Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
VMProtect_Con.exe
Resource
win7-20240221-en
Target
VMProtect_Con.exe
Size
12.8MB
MD5
b76394e5895c038e600e1fa22a627670
SHA1
b9f8f7c07f69c3aa5e4308268c02b6098664b234
SHA256
6c7d58b61c0127f07ad2c99fe760d3e4acc75119754497cc75035c62ef53e2ce
SHA512
5887252da53e1d514d3e8b4b1f750679e86b2c61239b6d9e8c3580ecdee391c79da71608962ae9b920e1d78ba6f8ab9d2c7322b30e28da7198ee8b70d26b8145
SSDEEP
196608:Js8CvGyVpzVjlhBN5nOkyTMoVD0Nr1MmxR/fF38cu3AUJPX6m5xz/p:Js8+R1BN5gTVt07MER3SFAU96ejp
resource | yara_rule |
---|---|
sample | upx |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
GetModuleInformation
FreeEnvironmentStringsW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
CommandLineToArgvW
WTSSendMessageW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
�jMi��FL�?��Ӂ�����ֈ����؆�>��yhuK�����q=V����g�>�cZ�vz/|}_=���'�`ݧ����: ��l��ߣ�]o��\�HV�����j�0)и�0{�zz�l�7�IQ�ٶ6�^��7��>X�<>gw�T��:�R�i%(�̵hC�������E��,�e�������#E�J&<}}�EH��T��pHH<<8]?��p��'�Ɨ�n�`���xJ��հ���l��C���^{}.w�������^S�#c���b�5��Z���#��d�^��]�yXͱ��eI�즘�HS��~��`]�?Fn����,1���?iB }�ᅴ;�����*�V�]:v�U�=��ht�O4�GIJ�p_�e:+YZpmU������ �<Ɇ�hHΡ��4��6 ��Yy�=C!����Β>�7��k�f�xg�����gf�1�3�[0fW�^pZ�0ؕ2J@K�ёb�Q�ᩣ�c:�[(���Մi�l�{�jL�����9�ӧ���'�sjf�*�%��a]Fj��#�I����TKg5M!��1sm�Vï���-�zswG��H�P�e$�32�9lt)�dgWD��c�p/W����x��eCl3�M��|�iMn������:j�k����ـ�yy�=�H|�[ A�t�Qv�����g6i�%���1�k4C�k8�U~:�2]���wx���N��J���~�D����� }�]�D�we��l*�I#t14��L ǣ�2D?���j���["�5 ���a(��8LQ�t��0{�ǿ�B��}�l�C����g�C#�N,������c*N9�g���'�XQ��Xܽ%�����2'���dCi���� E���'���.��o��M���{�{ā��$��:K<9b%�p��7e 3/էS�,�sQ7�O����\� �����J? v��K�������ݨdqʮ��/�����tV!5��C�k��m��Q����FZ%5a�� ��J����i�0�=�gq��x&������d>*i��"����U�T���X���5$�����Fkֿ��Gj��Qyg��~.��A��|O�C�1������{!��Sq*م��L{�|��*�0�����G]�� o�C�$�����غɚ�l��R� �hyB-r��k7�i���7E�H�U�x j�����>=|��b��gK5��Q"���?a��� Y��g��_�:@�R=�=:!�`��r�N�26�|�I�N��Si�S8�V������I`� ���.��Ē��E;5o3qYP���sVʓu5:� o~2�?t���j�x��`���w��lW������#��͔`��=������R�;�G� 4�Q����Poz�!~-�����0�^ౖ��^�dߦ�R�i���T��SLm���,s:}�VS@y�X~�Q���B��ݦ*��T0S�)!Wy�[�:���"�b꺻8�V���a���IE�A���.2�R��vX)W�����Fc��e�{�@>\����� ����Q�d!8�Ȝ;��7��a5W1݄�|s�8��e#�ėf��-��J9E�i�s�]w��! �^�y)h+[9��{���pjﳗ��鉽j19�e���N�6e�u�S��������a'"���8Z궂li �qip�2��bc�)��h�h���$��[�e���@ ��n�����$��[���^�q|O�H�KцA%,�A:��O�?!�#�@&�-�A�w-���`y%r͢X�z���*�,����m�r�5��>I����.{�_���b{V�����*�1=XFz��o#�h ��r�)�hY�Lp�qk��5�߽�����ޔ]����R-IH��� eY��k� [�xj��(%��\��n���8l�5≔��?��Z���&������q_r�s�Ar�?�̕b���b1��C�q�PM(�5�,D"i�f��|5�]8�b�X��� �38S�y�y�Zp)薉��R�I ?�a���J߹H-eOcy�fְ������<��Z+�ވ����b�L� �e�U�峂M��Q��SJe�=:�gG�CQm��r�I��Ȯ��XT��܈�@���[ �����A�w9yW�M�9�̸xm�/�؞����Ūm�yX�����˘�ˇ�����������V1�c�mD� �o�����7���&�H���0�K�/?GQ�=��Cӄ�]��#�̇������gt~�E3��JE1w�Si}}�d�%�{�~�a%��ž�+�e<`���8R��4a?�m�2�}�/w~���:f�!��N)��牼���k��Č�b��,aT���,�$��v��Bz���rt7��m��x�ycD��IMpl22�q����N�O�� �K�#MW�X>э��UC�t2��U�Q�f]ț��P�q�)pN!}���:z��?����/��2|�� *%V�xT��B��3�h³3rI�:�o���g�C����lX½ X`��0I���wآ����=Y\W(O8�(��5HR��a�����-�!l�i�˨����O�[W���;�W c�� �s3]�J�x�H��L���F�J�����^��������ic��vGr��c�X�u~܀ ���,U�?e07� ��Yb:��93�# {x��U����`<W�]�s����˗14��CS�kq���w�O#�,��ke0��r��È�Q}�p���U!������MĊ�.�8��P��# Ho�/���Z��A��IZ�-�d�0j�fM����\!�AT���2 v�S����]�F��}PyH���n�Y�.F�E���[��avu\`�łis�����ؼ���,N����x{M��� T������N~OD]vd�~���3ߑ�ن���b��u��t��T�pE� �Ն��IT�V��c�����A�kpy݈0}���'�ji�$�!E�1;F�H�iK�� ��(u�i�3���/mS}�����?�'�zՠ�4eΊ�pLw�����p��I��]�����͋���$}����vHmC�����k9���{��;=
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ