Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
2f3c958bc68f8f9b181d73b06f22c804_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2f3c958bc68f8f9b181d73b06f22c804_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
2f3c958bc68f8f9b181d73b06f22c804_JaffaCakes118
Size
613KB
MD5
2f3c958bc68f8f9b181d73b06f22c804
SHA1
453eb9007954f396910fab4d78d554050c18c946
SHA256
1b7592c44b20c58aa8935ac1ad6867be7ccfb58e499718e38a0d34ee7ed097eb
SHA512
4cddc1cbf24dff0541e03a077df93e0f1b4551570a0e6c3143bdcf3230b178900c97d4a1c8751d99d2271c3e0aebcb81d51e48986e217433ff79bee7a20874d7
SSDEEP
6144:hKIQvLhZqcyR9IEwi5Ze2gIye0m3YeMu+88vrno4seqOz2sll1ao0fuZKLxlAp1W:sj1ZqcyR9IEszySJfsWzlxv92bB
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
inet_ntoa
WSAStartup
select
connect
WSAIoctl
getpeername
getsockname
gethostbyname
closesocket
socket
recv
send
gethostname
htons
ntohs
setsockopt
WSACleanup
InternetOpenW
InternetReadFile
InternetCloseHandle
InternetOpenUrlW
StrStrW
StrStrIW
StrCmpIW
StrRChrW
ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext
mixerSetControlDetails
mixerGetNumDevs
mixerGetDevCapsW
mixerGetLineInfoW
mixerClose
mixerGetControlDetailsW
waveInStart
mixerGetLineControlsW
waveOutUnprepareHeader
waveInAddBuffer
waveInOpen
waveInPrepareHeader
waveOutReset
waveOutPrepareHeader
waveOutGetNumDevs
waveOutOpen
mixerOpen
waveInUnprepareHeader
waveOutWrite
waveInClose
waveOutClose
waveInReset
waveInGetNumDevs
GetModuleFileNameExW
EnumProcessModules
CreateEnvironmentBlock
GetModuleHandleA
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
TlsAlloc
LCMapStringW
LCMapStringA
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
WaitForSingleObject
SetEvent
GetTickCount
Sleep
CreateEventW
CloseHandle
lstrlenW
WideCharToMultiByte
lstrcpyW
ResetEvent
CancelIo
GetFileSize
FindFirstFileW
SetFilePointer
GetDriveTypeW
SetErrorMode
CreateProcessW
GetLogicalDriveStringsW
CreateDirectoryW
WriteFile
GetFileAttributesW
ReadFile
CreateFileW
lstrcmpW
GetLastError
MoveFileW
FindClose
RemoveDirectoryW
lstrcatW
FindNextFileW
GetDiskFreeSpaceExW
DeleteFileW
LocalFree
GetVolumeInformationW
GetCurrentProcess
TerminateThread
lstrcpynW
GetModuleFileNameW
InterlockedExchange
GetExitCodeThread
WaitForMultipleObjects
MapViewOfFile
UnmapViewOfFile
VirtualQuery
LoadLibraryW
GetProcAddress
GetLocalTime
CreateFileMappingW
OutputDebugStringW
SetUnhandledExceptionFilter
GetModuleHandleW
FormatMessageW
IsBadWritePtr
FlushFileBuffers
GlobalSize
GlobalLock
InitializeCriticalSection
GlobalAlloc
LeaveCriticalSection
GlobalUnlock
EnterCriticalSection
GlobalFree
DeleteCriticalSection
lstrcmpiW
GetCurrentThreadId
GetCommandLineW
GetEnvironmentVariableW
SetPriorityClass
lstrlenA
GetCurrentThread
SetProcessPriorityBoost
GetVersionExW
GetExitCodeProcess
SetThreadPriority
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetShortPathNameW
lstrcpyA
PeekNamedPipe
TerminateProcess
GetStartupInfoW
DisconnectNamedPipe
CreatePipe
ExpandEnvironmentStringsW
OpenProcess
HeapSize
LocalSize
MultiByteToWideChar
GlobalHandle
CreateThread
ExitThread
GetCommandLineA
UnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
ExitProcess
RaiseException
GetStdHandle
GetModuleFileNameA
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
SetWindowsHookExW
GetKeyNameTextW
GetActiveWindow
GetWindowTextW
CallNextHookEx
wvsprintfW
mouse_event
SetClipboardData
SendMessageW
GetSystemMetrics
OpenClipboard
BlockInput
DestroyCursor
EmptyClipboard
SystemParametersInfoW
GetClipboardData
SetCursorPos
WindowFromPoint
UnhookWindowsHookEx
SetCapture
MapVirtualKeyW
CloseClipboard
keybd_event
GetCursorPos
GetDesktopWindow
ReleaseDC
SetRect
GetCursorInfo
GetDC
GetUserObjectInformationW
SetThreadDesktop
CloseDesktop
OpenDesktopW
OpenInputDesktop
PostMessageW
GetThreadDesktop
GetWindow
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
DispatchMessageW
TranslateMessage
GetMessageW
ExitWindowsEx
CharNextW
wsprintfW
GetClientRect
CreateWindowExW
CloseWindow
LoadCursorW
MessageBoxA
BitBlt
DeleteDC
CreateDIBSection
GetDIBits
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateServiceW
AdjustTokenPrivileges
RegSetValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
AllocateAndInitializeSid
AddAccessAllowedAce
FreeSid
GetLengthSid
ControlService
RegisterServiceCtrlHandlerW
SetServiceStatus
RegDeleteValueW
QueryServiceStatus
DuplicateTokenEx
StartServiceW
ChangeServiceConfig2W
SetTokenInformation
RegOpenKeyW
CreateProcessAsUserW
RegQueryValueExW
RegCreateKeyExW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
OpenProcessToken
RegQueryValueW
RegOpenKeyExW
RegCloseKey
LookupPrivilegeValueW
ShellExecuteExW
SHChangeNotify
SHGetFileInfoW
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemFree
SysFreeString
4��MZ�9��.��@�=2X�h����")z��h�n:T\J�������aI��UaVG���s�,�E�b��C)_ ��cԂ�W��r?��('7�)0���}4�� ���O����9���^̩`����"��M�n���C%��r�D�b&�8�'"3�p��Q'�ߪf@g���"� ���7��ϑ�}��A�4��ei���h� ��Laų�*�����O�����*+�+Ɲ�q'����ܴ|1�f8pzRAe7�q��@|W��[�@�Y~��t����o�����A����9�ݹ���yY �tTe�Ԙ'1�����s�� ��{��L6�B�c����v=��jv7�VM% �W�ٖ`�۲v~d0��L��M�%�K/��w�O�`�7����[�!�v�U�m�#�t��S'��~�v<����S���ol!��/M��BuM{@ ��qbW�15�+�u�p����&n��Gs���!�Z��:�jLk9�;�������@��L���)����S8ݹ��b�5ϔ�4��'j����*���r�J��!�-G`�Ġx�:L]����1�����t��R^m�kQOG����9�Z�+�����2��L������J��C����������c �ob}~�uw�1�S�]O�����]�,�'(���hn��0fŜYZ��=����oJ��=�Z���Dr��˻���v�������ޞ�N��5�Z]Je\����1�V?�8��Gb�^�sL���z�I���Q0��Lɤ������t��X(r�y����<��Iq��Ag���9��l������=bb��.��sJ�|�c���}n�����Y�`O���)�����h�e��������6�;��+K��,�0�O��6�m��Q��o���o��Y����hH�;S�8B��o]��9t&FJ[��_�{�Y!h0��ΆA&I�eX>ir�P*o��������.&,bm$a�O���!6�R��7������,ҕF���gO���sGM9.]r�&w�l�"g��I�B�I�E42�^�Б�x�K���H� ��x���n�>Tl��E[?�b�˾M��q�Ł��=�^K7�c���P�ʠk�`(�h� �&�F��wd��2>m,Aɋݭr���s����7�yp�ı��]25���b�ߵb��L��@����+��� +|�\Ӭ�F�MVȒ��\t���3�e���f���<�ҳ3��l1����͋��`�#� 8�ϓoY�ᴿ���HS0�� @h{�ζ{���&��ͯ�����X� �j���F\�;��A-t�H�L� E��y!�.!��R��\`қ�7� $�[b���:t:� 8��^,����*b���[�c�Bmu���bNI[�ʭ8vVM�%�e6�u��g6Q�6�5��:?(��7��D� �)���qV��7W��h�����T������Ĝ�(]Tӝ��'¨�`Q � ʗ;��l�ҕO�}o���r�����J?(���7;B>�?����//����gp٘P �8�t��a�.�y�(ߌI 8��`�������fˈ�z�p� %���7@���X�憃v� ��J.K�K&�7�q��^��͇Y���2, �bj:>xО�!*�O}�x��g���$ÆDp��� )�?��)&X�-(��}���yWw���jjsN�����$ֻ��Z�t�J�JI��|d�ătw�̧y���"�8��,"��D�<L=(Ж�-k�J�� .�7�摶����H�I������2#�<T��{��~p�WRֵ��*7�%ͯ}�Q${Jя��~�As�� Z�z���)�}������l���u�������wC���4 k<2k�ήj �x��s����/��y0�oL׀lI��H��Yu;�F�bf���+�hx����T����|�����$*;���)��a#<� �g3g-v{ ��9(o��,ʂS�!%O Ҫ�@�kuy~E��b���U�����g�<��� ��̩[��%8�9k����s��9`�)�N���_�v����^�n�Q] c�E�(@U{�-��ۮDBH��*�(j�s�2�]�i�[�Nh�zGz��[L�Ѝ�a� �`�L��u�Ё��Iџ&�/��ւ��&ۙ��^-��h5�lΐ�:��Y,��;YE c���jaX�Uuې��Y�C��;%����U�W��v�:� ����~�><rD�G�ЂW�G�$<_�z.M,�Ex ���q��9I(�)�Ja�/�7, �jj%������Ůl� =��Qf������� "�-F�� ���OW��@�����{)��7o�"�Q��6NF�bLU�х�g6��et���/���(�oh$�ڏ[J,!���*M1~d+� ݲ���r{�\�:Y�;�oۥ���]���y�u.��*��_�B�"�����@�:U��?�no�7���6K���_8���Di@���K�=��%�����ϮĠUԖ����Q�.D1δ�����Ԧ��$�;��3A� /�)��aE�VK�-�a� ĝ��ZR���svYY*%�oõE]P���������y�?�m�bk��ݗ}�X.�����?Rb=1�B[������#���� co�X�^���8��٪ߖƇ���έ���-�`<���[XA8"�P�xԏ�������ݯ��s|̢�a��Ng��p�{���� K'��H��j��������X��,�>�s$��w���1��v�������PF�Lr =�n]� P��@} � �67JZw0G-l�5���|�Ʋ�Q��T��o����W�W8�ZC�h?�@��?��%>l��5@fU �����#ۣu��`�v����12�%_��\�J]��!��P��em�1l�(�g�:i�OW߈�����r�78��9��Eң�tk�����g"d�;P��e�T��|�>]e{5���Z^�Ӷ���Jl�._i���35�GPmx�YDa=k(���np��[��^���<o��f H�Lk����V4�ƒ�½@<c,@8�*{�s!}&t�y�
Install
Launch
ServiceMain
UnInstall
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ