Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
TORONTO.exe
Resource
win7-20240221-en
Target
TORONTO.exe
Size
421KB
MD5
706d2775dcfa672f5b84c1664876d8da
SHA1
75a6836382435adc08b7d6c17e52ac51d0208e3f
SHA256
35c9ff44006c3ecd283334b1c398a416972a9db1b2b0431b4aa18e7a2222f49d
SHA512
36a04a2f6f3e54aeb83d84a2dbad2177c81615d5530789d0092e261d84abffb775b503fc1e651e0cbe58438834532a48c57789cfbaf9895b8b6a707f9bef724b
SSDEEP
6144:yqv06b36JzIwBqozqCwcEfqG+XDPcq+Mx5KjxdC4KmOSWdoFp1dDhb:Zb3KRXqC3wQXDNHYQo7L1d5
resource | yara_rule |
---|---|
sample | family_zgrat_v1 |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
NETCrypt.pdb
_CorExeMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ