Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
表格6005.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
表格6005.exe
Resource
win10v2004-20240508-en
Target
表格6005.exe
Size
1.4MB
MD5
6fa496a157e95a740b8c2beb58709329
SHA1
c4b6a3a65c7d222d7104f2d0094efce6e3733b2f
SHA256
5b152607fab9c6cc27eb250432e7323207e0309f965b78ef6a8f73283176a6b3
SHA512
eeddca300ad46b548e460a0be740583fd4c6dc315edf7b60b4ffd67b112990a26fcb4c513f4791bda01a3c7a02669662181d9261b5dfffa623563fae3599fb24
SSDEEP
24576:ZHfjF6QEnf7Qbe0Lk1Bk7p9ZRv4D++UIAJq3cRBJdyhOaxHu:L9EfsbdHRRNNIAJs6BKBhu
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
GetVersion
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
CharUpperBuffW
�+G�c-�*�BS|��p������xS��6�Jx\=�I[�����Nh߀q��7����ʙ��9�u�:��7�%�B�W�եz;�p�k�8���bDL®ZLw����s����- Id��S�YMQ&l�JP�)0F�s��%/Nr���;���N��5q�!�A���P(}�g]}�]8����&:��Q*eԙ6��0;������g$X h\f������xu���]�!c�OuiL<|����`Y�ʩw��A��j6,]+����"��S�r��h`�����e�.���˺�bZ�TִrI|˂$�AʎV�E����!��R�tb��k��UHu6��.�-��v�d�Sü2͞h=�;f��9T�9VXD&В���յao_�R��bZx^mtw�T��Sd`ܬ/�: ����Q�"Ȏ����|�m�N��N~l��d�?V/I���J��:y�������T5pgcgk�Nv>ҳ��l�l����U�0�����w-�Ɣh��rjUи��^�e��ƴ�\��|�dJ�%�(��B�WX�<��*��-?��I�B�l|�!-6�r3so�U��`�![W��t�Q�,�������+;Z����x]�Xd�CaS���(6��*�"�LP�<,���y*����D�BE1��>����(b $9�@�~ɕ��$���@f_�_ZmM�H�3�9��Z��h�J�`]A�9�̟��?T֞����#[�z�&3,{[�*��!���ΰ�σJ�7�(�����T/���X;�$swT�+к#b�W���ε�"�%�P�"�T�#�>����~��į�M�i��t���ը�x���:T�A�~��u<A �w�C���P�����Y������;�s����T&�eZo�"4�_x%0.#�6�6 i�,���i�cϔ�c��k��Dh����<��w/6�$x$Я�X���9 {v���c�J���)�F�TQ4��<����D�ȃ�\.`K��;�$!�#I�:R�v��"T3*���p�|~�+���A'��tyc*��$ڮ���\ݷ'����e����iC�X�'�=x#c�p�"#��ʚ�ayAՂ��7k����֤�埍�:��q�N���O��Z���>HR@�h)@ +���S�^r�ǖ�VIn;�V!v}�<*���G]_6�B$դ������y������0=��ƞ�t$����+�av#R�_��ķ��B6���M�iҟ��P��[�i$t���!a��� OR:E���|�+q�y��u���"Cx�"�l#f9�a��D��L�3՚H��W�<�\մ��KY��r\Mb�m�G�l�9uÈ$��X��*Õg.�AN�n������� g�T�@T'��~��z�iE��2 �����1ġ�f������mβ�����e�v���0���!d��lr�à�j���#i�E#W!��P_�i�c���������<'E�P(��TAi� Un�>\��G9��Wc � <�3��.�ml��ϼ� ��P�O5x���v.勖��eWYG�����U1��������cN���+��"����r#���Z)���+':�����ZGx��Gܦ��������w]�JW6}pj��C���iR�4��4�,��YGH������7Ƀ��KIM:6�/fԃ�,4XZ��N]�iCuh�������ő��Z=4#�ڲ��:�g�����J��ۂ�*����������k��!���<���v�n�NYF�x�ՂT>��g� O�B��ӝ��^rt!�OO(m�a� ��փO4LF�����=���M��3A�&Bp�+����Ouq��T۾�O�L�q����w�ԛ������ ��L��hyPJN�5������X��m'.ԑ����0�ZxzXx����lq��؉�����,H�D�f�jW2�W�:��V�_�"� ~����P.����f4���1D���k��T= ����=TG���,����gܽ��38��l���;���N���"���'�n�ڣ���f�iT��3��o��R1�@��R>^�F܈��D�Հ�<�rB�f���|�`v ���a_�s �����j)W�kBey�+����}����2�_��j��"^��62�"2E��\�;��Ξ�7�Ϧ�2�-����Rf����L�Lmn*������1�O��?ѐ�g�+�=N��2m`�Y��ag�_�_���P��ȴ�j|3ͥs�:N�?�r� �tuo��l��=f�8��ߞ��Ğ��"�#u��#x�0��ެ"T���b�H.��j<��.��j��B�I�2��c�����������yت)�[&�.4�3+2�䔍��k ����qx���ί�g����U��Î:���_����)���k+�S����7� 퉈�dW�Y���k�jmQh������͎zeL��q>�j(�}�*�џ�w0z���]@�u!0�����N3!��Y����P�������A��2�pA:VoH�٣'�jh�>t�rш (�s����I���~G<���� }���aLF ��%�6|npݣU��m�$���xZ�7Il�_TZeGf���G�R6\�o�UP\��^��n���`Mƪ���@=��c�U��Eb��� X%��7B���T��K�eg�Q�p�`2�DLe���b�����`3J�^&���s�����Tn�Ը���}U�{+\��穥�gBy� ��`\�Я4�� ��xڰ����% sf ����U�2%{^���� �8���G�'�� �މ]�y ���N:�� R[F��첄v�[]����A��r�����u1�/���6���L\����⌟�Њ^���m��G#��#ꜥ�V&jA-P����4uc߯f�bC��(����S־��ք�����aɳ[�s��@^����q� G,oc٤����+dlb���y�����E��džk��ׁ\CP#V!$m:�;��k��t'��������Hۢ���TVN�t䀨�3�}9�G�w[�S����Ƣ&�!8W��Y��a"Mo>N�y qy���r���䢫��_�����W�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ