Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
setup阅览6056.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
setup阅览6056.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
表格32116.exe
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
表格32116.exe
Resource
win10v2004-20240508-en
Target
12x.rar
Size
2.6MB
MD5
92dcf07c823d3dcf32a783f78b42f0e0
SHA1
cbb2ae1a18153d1057b8b0cea4e089f06af0a5ca
SHA256
d42a6979a45d16942740664f324dc160f3371ef5176d2839722f79dd4ada75fe
SHA512
7417ad2e37d1a084a113d7368a3bb5c9cf8418508be0c411d4ef4baf5481006b99ec9870aa7fcc820b0dc96c0c8630304d40c4e83676a043254548c0b3a1202e
SSDEEP
49152:JoRLRxppZIivQ24Zh5TDhzTEgTJtjNbn6oyUZ+x5ChYb/krD9bysXZPpLD:JK1dkl5BxtZnvy9nChtn9bysBND
| resource | yara_rule |
|---|---|
| static1/unpack001/setup阅览6056.exe.vir | vmprotect |
| static1/unpack001/表格32116.exe.vir | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
GetVersion
LCMapStringA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
CharUpperBuffW
u����AXW�3#�3��2����֭w& �(Fg&�������@5��G��^ i��Hx*�!z�yS��s�!�P�GS1�ؙ72�UR��#B��rk'w��IU��]����V2!���8��>�\D�����|��APe67+;���F���2h�/x\f��{�P��H;��C6��pt��� p[�`���W��� T��$��=F^��H��XVt�~��p)�B�1����t�V9 B��&����cg��\`��)����%e� �kyG�,R�YGѥ*�A��+^;F5�F��j=���א��J9s�/�5��}��f,[��(.��ƾ�-K�4^P���BܺGm.�R�.d��ƛa������~��5���U0O�n����^����k�aN:~y �gU��#��͜��#�7+t���7A��I��@>��فk62�:uCkd��k�!��c��g�C�N$u�ؤ*V���ف+P�_�Nib�_�J}+���Җ����}�g���U298c+7ML��&�v_X+�[,6l��K��.0������a(\.�Ⱦ�� ��E�~<6x��N�Df/A5s���XHڇ�i(e^r�������P�3�+Ń���3>�����Ѫ>E���G�-�@E$�b�Mt�|��i���"��P����Wԫߋ�]��o�l�������Az� M�::c�j�쓤���~���\L�}�`�c���CV?��7,�7�ҟ��/=~Lf�>>���ID �]�ޚ�Lj����eZ5L�F�����B;^�v��%Q�sΉT�l�p#x`7}ߚ{H�4_1�X�M���搷#�t��3]�+��{n<��<�Z�p������_Fg�W�'*#y�y�ͼ8G�e{���-`�-dzx��n�J�9�[��v3�0͇}����W�\�P��`2�`�̖�QGF���i<�((j��U �������,mL7e�8}]*��n�3`�C�!QA����V ��^�F]g�>����M�&KD�p��]���l'Y�%t벞�z~+�bK��^�ɚܣ�4�ï�D",�����A_ȫ��[9�|9.N��}��|_�thk4�c�ӀB�#. n����{�o�x�>T��|nO�`S�"��������ery��lJ�K�OLD5�Ez 3�[�lkˉ����&�R�嶹X|}������;��� R]�#�5ރ��/�]��d��e0��'��*��Ƈ���Dٝ����B�*`SӴ���+�H�U)����Z�1�����X���?�宐H�({�q���sfy8�� ��^��o_��c�41�l߉��U����z���{GY���O碆��S|�̙�O6�0Ts����\^J8�; "jp,��v�5�3&"QvH�:⤆�E�,�*{��,a��X3�o��б��p�'��<C&���mE�F�<�p�=o=_T������9���v1y��MXɉ��f��6�>D�H�WđQ�,�����Toq�:�[SC˓�,�j��%M(��,�(!�m�;�& jK������EU�;����� ћ�Ȇ0�uo5v�mK��"'��˷�nv#9=��k�0���&����ђ҉��M��=�GM�}w?\�]9��ò��Ug��#)ՠm�F�nz ?��^n�^���19���D��\��� M�0� c��:������{~��D[ ���9�mdNM�q�v �O�'1H�R���Z���4�@e,B��t=�R��wX�;������eO��Z���wc�~8���hH��'���y�(따�E�0q��v�F$*^T�0�_a�l���G�6�%�[n���e�h�Z�4p`,v��+Q\X�-��?XM*�\E���5�=������b#��;WV���|FK��Ap�o�2I���K9~�#�X��\�Ϙ}rG_����6�\M3ЌB��;,�[(쇺��-�t�zm�n���"3�� �(0 �)�Q�2�Gu��ڪ��H)�y ��'v:��- ��P*�,������\�5��!3��Ѳ"�rw����cN��I�aM�Fކ.C��S<�Ym�IX/��9����+:�y��R�k��A��T�N�E�'�ނN� 8�3���s檴��V�h�<��P��&�"��i�O`��ƌTM���w���$J1�x[z��/�zZƶ�?<�/��j���e0��F���f濯4o�yx�����ҢD�ڐ �/�īlka��=T�V���Y@�s�FK�KD͇��Q r���$���'�D$�C��}�ˀH�ҹ|�r3r�M��;��=�{8����:]�>�u� �z��#!�&�Ю�i+?���5z���zU�Li��( ��([ڹIܫ#�� �jHW�#��J��@ ��X>��ou�^2�$��r{�%KnT��*����~6�0<��w��\d>�aBX��k�9!4�U|���ډ8�1!�&�V���?=��K*�m�$��,4�_m��N)]$�w�d��y��Y����k��ݹ���I���LJ i��v���{����W�H� �i0� ����o�@��-C�JS��[��(�H?ٲǛ��q����Ou�;T*O �t�*��Iy�ŘK Æ�FR ��WlM&HY�������k)� �h#D������Ya���f2(N�4ۗ<5����r�x ����@��$<뉾��[K'�%��!hp��oK��S���IOUW'� d����BAmA;K�����P���S���d�q�ce>aQ1w�%�7���ZE)LB�:"�:�9��A4�d��e�E��A5�rz����f&?É�Е�d� }L-�7F�ō�]T"=�u-���:�)�+u߯�X-��*u�}��,����<��2���l�?��[��荻�G��< !3�`�i��B%D�Ȅ+�x.�fr�|�C�U��q��lcf��S�@й�S$g���k��K��v)R�#�L�-� �@'G���6���T*�(|Gi}� �n]l�6������=x5BU��/�a�"[��5GCI\�Z���#�|hL���3�J�0��U����-#�|��V�Ĺ�&�:�A钢�:z��hg���
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
GetVersion
EnumResourceLanguagesA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
MessageBoxW
hbG-��%+� 2[/w�Tz���LaS_��M�J���<%��j��:I�;*���u{^7�/���mn��������ˤ�oX�T40���Z �_S�Y���^,I3�KŻ��n�丝[09�UD��y~��`W��g�ݗdd�x���~/�F�䝪�'������k���/^�W��+XY8 2��=�*���h�������[hC�¾4{=a�~>�����Jp��iv(2�0�$�,���y��E�B��㚅q�S��,��[:�g �u\�$�d����*�� ���c�h�ި�����ْs�d��M��x8_�#"��4���N5�X�t,%@�f}sc�Rr�<7o+a\�D(��������c(��Y�ڮ��(Jê�E�#�:�RA0)Jw��-ѲGY2P�Z���O?%"ݍIE�T���Y��� E3Х��w���|Uܝa��E����p�a�'��H�h3���G�J�L���T�c +4��^��긲�* ���2�m�d$io$F}-[��yq�4V�Q08r�.$��)�k�{8�Yn�%:߱*����Uo��������l2;P>���π!�b y+�,GSd�C��.} I��!SJ �|�h��7x�6�F�{�+��u!႕7�?[s���F��g^K�?�A�KA*q0������Xxه�FB"iGX7�wQ��l����r~��ዾG�It�Y�����v�����Aa�t�.Ux�rZc��%���l���F%�����-���%�kՐ?��Ƌ����-���%�e���R��E�YuU�q�v�9.!؇iXSu^�nE|϶�2F����b�[�,�\����$������nX�@�l����߿�* ���x&?����=� jLKE���;{��n'z#�N�FZ�a�g��Φ|���bt='#�y��2� ?4O�܋�Ua"} ���ކq^���ä����s�Z�?��l��`1��`��n���8|wE|'��O���� �y�`@�'�H�'E�Q���~�V�+u!0®��j�{R�g�r��9�k�=�,狦2A-�/�Âc�����U��R�\�V�r����'��+�i��H`���TS"���ڹ7��B#��wwG�ݍQ� ]M�ZQ�J�Iӈe%���`E;˖�2I6sm��e4 �K~��r<��?bv�/b�jO�}�����;�VL�A����$j���<��U���*�v�>�?w��)�W=�v� �����:���d������1�_�>6�S�>�I�%�EhU�9Ŋ��|����D#ϔ>�0,3�ӽ?a3Q+ģ��D�q��o��� k��n�>�#�zt�/^�"�!�?e�'�bu%� "��3K�&"C~�C����ùOV�̂����� ��xs�� K��"?�WK����N���A��:�yXRǚ�t� ���+�.{'���d��� ؏@ٱ��3�v� E+��,����̋�5�f����Hl���۬ C�I(�%��D��~�a;��Wr'���g� e���B�C=���8. c��I/d���9s�øO*��n�ȗ�t�<��&\�Z|�{Weie���F���l%$�h^�ڐ�����8dU�'��]��x�H�����\���ķ4_&`�� �/`����k�4R�����!X��h�M~���X��w54���\��}��5�O�"�s��W����L�|jvF�e{�!�� �\D�����X����bU�yp�Uɉ9�X'���Ȥ��w���R��8�ܪ�z�Ʉ�Q�-���;\�7���Y(���������T$�</+��&����@�j��� ����ڑ�o�����s^�N4���-��wSq�����j��N�[S�7�3�)�P��X�JZ�E=��� ����朮���n���# ��mhZ!��B)$4 S�%�nhc��af�F �:�������;;���TYB g�)��*���(ݺ@�D���?�-��h�A(Ye�X*��5Oԓ��|P�t��9/�!Mpo������n�*�����y�4c�0��cK�^%�4-t�(��4����>Mw+�����TT_5%z�V���)�ıK��������ܙ��-��S|Z;���[4���n�Mc�Qc]�:���Q�ˢ�\z�h��)L#��/rX�d�$��^�'�n�t��%�ΰ��X4 U�_+�����`�_L>ˀ�����+�8��V=��c9y���F�˵��t�������5�������!'��Dqr���i�142s��Q� |C8�v&�QѮ�I_�Jʼ��ցK�%��\������L���C��6�r��f��LLmk�c�_���m����g9z@3���^��Ҵ�U��FapU�0qP���k��M�ɴ��λ}[�A=��9�$���X��ťm�:?�\�3˻� 1� ڬʬ�LV���.�� zi�e���3xn�#���X�����%3>&��V��Ȑ'ěA��8��b����[�zڄU{_Q��bH)�;`�K�%�Ѩ}��LM��&܀Rp�����K5��i���aB�3���O�����5a��V����R,���@ �ɴ�a�%U�g�D'D�?}]G����b�:�X�ۗ�w�PT�*]�����r�JMc�|���+!��l�+UMע ���U�yS)���)b�o�����G��$�$�t/����k}:�k-7��R{M��� ���6!�,�����n�'�o�X�H(wn8WI���8D��05�L��D�c�1wR ��~U���:��������������)9�":A.�3�3�V2F�3Q��%�}���u�*��1��-l����z(���C�@�Ir�ۘ�s���@D�~�W8uj�u��le�+"��N^h3ܙ_'��X9�Ч�vi��λ������̷%(�R�K��������>�� >a-4 N�m��L�=U�^8^���<��$����)'i���COQ������4+4�!-�HT$��~#j-29���I0%�Mz=�������[�� ̺���s�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ