Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
Behavioral task
behavioral1
Sample
4b531ad541afc84c42a35b8368ca5da0_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4b531ad541afc84c42a35b8368ca5da0_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Target
4b531ad541afc84c42a35b8368ca5da0_JaffaCakes118
Size
1.6MB
MD5
4b531ad541afc84c42a35b8368ca5da0
SHA1
eb0b2a1bda5f4cb93ea5d3492c0d3b5af007b3a4
SHA256
67ee5ca5a2fc9bc15612bebdf81ae21ae9c2cd1b9b27afd3dd7258a91dc8acfc
SHA512
2ec6f7ebf844614ef8baa653c2762d83aafcfcf5a1b1e4006e18f2d9e31612f1b53e34167d7cda5496cf962ae682aa98f6d5b785fd5e797fec452980fcc0552a
SSDEEP
24576:wKV/XM9cz5s45weUYXqNzen3Y6WDetxP/zekpUHom7E6IUGc2ryrew7Z+BOCU/Dv:d/cC6eUYXzYDetZ/zekKN8UGnGJ5/DZl
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
MessageBoxA
lstrlenA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
RegOpenKeyExA
{#۸�/__��-�'5rSY���m��B��Yd���D�5�6� �+��ON���q&�++G�����z˜[�cV��QF���5����$�B���C>O��m$D��X�Ar�R�/$j<���7��*x?Fa�<j�X�Kظ�r&�H ��q���Nt� [�{èz˅`���]���^F.v4���}U��ޮ�O*���5k7i^m�c�rT�_�&6�z��f�N�ɜ7�.|��Z狅а�Z�R�RɦN�^�6��~���f�����X/���à��lf�[���N������BA�.P�_M�Fj��K>�Gf��t7��ޘ��y��w�-��O?f�?cP�"2��F�ifR)�ZJoh{5]+�{1�q.� ���]l�@g5��y�4z��=u��@�g�|��.�AD\46t�3�J��v,�Ӂf�Y����"�� mq�M��R�Pm�ų��±�dr���$2b|v���"1�����p��&�PDW�SIW�{��szr��R,�b�cc)G�x]H�z�w�r��]g�9,1s��UbٓCe5�v�%���B����c��j`L/*���z�3�*�k�:�Q���.9W(lǼ�N���/�Z�J�M�S?���m^� &6�o�f�f��g����\����Nh��-wJ'GG��#�d�� �YH>�����:�*�B�P��D���c�-�pl�-��6@��-�� ��D�'�^�}k ^�L�"���7:��?&6 ����%�� Q'���SX��V����s슾��ae�_��Q6̓̕D���$����E�ӵ��Wڤ®n�KW��u�i����nGOM����I���3��j4��P�!8 ���B`��h�x�X�!@��Ǩ�H,̠~c�~6=�]������t�!L��:�<7��s�.��8ز��[�T�/�ʎ����S�c�Y]�z�+����j��� h@���Q�'ƄZ��;��L�_�d�����2*�yw�2��7S���<�L��� V��2�%�CE�cm/��ͨ�H�R����У͔�^������3q��J��` ���(a��Ҁ&H���!!ǚ�`�*/�ds�v�;m�w.�xY���G��pd��uU$ig'l2�2G��)�+t��� 3hH�\�FYvB^�*�h�����km�>��/�~����~�j��Je����A�K� �76��L��� ��MP�hm�I�{�3"��O�ml6Ϧ�������7V��($1�j��ڵ#��؋Z[�]��R۳���%'���\��r�� �����ą�����Lq)�r왷��<�e���ERdi`�Q�z�(>C������H���2�!�ڲ3.u�K)]�Y�I��+�&|U�"�S���^E�x��f����`�ٶ�NIL�Z��,�r�z�A~Si�z0����u��ŭ�c ���ArW7T�3�� !��FR]�*�d�� ��$���@������@�dے�cw�3_wC뾦u�E�:��������/-&�t� ���센W|y �lX�.Hľ��/l�I �⾦[n��3�j=x��������U��~�U>�Jxõu3w���4��!5���ݕ�]}�C� E�wU �T�.�]9P�7�84BA�t�܋-���2��}R�mL͓1�:@Ĩ��6���D�]�x�6O�� =3N3;1��=��F����k6R#R�_B����Q����"Q9�3OC�r��;#dĀU>F�E�-���;����D�P�ITҿex�� 㰶�{U��L��l�u���M�[��^redH���R��Rhָt�zg����J��,E����,�s��g�!������8\�O(EIE�߽��4#��\[3�g?�Lhu��N����r̫e.����K L֞���LG ek^���'rR���Ө�0�1_WlPw��C�㤄�O�,���d�&5r�� ah�AOLH�@F��+F���^���� �is�kS���[�$ w웉�/8h��=����ͫJ����� x3y"Zwvp.c�&(�1mq�����C��!Й�H�efӠʥ�6 ����<}}�F�� ��^�J(~/��Dެ{�i����������{q���倹�����ԷƵ�u��`5/���H�N2�ҏ�7�3c�SCZ��� �)��O<`��������Z�Esv<C�9�Q{j����3�gK�8u�k@�!��2�d� �X�_X;cx��dC�?Q[M����~V��5�y�!a���Kw�O�P���D��l�|����'F�XL��W�nnJ��y��}��Z0O�?x��>"�))��`Y�n����*���b*��Nq= ���<KvB�b��pWh��iy�Lp _�3��G��� y>k�0�K�ĩ:��ͺ��������c;�4�#!�}B����X?U���;t�����~k�ĸ��!��%�Mg��'ċB�~>�_@���+�V���0��!Q���P%�%Y��lk_�Y.i� �&�(���s��Tu��Y�f�H�7��x�pK�*�5��,��K,7U���%��3�ZY7`;��)o��BVo|����[� F���JD����[ʙ?^�W�'[�2���`�U��{���6n���f�-�,�M�9��p��gﵶ�<�ʗi��w}�&��X9E �6)�X�q�ğ��}����+])#j�%Ƞ���H�(`32t���s�� {�.�-t���n�/2K&�B��I��X)K3�% ��3�D��k�����;&����E���?���:f�Ru帄�*P����M�ğ}3��8[V_��K:nJ�.�Ұm�=\zha��%�FFtvP�p��CyW~#U.��:�-�¯Ӛ��I)�����O�L� |lA���t���pn���=�1j3pF�xV��}�_(�U��b�6PQjsౡT����z���&ϰGD�*�cqOF�~��Z�bY�Ӕ��B<1t�<s�,�Pv�g�ʺ�����&i������=�V� �tc�fUf���8��G��_ⶈͱ}��c �6���}c�*�5�:Z8��T����͉�ZH_;�s��B �U
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE