Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
47a69704566f37e8626bb8bb5fa784c8_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
47a69704566f37e8626bb8bb5fa784c8_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Target
47a69704566f37e8626bb8bb5fa784c8_JaffaCakes118
Size
950KB
MD5
47a69704566f37e8626bb8bb5fa784c8
SHA1
75fca1cdab2277b883e7b9dde0db65ee510065ab
SHA256
ea63f6a26a18fbeae7c9e042a43988f938503126b485238e3d44f75ae30868bc
SHA512
91b1a7b8c23f4d7a6a81f74bf8108b60d9b9be8bd781275629f148d5f763f098c70b06ab4cba6c9f2b38d53843b4d3e300b9a725c75dc3a631a2ce11ee5d67bb
SSDEEP
12288:tZOEmEapwcAI65kUduJsUy/b8qpxxrlD2Dt4MPK4rNEAOoHLEUspDlotBY0Exipo:O29Zl/YExyDbPsAOoI3ctX0NoYOMjZ
resource | yara_rule |
---|---|
sample | upx |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetStdHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
wsprintfA
SHGetFolderPathA
SystemFunction036
[�3�0�,X��)��b��F��9w�Ť$��\Jhd��4�P:I���:��~��ɂ7h����@�VeeC��VQ j������H��M�wtx�@�(��o+MUm����~�5�``����� 2�y�u6ka��.YZ��j�\"��j��m����G��}@�Ԯ���h�w�)Ä g�[�H�u�:Ҟ�!�.Z%g��J�֍W֖h�@A�*����٭ϫa?��2��uؐ�]���:z�Z�T���Y$�0��e�3`\�k(�%�/)C�WXa{�<wЍ�B���W�3γw� ��j�9��u�D�ь�ĺ�)��K0����o4\����㽆S-��E���<B'�M�'��htZNEƏ�x>��~9���& -o���g�シ�g擟������/�&�C����Ī�l� M+`vRŤ��49HΎ�+A� ,�I����Y;�*����!U�K;�>0�筕���:7_��a�4���kF+Ϗm��ku�.�W�R�����A�[��}�|��J�p���C�d]�\[�| ��\JssMC!q@� �&5"��w�_�<�=}ҽ��1�t[�������/��Q��B �Y|���q��#�0�`Ā�O�E�s�����eY\q�[5�ڢe�G^�7�G�Dn�1�ล>kS:.x'���A��b��~��o�%�¦v3�"�eީT�FV� �� ք}"�cR�Or� .(l*`�߉�K;�m�P�z��E lU���7��N��L����g�_c�z:"]�R`U8v�_Z�_<S)�d�(百����1KO?�������r��*��m��y%/&7���Q7b0m��"�M`��Nۨ(������/�=p�s�ko�'0�8�[i���Dꙙ�ë-z* l]&~��H�)�\�#�7�UKs fR�d�Y� ��t��� �C��~��3�NE P���jaæ�+�7�_�t�L�A��q��ϧ�!�P�q�M����C�hi�f���V�W�l������v���}{�:v9��=�q�3�(��v\F�D�+�w��L�M�$�҉� U�'˗�9>�����9�-��Ҳ�&�V+P�V�x�C �S!F-�k�bw9W;R�a�ɧFԢrRS��q=DӦ��f#��Z���m��*��d3z5� �(����Y����������w6�I�;܋:}��C=iF�� �m��O�`� ��^khS�R��3x��Ը`D4�/h���۞�뗜{�V�:FJ�<�E�I���-ch���'�r�n�nA̲ L1�a;����M Ȣ�Ƹoד��Ë$L<��KL���'��I)&��_�Z�`�p'�����J3�w??��%��g3�����?RV"���fk|��Ŋ�,��:@K�4���.��KK.��#< ���9��L�f�Z�����͊�(�c��C���m��! �5�rN�U�e�0B��R��:�o���[{�%�ֳ������1�.�X��C�؝��+�l����k�_R�5�>���N7.Z�Hh��=�����F���nx���H�l�1�ϣSf��Ͷ+ ����8����-#uK�1�RV9r,�q�a��d#K�������VX���@���.�����C�&<&�,(�fM��4����3�H��!��;ʒ�6�4�T�]N�*S�TK�x ��j�hY�x��:��S������'O�b���Q������fق����.��#�7t�G]x�sb�<4����f9����2H�O� �daX�;FvF���[w��C��w)���;`�ǵ�d� y������e�^���x�Y��!Ҿ/-�м� <g�>�®�L����љ��F�R�ԋ?���ˇ�����sJ|Xe�U�u�k��I���$�%Y2#Ң��=f%�/�>�->QN��N nu���i�3����m�}O:��kz�m�I"#���:o6|-�|����8 ?65h���(S̝=0���Pe���T]�7��x#c�(���7��9en=�j��{w_���0�G!���h�̎n^���p]i���@��\u�#�y��������7enFZ�_��4]"�s ~#�-�k�U��W�|����j2O��S�6�|�� 51��lNS �ni����]3d��)�b<0\Y���?��،2hh�h��i�8Z�m�1��̡b�+#�҂����� ��.�x���M\�� �DF)Ѹo�" ����E������Uo�1�i e�T+�Z�z�U��-@����fǺK$gUɿ�([N?�rM���"���ć�6I"J�Ǎ/MM_��]���^@��յp�E0�Q�<�����t��=<��̽��� �@\��L�8�]���w��!&rȰ�����wAVN���^/A�H��6�gl�F�+�g����C�ؾ�f���*���-��ĉl�%�c���j������9���C<!=��UT�� ��lJjo7zYlj%xw����������r5PH��AuԸR'C�h.)O������j�('͟�ۈ;K���\a� 0;2�k7�+ݼ���C3%M��-q&��(/N=�<+����j���$¸y��,�]K9��^`V��+�\� [�?Vm�Svt�=r2�χ�Fsӻ��7L-�n���gH�y��`��%�� ��.�y>���z`}XTߖ�G���xkp��5�(�du�qG�4gi*��mu]����$c�����">������0?3+������ G��GŦ����!2����j��J�XG'5��?��C��s0� �+)?C��E��|^��٩�n��C˩&K�!3���+���B����^1��EG�/�!��v����3t� M!��e�S��F���q1u�x��l& �V̄��qQ��e�W0�`<��F��g�߶����E?�28�Bu�,���Ǧ�����$���=[��.ca{ԭ�g�}u�ėG��R���g�'z�����L� �\�:�B��D��"K['�nzj̬���2��[$CX��Jg�<���N��^'�&v����n`-l��@*0vn��*M�e��IMHz�2T�H�����.�/٦�M㔱,g��i"��|JӴ��sz�D-l�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ