Extended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
3ba457a017153af791cb1d90193980121750b4d9661932f8ba22370b7e49be3e.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral2
Sample
3ba457a017153af791cb1d90193980121750b4d9661932f8ba22370b7e49be3e.exe
Resource
win11-20240611-en
Target
3ba457a017153af791cb1d90193980121750b4d9661932f8ba22370b7e49be3e
Size
1.5MB
MD5
defd1593c4d9adc622ddcf38daaac65b
SHA1
cc12bdbf7834f5e6657e8e34a3b407a5a7aff3cb
SHA256
3ba457a017153af791cb1d90193980121750b4d9661932f8ba22370b7e49be3e
SHA512
0a9ceeef14df499467be9b275f62382e0c9036afde8a8196667acc85bc097c4805615ae75d37978133e51ff528eb214f35f347ac57348aa9c38a51e90f96db98
SSDEEP
49152:VhW6qDjofxCyXnOf6RxDWnhrvWRUqKXFi0iHLv82Zs:Vjsj+CCw6TDWnhTxXwTNs
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
GetVersion
LeaveCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
MessageBoxW
#���8�"M#���e&��ŏ;s�'S0����b�'�L��������[hYK��N����Ђ��N�݇H�؆��?��'��o���I��z�Q�F��� ���P�B�NJ���rX��5�V�]=��OdSRz�, ��<�VVTU{Ė���X�NJ�M�`�����"�o��^�ݲN ����2ma��/�[h�o������aS���<}�@D;�������,]ϣ/RN�5�, �cO��h������@I� X���e����'|�-����̈2{{iC�J�l�"�.���M�����������x�hi�D���s�����7��W]�+���*x �<BtǮ��'z=G<���υm� ��ݺ��y�D#�7Vd�Ͳ��« tyN����f����=G�A��j�̵��t����0�9`�<�0�c�n���i��['��D+���-C���+��'�{Ce w�<ŏ \���РVJ�����w�����LP-�����_��������P��Ҍ]+�/��T��oU�SW>!0���;�Yk��S�;j� �r��n��v] s��=��E(�2UX_�����K�hmN��/�xN&Ie��u�WL$��c���s9����B�͕�S���k��+��^��?�b���-�F�?�α��Yg" ���6�y!���n��t"_����3m�]^�� j���=�5[�\�'\�\��~�Q;�?��.!o��Λ��Q�����HJ��X"t�O�A7�P��+ud�8.� �F�����<X}v���2���c���ë�E��?�'Po*�]^�X����m�cq.C.�:L �џ�ڹ��w�Ф-ܒ�z��p��i�j��Egi? �� ӆ��^�oB���uP{�Wɋ)uE�ӕ�ܻ���ʗ&9ΗN��J��+x`��#�� �e6���XL_�ߊ��/��d���Q�w�`��U(��4�7lLM����#-R},9�}2[��$6 eG���U7�;;4axntt��u�M����+@�)Պlբl����t�I7�R#��I<�9QJ�4�i�%B0�DQ�2����H�&����TFNe ×�H|;������]ʅ+���_�d*�rW�(�l|��U�"���O+�7Zed�ab�������v���ҿ,�I=o�2(�qHn���w�M�@K����pgmҐ�S�h���;�G.p�H�j/�.C(�� �L+�;�k=A�X�O�ɺ�o�H�wA��o���!�뢤e�[�m���|�T���E$���Yp�N���U���?j^1ޢyj�<��Ѥ�v#��6��C��Csj����,HR���أ��={�����\7���*����u�_���LP��2P����w>ў2�d������]|F��)���Jf� �;H�1T<9���d���������bvkO �[��m'�� �ʳ��?���q�sb��cn֔N��|��������k�4R�D�� 瞑WP�k����w���T�uF�\���9��� XS�sɌ�?wZ�]x՞h&��?+A��ۑ�-�����8P�A�^�P��L-�8E��,y�(VC{�$#%���a}}��[��1MMє�t�%_Q K<�w>���R�g���������^���" ��qC�Y��sid���(J���qP�F�����5�32!��'e؎�� t�����������rF�x1�&e��e���Z��$��WpiI;�Gh$lj +��o\�h�9cZ*ac��mS��9�C���� /S]��Y�`�2^ä6�SW��VU�U�b&�->�~&ܵ떎��hj3�M�7��ޝ�?�7�@�(�@>=�]��|��)�/ �^~ڮ��9L�+q�;=���������zr�^;c ��ŗ/�&x�\���&��;ZF�%#��Q���`|�ofĖc��a�?����n_�d�_�|�=�_��o�B�,��[z'��c�e�"�������=?7]WΈկ��u��C�%����?��mCޘ�-ĺ���h�ߩ�r����U �86�����v��(p.��1W��9��KWi&á��L�-�Ҹ�`%�6H���:V�#�`�.�2)&�]����TE2����B�עm�a����ںT��h0{=qM��l.Z�Ǘ]�O' �l'���h� ��d�$x�#c���]�̠��Ի�9_.�x�fu��:7s���-hs<\��a4j�H-c�!x�M�k=��78T(��Vr˰�5$���}�?�lw˛��s����R/�� b���8r?F� �VB� Kj�.Y���f�[��Kj�w ��HՂg�s���|�������Ŗ;c���Z����f�A��~9��tf�'@�����I��E�0E�����.� ��f�u˻=�������A���A~�dN��PDe����!�+'FNj��@��/zN-W�Xjm���:� ��:(].�^���]yq^kqu#V�i{���FK��AdA�+�@3�B��3��`�4!K5�Zb��،WK�eʡ_�3Zң&�����a�:.�Qv��[St̛��,����R������߶��au�����%����,�h�?(�P��P���0�j�:�I(��'Vc���iH8�`x#~��n*���d+�K��֊��u����4 �B���>/[�ؔh^������o]�\�y�7�\���z(�rFC��5�s.=����cO�-k؎�����`G��^1������m��#��?���`⚁�/n�U�\̡�}p�L�C0��7���5���!3f,?W;���/;(��t fbϑN`�S7��.���xw��*{4��t��-z�����W~/m�!���'�e���sLP��8�(�)�)"4�o9��M�v��3�!��@�^>�|'�-��y�k�@IO����)��Q>��w��-��a�%&x���z͝d#���t����Y2�a]ix6���p�+��&��^�h �C$�(���ְ�c�{�d�'��͜�n�G���J��B���FjG� qv>9��g��n[E���KA ��z/=]Ѻxl�����}X�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ