Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
td2.rar
Resource
win11-20240426-en
Target
td2.rar
Size
20.1MB
MD5
9f5b6d7c28b37724487075da1b18c78c
SHA1
5c5cc263ff07f8d66fd04ffb50439cbfba4740d4
SHA256
5a346a9a576dce2c0e210f455f16d4a7895689831e8726e4414d328f3690092b
SHA512
d29a9b1422f903b9f52adc2d04b8fd26f5b1a6da763dddf375d386b13073239640b8ae44c9511b89494ac06dcd52bd110033cc02cfd2823a83f37b2ad264b9b2
SSDEEP
393216:59Lqb1C9GbQASJddtvDv3oo+dehFtetuc8tvBXWtCfY:59O0YMrhhFgtfCGtD
Checks for missing Authenticode signature.
resource |
---|
unpack002/osurx.exe |
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
d:\projects\processhacker2\kprocesshacker\bin\amd64\kprocesshacker.pdb
ExAllocatePoolWithTag
ExFreePoolWithTag
RtlInitUnicodeString
IoDeleteDevice
ProbeForWrite
ZwQuerySystemInformation
ZwQueryValueKey
ZwClose
IofCompleteRequest
PsGetCurrentProcessId
IoCreateDevice
SePrivilegeCheck
ZwOpenKey
ProbeForRead
RtlGetVersion
RtlCompareMemory
MmGetSystemRoutineAddress
PsProcessType
ObOpenObjectByName
ZwQueryObject
RtlEqualUnicodeString
KeUnstackDetachProcess
ExEnumHandleTable
ObQueryNameString
IoFileObjectType
IoDriverObjectType
IoGetCurrentProcess
ObReferenceObjectByHandle
ObCloseHandle
PsInitialSystemProcess
ObSetHandleAttributes
ZwQueryInformationProcess
ObfDereferenceObject
ExAllocatePoolWithQuotaTag
ZwQueryInformationThread
ObOpenObjectByPointer
KeStackAttachProcess
ExAcquireRundownProtection
PsLookupProcessByProcessId
PsJobType
PsReferencePrimaryToken
SeTokenObjectType
ExReleaseRundownProtection
ZwSetInformationProcess
PsGetProcessJob
PsLookupProcessThreadByCid
ZwTerminateProcess
PsDereferencePrimaryToken
IoThreadToProcess
RtlWalkFrameChain
KeInitializeApc
KeSetEvent
KeInsertQueueApc
KeInitializeEvent
PsSetContextThread
PsGetThreadWin32Thread
ZwSetInformationThread
KeWaitForSingleObject
PsThreadType
PsAssignImpersonationToken
PsGetContextThread
PsLookupThreadByThreadId
MmUnmapLockedPages
ExRaiseStatus
MmHighestUserAddress
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
MmUnlockPages
MmIsAddressValid
KeBugCheckEx
__C_specific_handler
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
ȫa���!x���b�������{�>B*�&(c:Z�{;��B��;2�ΐ�2��ښ�v�?�f����H���.^�����ڵ�Ȕ�=h+��k�wM1th�Gv3k��'g�ۆ�Ru�r;W^�f�� �?�k�pā����NI��6^��dvL�W~nob�7��g9+�����2�G桚�[C�.b�����%��S�њc���-����u����R95Ո%�$�[�s� ��&�$�Xx��`#�ֽĥ�T���w�܆;Z���*r�,���`7 �Y:�+��� 9"���hswLQ�_��~��+���t���x���,�;�P���}�fA�mT�+�u(��Kj�[���6�<Փ���l�:#� -�IU�\�c�}�//e[�0KTB�n dV�����n�G#��nS���<C������e]�����d����[�8 ��������m�Pޅ��;R�ժ ��Q�K��&���e���$B�U�w����@=]���p�Fe��\! ��:�TQ�ҏ(~rա^2��as�a"�t��~�G�0�O�b��3{5���Ҹ�{�3��2�����Y��I���Oaq�R"Zy�? N�\|��������%Qm���Y�ג�����7��J^��J ���+܃1d?���du�8����v��vQn���EE�Y��:Z��Lj�[�D�����'f����gbɹ��i�;�<}�3\����T����B���� ih�|��;��6�����H�UB�v��˨�^Ç_�<z��U�ȡ��w���Qk_�i�D�X2E$���������@9tz����|�K-��W^#[у�t���q&%��j��~7+?�n�'��Q?�#�7{Q�fy\�$�>ʢ)C��)���f��p9�-���l�Ѱ�fӂV�-�O�DWN����=@c��Xs-M�����*G���|x�F'�6���I������W�=�U͘f�$�魮�+���/N��Uى4ՇT��=���2va�նoy�7'/[31A����� �������2(\-���Ⱦ�M���`� ��걥yf����o}) fSUڏ$P�d����<�c����{�]�U�����v7�B*iw�Rܢ�&d�W�9����#�}�E�a{I3G��ex?>�-B~O���?��n~��yc#�]Y@�`�%>^婉[3i�* |�.e��N��d��[�i�f� ��\�9\�AE�9��5���K<ԭ�|fs�:I�Li���|�',,&���ؖ���mz�����L�їa ���x�@�L�K ���줵S8 ���gŃja�r�[�ɚȳ��Ғ�eh+�"��K���U�=U�5�7�"����n��/ű�t����AT�<hп���٫.�R�]Xj�m�I��� �;��F�����Ign��{; �`٭��g�q�R��X�A��~��U��svqW*Ŝ�b�V�K�ͨ<���� �w��f +k���Ԟ&���������a��AdZ���-�hc�`���[g�!�}�,�H�JH`�xxaF��/��@�<�$�OP`�������N�2;���P��ޡo-e��b��e�-w2���U|}�y�+0{j��)�GK�,�ؔ!���V�#U����)��X? M2�SA����D�@s�yy����hJmdEZ�y�0�Ir���ӊ�ѫ)q-�� ��UP7�\H1<�/Ov��B���[r���#�JG�z����7�M�QZ!�����N?Jߴ|.$�!}��w��9�_���$���vm�^u��~�1S�����F}�]�pў] wV��lϔ�������������φ.�����^��:�'N#��TM��-b uX�W�����1��6��]}Y �X\��с��=����n�9��+��,�GP�7����N�eOP[��VFľ�J,bMU���@(<���x iFP�+t��X_@ޖ�$�%����C�����JXE�C��@�1�w��%�D��d��9 �$�. ���|��+���M�{���������xH}���`1N���V��1\4�9xCY{:B��/�>�5�Һ�����)]wIt�mC�Ev0��諀��_<�o:�Ň�~}����*g&������z����t�mQ��"�mV��녵��r���n��@ZX#��կO�z��;�a��bx�[h6{t�6 ��gP�c^zI��Z�L��gܢ����U8��O�l,#�{����y4�_L,�������#���M��J^�G�+B���Ĭr�~�7��G1� 7��<���JV,���'�sg�"a.��&�>�1>zU1L�����Vasm�����rM@I�B��c-4a���oŞ�J�[?M��W<�iٖ���zMu1b�������~g��~�}3��p"��.�)��Z����w��O(fvG�9qt�-#�]m3��wʜ���ev\Z�dS�J�9��va����Ս��J)�jc����}���$c��jU~.��?���~3k[�cܖj�)�#�Z�q�<eU�b!;;�UG_�iʌ��Jp�����t������ 5�iq��u�=�ER��#���ɕ4�����+�@����ҭ�����X��v����t�ی�t�cF��)T��Ε��El�B��e��S��� �|C��MK�sq`\W#��� Q�x��Gc���KFt�Tט{ LNa�Bg�Q~`� �p� Y~,��Ӛv�8���=�i[29m��ua���Ѧ��S�d��l�lzτ��4p�Y�w�/���AW8�<w��b>����\I=��N���"�=�^)�u%"�ہ�� }�@��u]�g�a�X�X�M���η��`�'�H���HI��)�+Кt+0K� ��0YN��o�gye=I�̵̥�\��d(3%mA(��p������2�����u@";pkV:��][ ᭔f���4�#�2�*��y�!��-ww��6��͌@�B#�ʺ>Lj3=g�u�n<x��+PJ�rD[ "b��3���D%��un�.����#�ژ(#�S�U0]�s8�i��&���v,l�k�J#j��\V�����}�FÏ�I���OU^���[:�U�F�:ʔ�K�a6��S�����j��`#��}�S)�2��5x��=��%� ��0�f�Jz�Hx]�|'�xr>��&�R����ǔ���P��s���E�[�V!�����݄�g<4X�~���D7�з�$��N��)�^�kb���ˁ����>����}t�P�X��cB�㍑�����G*C�Ԅ�o��:����W?F'�w ,?dl�(�S8�4����m�@�������rc!?FF����/;��DYe�/^����ȃ�w��u���{�LK\�J��{�]cRNt��:z ͡�2v�%Q8HiQ�1�Ϲ=�^��3z���a�CJ�M]��#M ���F�D���v'KB�n�OP�F�KC9 ���r��ӕg�rf"k��Ro�-k�)���;pk0`X�2ض;e�>��) ��EB!ɱ����$���J����I�+,WO��%<t����3?�앐,��">i��t�3ALW��.����#��%��O�Wv�iR��Am������$�E$�e�����Lɵ��������ү��y���&��Ó������mB�(���.$��Ã-(f��@^f�Cw2�?�N|���-�SM}��,�K�`���Ͱ���уq;�q������O������K����$ƘT�U>�l������;fYs�X�K��J �7>v0���#G�)'�Zs��ˤ�^����?�Vbl�?�B�o���*c._���
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE