Extended Key Usages
ExtKeyUsageCodeSigning
Behavioral task
behavioral1
Sample
shooter.7z
Resource
win10v2004-20240802-en
Target
shooter.7z
Size
25.8MB
MD5
bfe9e0900b1ec79fbfceaa5c3394cdcc
SHA1
0d8d87e2dae37496c9ed8c51a525934a7b52ef0a
SHA256
ff5ed30fdf818d436409d6b82f44e6b1bfb34cf1305d1fc68f4306af8bc41864
SHA512
d003251175862dfe45d46d9773131fb5e9a82327e5160e2a700c07e32faa238cf1d9a130014de3074481bafa2d9d3461557b5bec254fa4e8a50f51103a2e6c7d
SSDEEP
393216:gVqM3gJwp71tvuigUNF2h0K3j4/T0/s/eHhLsDpKOrOOYN3zXTG+Fm3fGK0A2:YQJw51Vuig7XboDpPi3jDFEuC2
resource | yara_rule |
---|---|
static1/unpack001/main.exe | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
unpack001/blackdotsapi.dll |
unpack001/main.exe |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
D:\a\_work\e\src\out\Release_x64\WebView2Loader.dll.pdb
AcquireSRWLockExclusive
CloseHandle
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReleaseSRWLockExclusive
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
CompareBrowserVersions
CreateCoreWebView2Environment
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString
GetAvailableCoreWebView2BrowserVersionStringWithOptions
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
C:\Users\llama\Downloads\compiler-src-main\compiler-src-main\x64\Release\incognito-luau.pdb
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentProcess
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSListHead
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Xbad_function_call@std@@YAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exceptions@std@@YAHXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??Bid@locale@std@@QEAA_KXZ
__CxxFrameHandler4
memchr
__std_exception_destroy
memcmp
memcpy
memmove
__std_exception_copy
_purecall
__std_type_info_destroy_list
memset
_CxxThrowException
__current_exception_context
__current_exception
__C_specific_handler
strchr
__std_terminate
fflush
ungetc
fsetpos
fwrite
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsprintf
_get_stream_buffer_pointers
fgetc
setvbuf
fgetpos
fclose
_fseeki64
fread
fputc
_initialize_narrow_environment
_errno
_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
terminate
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_seh_filter_dll
_invalid_parameter_noinfo
_configure_narrow_argv
_lock_file
_unlock_file
strnlen
islower
isdigit
ispunct
isalnum
isxdigit
isalpha
strncpy
isupper
isgraph
toupper
strpbrk
strncat
strcspn
isspace
strspn
tolower
iscntrl
strcpy_s
strcmp
free
_callnewh
malloc
_aligned_malloc
asin
log2
acos
fmod
tan
log
atan2
cos
ldexp
frexp
tanh
pow
cosh
log10
modf
sin
atan
round
sqrt
floorf
sinh
_dsign
exp
floor
ceilf
ceil
strtoull
strtod
atoi
strtoul
clock
_time64
strftime
_localtime64_s
_gmtime64_s
_difftime64
RBXCompile
RBXDecompress
RBXRawCompile
Setup
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
SHFileOperationW
SetLastError
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
WTSSendMessageW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
�ݭp��e��#�z{酔7� �B��(D{w�'���5���m������]*G^�ds�q��mXQ�Q�N���5$o7JX�ҕ�۴h˲����A���.+PS�F�%ٹBXp�{ķ� ]GH�F��i �~���:c��3�CSIL�2P͊/y�A�B�� �[�I �ud6������w1v)I����`D��З� �&�\��d� ��_-E�[:�Q���ft����[�o�&�%�&,N^����Kd����5?�zaDAV��9sO֢�_`G'����@~���W���7�����p�ψ��:����,כ3Rl�{�5�[��K��@�h���O�%F�44����X��S?L�A?�X� �FZ�U9��Y���V���ؗFo�®�/mi�5;���n�Gt=�U�&�{�F]�^�v��0ŢY_��q�4j�} �cT�w�����u�C��O��P�� ��`uLC�T\}C����ƛ�L�+D��X�k4�ԓ�.M9�渼,{�W� )����� Z~���B� ���U���C�X\�\��P���'ťV�T4D�N���z���4�γ%0��w��ܢ��"ܪɤ.���`Kb�1�z�G1�q�nj䑺u&/���{����˄b2ߝ� �)��1s��9~B�eX-�"���`w6K��V!�La`��7�����*�s8DT� �X�lj��@Q��"��TNSe��?��h$�)x�q~ #�C P6��E�v-�*�P(�8�G�o����Ɂg;x}0���o�~��O|���*�hs��W�������/[�5�%�k��@��6��֣�_Vi�+��<Rf�Sk�h�|̎>�~�L#W>X�"�c�$&��8U���5�y�3I%�hÁ\�e�+��b�y�7�=�c/JpEw�uݪ VGf���*JX�� �}�����9Z������DX�����#3A��~D*m�9з�� h�B��B�4����,X:hs�Ꮢa� ��>N\D3���õI�=���0]�;�w|�&�Mը����;KYmQy-���ej �Fq G����f H�~l��6G�f��<�+HE��>u˫� M���ճB連"&9��Ò��������0��&8qJ3a�~m,m�t*���!�eLG��&(3�xU]ߡEc�Hr�p��*x��0Q��Fxih�%7����h�QhNu*1}=h��2~w����V �&Z�� � ����z\�̪6xJ�*�H��D7���0��&���UE�;����F��fNL�Ц�,�TH�]��*bc����DU��yЂ"�yX��O"���4�'��:��2���"~D�G!�1����y�����D%�f��d���]N 0�!��|���p^��SK5��*�E��j����X�$�;�U�����L+U18���/R Z�%�v��E�P�m��i�}�YKV����ƿE���0�)�SA�S gx�ųiu�\1�:��I�Y'��q`(���Ⱥc�&&�m˻�}���k�vd���9�w���̰�u����je�[^�Z1,���i+��� ���J���X����P��zlD�?�_����f������{���$#����MF�"�5�'���hZ��iFv((?���վ3��0") �� _�&��]�(�*�DW������b�S�M�[�>@>�~��PI-u� �+�hCi{�w]������d�����R��g荊\6~.d��w����Bh� �����ڈ���xIB��c�鉈�� �Ɩ�B�᮶&�����_��\p��X��@i���ۀP}���S1�;~`ݲ\|�)����w��k�~6nAK$�w<���>�Z��iY��#{G�Ŷ��7&�$��{Ϸ����xR��,e���s��L�^$�0���^Hv*������r�:��7���733��;b�[���;��ŵg�*A�Kg�Nl��EM>��>o�ҊP�X�EG�Z-���{g~$N#���溢v�����r�>LM/��ᛍĄ?�n�7/w�S�H63:7�}Ҫ�x�k�"(z!6t&��]N���73�ù�/�cŔ3����ϤYJ&4BUw�UU�4�E��e)X�{�g˜��<�O_����2��+�����{_J���TA�Kҷ^�'�db� 﨧�����p5{��ԁ�;�|�X�Q���F� ̊r� -�ezyn}a8O $Q�z�,8Q�[KL���#@�f\��@��E�'$0F㑴�K.Ӓ�BfQ\���O�b��$&K�:7�n���m_(���vEyt��C�}o�������Ј�@���3ݛr�]�k�h������䄵��5�q����˛t��9o��`%r��-��Q��+S����JM}�B<x��V�lb+�/��m�k�,� o� ��c�gdR 10m�\,���,��@w)E�gdjnt[q�V�J���!�sH�����"*v�S��:���'�}!WO��n�3|qP��� �(��_�]T��$q�Uj���{l���r�=�t��J�ü�]Ph�6���)y���۩�} R��7���������Q���f~�!��l��,�=N0�ʓ�F��Ь� �H��[OJ-�٪Y- w�!���<� ,��ȈD���Q�{!��2$��}���S���Y�3���U3"*�s�����O_��_�F!��>�6H9!\�������KY?�|�uZwM�,ĥ�c��D�ʱ8����+9�R�Mh<�ƾ�1%�-j#���$%�v8�#;o_�3<ۍC d�B� �qy��� zR�Q�St]�Ė�@��/@�ިL�%�/+�g�8��e���i8Ve0M��k��p;�����0U�h���8�mlUBC��0���E]7�=0�p"��� =r N��x�p[-o�QX���s�X*��#�)�˙lIԓ��\O�W�ui]d�9�f�I����F�#��+�{L2+�3s�����U�Kf�������ї72ߴ54���A����<&����|j���o]��(:i;:���H�Ή J ���2!��I��!�� ��EE9�������f����"̚3��&�\s
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ