Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Overview
overview
8Static
static
7OSIRIS.rar
windows7-x64
3OSIRIS.rar
windows10-2004-x64
3OSIRIS/AdbWinApi.dll
windows7-x64
3OSIRIS/AdbWinApi.dll
windows10-2004-x64
3OSIRIS/OSIRIS.exe
windows7-x64
7OSIRIS/OSIRIS.exe
windows10-2004-x64
7OSIRIS/OSIRIS.lic
windows7-x64
3OSIRIS/OSIRIS.lic
windows10-2004-x64
3OSIRIS/adb.exe
windows7-x64
3OSIRIS/adb.exe
windows10-2004-x64
8Behavioral task
behavioral1
Sample
OSIRIS.rar
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
OSIRIS.rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
OSIRIS/AdbWinApi.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
OSIRIS/AdbWinApi.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
OSIRIS/OSIRIS.exe
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
OSIRIS/OSIRIS.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
OSIRIS/OSIRIS.lic
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
OSIRIS/OSIRIS.lic
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
OSIRIS/adb.exe
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
OSIRIS/adb.exe
Resource
win10v2004-20240802-en
Target
OSIRIS.rar
Size
5.5MB
MD5
b4dde8583e5a21a89f53da22a2eae1b5
SHA1
cabfbfb7a75c5e227c1ecf5362b3907dd0376fd3
SHA256
dacd8a22f8597467e2a40b2185995b7477b58bf26d1a719a0258bb21704dc14b
SHA512
7f8f71173e8f73c67456a200070ff1caeb30e6b224c5e6004ab691baab738320a0dc1c412ff48d85b8939e9c90ef19433652eff115d2ff165ffcdbbabbd95350
SSDEEP
98304:FZd1SVotngkASF0Y9qP4FbtIw1nNNYfd7nZeY1qhcyvr6qCubjmzq77iuMKMXV/d:FZdUo9tASFR9G45tLbGpM+Er6jbqSuMZ
resource | yara_rule |
---|---|
static1/unpack001/OSIRIS/OSIRIS.exe | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
unpack001/OSIRIS/OSIRIS.exe |
unpack001/OSIRIS/adb.exe |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
c:\code\android\donut\development\host\windows\usb\api\objfre_wxp_x86\i386\AdbWinApi.pdb
CoCreateInstance
GetACP
SetLastError
CloseHandle
GetLastError
DeviceIoControl
WriteFile
ReadFile
GetOverlappedResult
CreateFileW
WideCharToMultiByte
Sleep
InterlockedIncrement
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetProcAddress
LoadLibraryW
GetFileAttributesW
GetSystemDirectoryW
RaiseException
FreeLibrary
InterlockedExchange
InitializeCriticalSectionAndSpinCount
GetCommandLineA
GetVersionExA
RtlUnwind
HeapFree
HeapAlloc
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCPInfo
GetOEMCP
OutputDebugStringA
VirtualAlloc
HeapReAlloc
HeapSize
LoadLibraryA
GetModuleHandleW
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
VirtualProtect
GetSystemInfo
VirtualQuery
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
??0AdbEndpointObject@@QAE@ABV0@@Z
??0AdbEndpointObject@@QAE@PAVAdbInterfaceObject@@EE@Z
??0AdbIOCompletion@@QAE@ABV0@@Z
??0AdbIOCompletion@@QAE@PAVAdbEndpointObject@@KPAX@Z
??0AdbInterfaceObject@@QAE@ABV0@@Z
??0AdbInterfaceObject@@QAE@PBG@Z
??0AdbObjectHandle@@QAE@ABV0@@Z
??0AdbObjectHandle@@QAE@W4AdbObjectType@@@Z
??1AdbEndpointObject@@MAE@XZ
??1AdbIOCompletion@@MAE@XZ
??1AdbInterfaceObject@@MAE@XZ
??1AdbObjectHandle@@MAE@XZ
??4AdbEndpointObject@@QAEAAV0@ABV0@@Z
??4AdbIOCompletion@@QAEAAV0@ABV0@@Z
??4AdbInterfaceObject@@QAEAAV0@ABV0@@Z
??4AdbObjectHandle@@QAEAAV0@ABV0@@Z
??_7AdbEndpointObject@@6B@
??_7AdbIOCompletion@@6B@
??_7AdbInterfaceObject@@6B@
??_7AdbObjectHandle@@6B@
?AddRef@AdbObjectHandle@@UAEJXZ
?AsyncRead@AdbEndpointObject@@UAEPAXPAXKPAK0K@Z
?AsyncWrite@AdbEndpointObject@@UAEPAXPAXKPAK0K@Z
?CloseHandle@AdbObjectHandle@@UAE_NXZ
?CreateHandle@AdbObjectHandle@@UAEPAXXZ
?GetEndpointInformation@AdbEndpointObject@@UAE_NPAU_AdbEndpointInformation@@@Z
?GetInterfaceName@AdbInterfaceObject@@UAE_NPAXPAK_N@Z
?GetParentInterfaceHandle@AdbEndpointObject@@QBEPAXXZ
?GetParentObjectHandle@AdbIOCompletion@@QBEPAXXZ
?GetUsbConfigurationDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_CONFIGURATION_DESCRIPTOR@@@Z
?GetUsbDeviceDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_DEVICE_DESCRIPTOR@@@Z
?GetUsbInterfaceDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_INTERFACE_DESCRIPTOR@@@Z
?IsCompleted@AdbIOCompletion@@UAE_NXZ
?IsObjectOfType@AdbObjectHandle@@UBE_NW4AdbObjectType@@@Z
?IsOpened@AdbObjectHandle@@QBE_NXZ
?LastReferenceReleased@AdbObjectHandle@@MAEXXZ
?Lookup@AdbObjectHandle@@SGPAV1@PAX@Z
?Release@AdbObjectHandle@@UAEJXZ
?SyncRead@AdbEndpointObject@@UAE_NPAXKPAKK@Z
?SyncWrite@AdbEndpointObject@@UAE_NPAXKPAKK@Z
?Type@AdbEndpointObject@@SG?AW4AdbObjectType@@XZ
?Type@AdbIOCompletion@@SG?AW4AdbObjectType@@XZ
?Type@AdbInterfaceObject@@SG?AW4AdbObjectType@@XZ
?adb_handle@AdbObjectHandle@@QBEPAXXZ
?endpoint_id@AdbEndpointObject@@QBEEXZ
?endpoint_index@AdbEndpointObject@@QBEEXZ
?interface_name@AdbInterfaceObject@@QBEABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?object_type@AdbObjectHandle@@QBE?AW4AdbObjectType@@XZ
?overlapped@AdbIOCompletion@@QAEPAU_OVERLAPPED@@XZ
?parent_interface@AdbEndpointObject@@QBEPAVAdbInterfaceObject@@XZ
?parent_io_object@AdbIOCompletion@@QBEPAVAdbEndpointObject@@XZ
?usb_config_descriptor@AdbInterfaceObject@@QBEPBU_USB_CONFIGURATION_DESCRIPTOR@@XZ
?usb_device_descriptor@AdbInterfaceObject@@QBEPBU_USB_DEVICE_DESCRIPTOR@@XZ
?usb_interface_descriptor@AdbInterfaceObject@@QBEPBU_USB_INTERFACE_DESCRIPTOR@@XZ
AdbCloseHandle
AdbCreateInterface
AdbCreateInterfaceByName
AdbEnumInterfaces
AdbGetDefaultBulkReadEndpointInformation
AdbGetDefaultBulkWriteEndpointInformation
AdbGetEndpointInformation
AdbGetEndpointInterface
AdbGetInterfaceName
AdbGetOvelappedIoResult
AdbGetSerialNumber
AdbGetUsbConfigurationDescriptor
AdbGetUsbDeviceDescriptor
AdbGetUsbInterfaceDescriptor
AdbHasOvelappedIoComplated
AdbNextInterface
AdbOpenDefaultBulkReadEndpoint
AdbOpenDefaultBulkWriteEndpoint
AdbOpenEndpoint
AdbQueryInformationEndpoint
AdbReadEndpointAsync
AdbReadEndpointSync
AdbResetInterfaceEnum
AdbWriteEndpointAsync
AdbWriteEndpointSync
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
RegQueryValueExW
MultiByteToWideChar
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ShowWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
ShellExecuteW
?uncaught_exception@std@@YA_NXZ
URLDownloadToFileW
InternetReadFile
__CxxFrameHandler4
__std_exception_copy
fclose
_initterm_e
_time64
calloc
isdigit
_unlock_file
__setusermatherr
_configthreadlocale
WSAIoctl
ord41
IdnToAscii
qsort
strtol
getenv
WTSSendMessageW
��Ú�p���ڀ{�,8rTC��Yq�atD-5�®+HҮ��bW��</�K�_Z���W�D�a�h;��O��/X�H��w%�^(M~��+o���b�V����?��<m�(^~�+XH�,W����#:y����5���d˹#�*�1�, ͯ�2��Sݪ��}���ʕ}�=t�z���J�u��P�;C���fze;��:��.�U+�1/��>�� ��4ZH,�M�x�������»�V����D���dE��]sZ=g쎖�%�g%Ƹ�)��+^[��T�� �<,�.m(��y$A��|I����6X���S��Xht� yغ���OA28Q&�i�P3v��G�xSȆ�f�L㍉xƂF���I=|�?;��9���^WV��g��9��Y�J����� h��ѯ/�M,���э �)˔1�iw����P�S���e���|��}��P��cs�K���]�T���*��|�?���0��}#��>�,NT��c�hI���5�e������KxBC��I�DIè��C��DL�b����j��wTQ����SD�Zp�c���)�i��^� ox}���)�>�����#R-��1�kˆ�=�W�V�G.�~�VwM�6 ��P��f����D:��%\pf�����Q�*��T�j�)�W�f_YS�2�CwJ�tH�b�%Rc�կ� ������i퐁�Ps�i9=+0W����[�t�=0�H�$r7�wU��@n����1H��U��U���3��@�N~\��8V�������%��� [D_Jo8�t �������"��J!��KnJ*"N3����n��2�O��;����~��1�?������O�9�OV��*{�����U�k'��z�w���L��\^Ԫ���������Q�m�i�G#؈'�Jc�ˀc�RQ��Ə>>dӗ/�UK�at8������Vґ�LU��R�cH�f;^j��}��Z´ჲu���lW+�;R���~���p&<����{��Nj��S�-�䍁��d���p�u&� ����w��ƫ�\t&j������7B��ܵC� �7���s ~D������"�����M ��x������{T��0as���Y�kDq���l�1 �Q��Z���/y�Y5�4���l6mF_�����b2�5�9�`q�q��&�O���I��Ј�;0t�� ���F��ܺ����h�K"��)N�Js.��P��݉1P����e���yF"K�>5�p��� ǟDhQE�V�!�-o���-���� �Z�F��5)h�Z���d��!�N��- j��T�Lh�� ,K�f���լbG.�#���8�;�VV�����*��Rڂ���H_3|���'����#>6�<���/A>�b^���%:��O�&B�0:�UH�#�ys���&3���@H%K�s�� �H�m���D�00~���������3g�P>��NxA������r'�_��Y�,��� �����C[pG��9��kS=�3�H����/P�*�q$A(� J�}y�2�!�ԣ.v�,����&�G���p�_\�Nw4���_��LEG,"a>'ѹ�lL^��M)@���^�W�O"\�����J9�^>r��Nww�� :����7���+���H����A ����sj��0�Iv��}�1i���6GzKr\�D/;K�Rl�$];����v$������(�ׁB�}�5��Os �5�m4 �F�It�wV���w�^P����\�|�Q��&pt��ТM^g��{˛�\��i��lGv�/SPp���^�Lԯ`u�#*WOV^�cB��ߕ&���PsH�.��]{� (�q�b�윇����XrA���c ������-�g?�a2tz�#�BoP4k��C-7?� \�u� �j��Ϧ �� ��])���K�����e��]��V�7^(Z�����z�N�䊫�y��G�Y�|]�3i�����\���� ��;`��6:�B,է�-�T���N���k� �x�k�2]��a���T�ǘ��w����d��{K~�-�?좞�����M:%����C��_���9�E^�q\�N>��Ѯa=0[�?ȭ�MO����j;���BW��h{e^��qp�g��۞.eP���N���x�Y�=a\|�<�b��2m������kS��y;ͯ)e_"Rw�}xM �[i�l�:�兑�Hh��q'�.�����I3��Ɏ����4%��)sq�Y��4��� ��@ӗ椶��u���=J1>�R?x�P���%�I�d�I��:����c�4Z/Eź��9\�J��!��H�LRe� �4Dߨ��|T����RQ�r.��n��@٬�k(r" Ds��ߚ59�b/9 �:��#��v|-@ �A�)\%]����њ�-{Z�����ut��ȹ��T�����C�fn+���l�M����n�F��7�fN��H���<�%gMyjX.s���s�*��\ې���ecmvN���� fY�k8����=�訮N|Yk��M/rH�:�B�͋cSO3!���M?�Y[�?G�HN{8�v��N{���C4y9�!��6�dPx�·Eak��'��{�l�CPo��F���@(�t0�v_��e���f�1�k��U�l��ys.�mn�Sk��)� X�l��:Juhhz�A3u�o!3�~4߅�D>��� �,�s��tQ������.Vѿf��3=! O��I%�5QZ!좘�R��sއL�A�X���+���N��u��iH�baV��E�"�� ~5cZEbD�4m�iB�rΡ%]��c�l'��֜���K�D`T,�d�_s�|�p���x�0�@�y}�; ��4��f:[����nˍ2��F���m�� ^��4�{���=;��V�q ��R1@cWJ &�>b��o���_��,�w��Eh,����v���Mdu� �H�He��1Q`�m ��fgo�ԋ���q�۔%G���FZ]�ѓJF�c�� vT� ���8Y�4��\��"�v�iS[���o�����)�`)���/m��V��b�XRW�J��H�$G@�{��t��sl�� "�p���*;
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
DeregisterEventSource
RegisterEventSourceA
ReportEventA
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
DeleteDC
DeleteObject
GetBitmapBits
GetDeviceCaps
GetObjectA
SelectObject
CloseHandle
CreateEventA
CreateFileA
CreatePipe
CreateProcessA
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FreeLibrary
GetCurrentProcessId
GetCurrentThreadId
GetFileAttributesA
GetFileSize
GetFileType
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStdHandle
GetSystemTimeAsFileTime
GetTempPathA
GetTickCount
GetVersion
GetVersionExA
GlobalMemoryStatus
InitializeCriticalSection
InterlockedCompareExchange
InterlockedExchange
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
QueryPerformanceCounter
ReadFile
ResetEvent
SetConsoleCtrlHandler
SetEvent
SetFilePointer
SetHandleInformation
SetLastError
SetUnhandledExceptionFilter
Sleep
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
_access
_chmod
_getcwd
_getpid
_read
_stat
_strdup
_stricmp
_umask
_unlink
__getmainargs
__lc_codepage
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_beginthread
_beginthreadex
_cexit
_endthreadex
_errno
_exit
_findclose
_findfirst
_findnext
_fullpath
_getch
_iob
_isctype
_mkdir
_onexit
_pctype
_setmode
_stricmp
_strnicmp
_vsnprintf
_wfopen
abort
atexit
atoi
calloc
exit
fclose
fflush
fgets
fopen
fprintf
fputc
fputs
fread
free
fseek
ftell
fwrite
getenv
gmtime
localeconv
localtime
malloc
memchr
memcpy
memmove
memset
perror
qsort
raise
realloc
setvbuf
signal
sscanf
strcat
strchr
strcmp
strcpy
strerror
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strtol
strtoul
time
tolower
vfprintf
wcslen
wcsstr
SHGetFolderPathA
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
WSACleanup
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAStartup
accept
bind
closesocket
connect
gethostbyname
htonl
htons
listen
recv
send
setsockopt
shutdown
socket
AdbCloseHandle
AdbCreateInterfaceByName
AdbEnumInterfaces
AdbGetEndpointInformation
AdbGetInterfaceName
AdbGetSerialNumber
AdbGetUsbDeviceDescriptor
AdbGetUsbInterfaceDescriptor
AdbNextInterface
AdbOpenDefaultBulkReadEndpoint
AdbOpenDefaultBulkWriteEndpoint
AdbReadEndpointSync
AdbWriteEndpointSync
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE