ���ˆ1���=9�J�����\�&�����r_�AeG%��á��o`�).=�����A ���B�at���C����i1��=q�o@�4�}��QJR���!0kg����4s����{�������"2�&kxM�s����K9'4F�x���8+p*��+E��NA.�D8M%���x��d>c����m�w��o���sQq4��R�ݟ��ƪe�:J�1��GҡŹU'�S��Y��sQ�:ӓ 8��#bdl k#0GPDȗ �;���4ޥ�����Q����{����X���ɤx�}��Q��U���F���e�&>ʀ�C�y�ɩJ��|�G�|��,TKj� YT�=כ��(�rֹ���r��N�.� �fcȳ̪3�y��4���3nF�Ҧ����� TH��5",�=��%dY�o��J�KT ��K���͈?p�=�=����?n��m��~�~OG����!'Ӹ��P��p)o#�����>{R)͐�}1������試%|�� � r�j%+.�32bP�v�m��!�Q*9~�?ZR=��4�J{��+��=�Ⅶ�V-W��-O�>^���A��G�Z*ZԷ�wq�8V���vhV?��V��T�noH�4��H+漼��G^&9���O,b�4��P?��%}��D�Ͱ� .���k��^T�����[�|)��n�qOz&�|���f\=�M{��U0&��dŹ�^�>q@�;)@b�{!�+;�TL�_ݳQ�8E&'�ܡ]���>�<�(���c��Ac��Z��� �Vj�n]ѩ���W�v�'�㹏�����t0��U��4�c�&��!�ג��=1V�f7��/�<��{��WllJ���Ki!x���i˫�I*��`�J�!���.@rgV���?3b��7����!.#�;x��%���eJ��3v&{�2F�כ�H*ǰQ�B2�VG7������p�V����� �|o����:�s���Ŭ�\��Y�Q*')�!��S��A89�˱�{���)�4�0��AGE�U��1��3�����f�A�����)[��ܱ�=.�!�3} t�w��Kf ��EA����F}��8����ki7�#�=LE�m:�9��7#Z�c���!�~�����&!Ùʎ����Ƣ]���?��������{�A%U_W���G�jgC���>"��Rq�nŤ�U��*����p�@���ރ�nmz=#1"��.�w1/�RPa�����Ca7�c�tz�!��t@�U��o��!s+T��?��:m,yz�e0/_� h 9��2���G0Rg����V$ތ������i�x,vvy��t�,2�(�[�f\�w�v�GO������|��mr+ꖛ��w��R��ϣq^�L�I��g�Ku�8��6+��AԆ�WbD˿J��o����b��n��az�U��.X[o�tP�Sw ?U1#��a~��b.��(�����K��%^�;l�ͯ0L.r���M7K�׀uX"4��t�w��&!K�m�ۥ!�$7P��ƤE��9��,��V�XS��^4����kI.�KK������vB��~D�Wk���5$Υi�/��N�cM ��HR����>��D,�^���6�B��n�� @���F�[�Y�F��!Z�*_ڦtc�SDU���h~.�R{榿Q�����94��K�p����#l{�=�F���پPgO��_�C�K5t�i�%����qZU��3��V�Gq?�,�Z�����l���D�愈��\��� �a��ƴ{e���n��S�L;щ���`�^�9 w��@�����z*j�_"�ȧ��\�H܉�݆��or���s��yv�:�Sq�V[�h���eE�Kj1�b�MV���bu��y�C��w��C��e� k���G$�Ox7,<V�B:��yX�`ry���f���zh�~�����l�>F��x��m�2���~ރ�d ����Ͳ��s�J����䡛[��k�G��+s���j�x� ��a�jg���)����a�e~�DŌxG����N�"7\_�`��"� ���u��+�ۃ5ѢA�ҋf���2}'��_b�1��2wO�,*���0*�$�(/E�O|���V�u�t��άP�b��z[2�a`����2��E���f���S����I�A���.���<�~��T��Q�1�g��@K�'�0K��Ŵ"�iW+���R>Y���玬|������:�;gnz��1k0U̥IS��Ґq�I:����@�n<Vzv�.:�a.��s_�QW��b�xZY�3�'��'�}���9kN�������F��^b�>_?��y5��0��c��gq�x��Q�z�`�Ʈ�M�xB�݇9��i���d���i$�������h2�Ő��Bu<�X��%]���&���f�5��R=\]&r*3�}?Ӣi����0x���Ъn ��(��Hrl�X��<rL_3�d~/�]l�FA4�=���#S�z#�jܘ�E�u�ax4*��1��@���~�*Б:�>]��S�t-�X M���A��}���X����r�Y�֗�:��W�cn,������>�檱fvb�TugZ�72U����I��j�D�HĴR�3�l���s�"'NʗX���p��w�ͪd�C�#_rޔ{{âe�#�f�L
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ