Extended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
3a02e31b13dba175fd237bde1126abca_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3a02e31b13dba175fd237bde1126abca_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
3a02e31b13dba175fd237bde1126abca_JaffaCakes118
Size
235KB
MD5
3a02e31b13dba175fd237bde1126abca
SHA1
23cd26150ef5f7cd541e960bd12ca6b874459eac
SHA256
4541b38137e153af8e85bab0164e0c26811f45376d811ac11bbe56298663de63
SHA512
7e37c6d36cc73e2501e546d7ef96869b095cdbdd1be9c0033f25b8a512481a5c14ff3876f926aa5e32629bf74fcb644f6d56acce7c52792a226ea0eaed764f16
SSDEEP
6144:RUkAaj7m4t/S3elexrsD8h68kxkbNCDwajOezo:RRBPm4BtltexbNQQeM
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IoGetCurrentProcess
ObfDereferenceObject
PsGetCurrentProcessId
MmGetSystemRoutineAddress
RtlInitUnicodeString
PsLookupProcessByProcessId
_stricmp
ExAllocatePoolWithTag
ExFreePool
PsSetLoadImageNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsGetVersion
IofCompleteRequest
ZwDeviceIoControlFile
NtDeviceIoControlFile
MmGetPhysicalAddress
MmAllocateNonCachedMemory
Ke386SetIoAccessMap
Ke386IoSetAccessProcess
IoDeleteSymbolicLink
PsRemoveLoadImageNotifyRoutine
ZwClose
ZwMapViewOfSection
ZwOpenSection
ZwUnmapViewOfSection
ZwLoadDriver
ZwQuerySystemInformation
KeServiceDescriptorTable
ObReferenceObjectByName
IoDriverObjectType
PsLookupThreadByThreadId
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
ZwQueryValueKey
ZwOpenKey
KeAddSystemServiceTable
ObReferenceObjectByHandle
_except_handler3
MmFreeNonCachedMemory
MmIsAddressValid
_strnicmp
ExFreePoolWithTag
memcpy
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
memset
ZwReadFile
ZwQueryInformationFile
ZwOpenFile
KeBugCheckEx
KeRaiseIrqlToDpcLevel
KfLowerIrql
HalTranslateBusAddress
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ