Extended Key Usages
ExtKeyUsageCodeSigning
Behavioral task
behavioral1
Sample
19a8e52dd496f23e0233fc4beb5fd8f6_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
19a8e52dd496f23e0233fc4beb5fd8f6_JaffaCakes118.exe
Resource
win10v2004-20240611-en
Target
19a8e52dd496f23e0233fc4beb5fd8f6_JaffaCakes118
Size
515KB
MD5
19a8e52dd496f23e0233fc4beb5fd8f6
SHA1
e524eea6112a01d318abd5f03b36794ef1c14db7
SHA256
5e6acefa95e1dc9d3b4c8ca844e13af36c808ff1694b023ffa960c31cfc15dad
SHA512
e2a30b19113e53cd92cc52dd29e4ca589455e3c4f898ebe628a45184566ae069200a4d0fa05d9c737d95725d4548e11fb3b92b530500d892672a1ce1c27e762a
SSDEEP
12288:9m+S/Jvc6oEYUAvNukPh5A+h9MNIg6bTNXjtU9:9B4fXdAvNukJy+se5bT09
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
LCMapStringA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
GetWindowRect
MessageBoxA
RegCreateKeyExW
SHGetPathFromIDListW
CoCreateGuid
HTMLayoutGetParentElement
GetAdaptersInfo
HttpOpenRequestA
ImageList_GetIconSize
�i:��'�,��m6��d/�F��(�P&���9�� cT�����7�����@꣡���a.klΚ`���)�ho�b��4v�{a+w&<�aB#���M�if�#rWt�o�-�@V-���I"��6ϡ�f��6o��n�|7�1tQGc��t���yyYh�/�z� ����������������Y�N�?��n��+�G�:�w�үj���N��NP�|�[)��o�{h��;/�Jg��8�9�6� �*\5@��$2Aʭ���V�����Y���{�L O���� �E��+� ;^�X���z�S!|F���C�d���q����q�0��A�K�i���� dH���aXɍ_�� ����;���d=d�^���4�j�]�a�B���÷�V퓹�Y�K��W�X��uU=�2vD�R����̑��v��TZcd��[A���Ԓ�f���"t���r��������)���j_*��at��4�i��7k��<f��;WG����� n�u9[5eּ�.ʒ���Cܕ�rg\Db�1'!x�5���䟫fP�q��΅d[�5�����@�c4�uE�UNNee!/ܨ"'/?�&&T�I:<>R:,v�?���>�G�v��6�S~N�XA;�,������b��`�� �'���s*y�aS#�noT���캳>�S��͎U㕡�&z)"�v�9���E���:u"u�f���$1FQFs5�������Xi1�E���ؽw�A���7E50��bY�!��"���� QF�|IDZTU��r}�f��1O.ҏ�l�{DO��,a�Z��ɪ:�W�w�J���h+Yr��KT���8��v� N������x[�����A��?x~0�ѵc>ī����| �rL��^1c�$^�����<U`�Ҏ��XG�z!+�:# [\DP n�q�G[4f����7�д4�V��ќ��ү�VL�E<�%��1�f����bjd��ݢ����k9b�[-к��9�}oZZ����J�� tI!*��%��/t�/q��qcA�3FU�U�q��&6���ɨ���z"�����5U���E���C<�1�!�:ר�P���B�M~��J �F�m����n}��B�<- ��Q=%O뼛3 �t3�z�[�7@|οgD��T�3�8ߒhS+���`�������B�b�)�n"�Xd~z�3i2ʃ&����P�Ȋ�}����[sn������s�}81�b��J�`��8�j��h�}.�+Fuh�wX�� ��9a��m�.e~�ܽDC�R�n N�e��r�ˠ��Ty�FQ�"����ϫ��X�&�L�������l`3��f�ƉV8�O�Q`H��v!i�}��-�Vy�3�k ƣ�Z��8Ǚ�Af�����^�̦������G�_[u���5R��c�!r��~��,xF�s�����O1��HJo"Nȅ��Zy��6�2fX�|���ʬ��_U����E�\� ��0N�#s���D�\���o5'g�ڸl/�����U�� E�\| tOoa�v�m�xqBp�b�o֬Տ�dՄ"W1���~1j�s@5�)�����������g���4,i�2�neW�W^��1��\#�������� �:���D��������C2JP\�!Bf��k�,�\���p���N�?��ɴ15A�&ū�3FRJt���:�^�|���E6ݧ��PZ�F2YzO���[�]���]Ґ�*���[��3��PRC5([�iBb�R0��d�|��@Z�w���ܘ�1�'U3�O���p-�vu�ST�^�ߞ��40���ҹ*ћn���1aE$}��O�5L��CJ� p䴇�p=�*�wX��[�VWl�N}��Ϙu���@��!���~2�����"���畐���.�7�ǵ���:ڬg�l��5���Cc���wp��xl4��O�C<.,;���o,��I�$�S��U���"!%g��" ��1��D�7��xN;��E�U ;]���9:��Q�ٯ]�,K�_Zb�����V��gyJ����T�Gb�{��R���ǶPOQ�7{��]���B���~m��R3�G�n�R�S�Tmm4����>�`k�K�~�9d�T>B�b&x��y��V$��k"�#�嚚Tz�$�qڧ[���P4��d���Sv#jE�kf����\��$.���s�q���n��{r~-���_j��x�e$�v�l.�����$�[�aJqmd8L5�*�rA,h��/+Tkjz�b?w�V�����`]R��/3��+f9Ր���a Z�8���(#m`�x�AP���P#۫8�C����=M�g���%��%�s^�H�-�J���M��&��i���yLF +�1ձ�=Gw7�Q:n��N0����0[�6&#t����|�r:���"$��{N��VꜼ���{t�NǓ��A{o��P@ʞlG�<-!���W*���U���B{�bC[/��(�<�1�ty%'��v���0�頄8ZK4���zZ����߷ɳ�8���4��8�R����>��IL�B7hl�W��M<��uWň��D���L�px�f�|�O-�i>9CV����g,����eu�.���En#�����2Ǘ9^�M��>�-��ɺ��-��l���1X|��K��1��R����(h�T�U]�G��/���9��Xoҩ�&��*0)�.9>��廑a�<�`� �brr�J�����D��|��FI��ٯ��l�}�8F@9�O��� h���Ub G�C*����̉V?�h�� =���~%�L�֭^}�,R�A"`�A�;$'��pʠjKΑh��<����[ղbt��hO�RqB�m6�(a�a�J���t;j�8�l:O/���s<�Zr����+X�q̍���A��u) ���)�.C=&7h&���G�eg����^�dy0W����dۘj�qX^_"���&�+Ie�����Ɩ��e�6�f����i�����ܺ��<�EAᇾ�,�g'k��3^�e� ��_�l�G�z���H��Ǧ���|����(q�F�F�UbL�"�e�>{�f�Q-���P�:7��ki�2�S��=�X1��JU hG9O�LlO�H�U#AN�i|+˭tZ]G��3�X��So���iq��V1��`
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE