Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
Behavioral task
behavioral1
Sample
599a7d79a3adae18ca536e0aa038cfae_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
599a7d79a3adae18ca536e0aa038cfae_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
599a7d79a3adae18ca536e0aa038cfae_JaffaCakes118
Size
193KB
MD5
599a7d79a3adae18ca536e0aa038cfae
SHA1
16d3820684c336c9534f3a82ff806cb4123e220c
SHA256
f1260408892b02586cd870fa02d509aaac355c84f02a12ee7ebaa95884ba68d6
SHA512
88df3c16469968f2b3e48de7d0ba3e589d9c4f4745ccf8d4b6bc2dfb92e1e9240facf0553060bb6b91d153487c05e31c7d42f2dabd5282968e24c7ea56212af1
SSDEEP
3072:wP+vA/PAQaUKf71j/QpNLlBK4ZEySAhQNMBTCKF2O5Q4P8X2X3kLg:wPpAQ3Kfpj/itZFSPaBDot4Pudg
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
StrStrIA
PathFileExistsA
FindResourceA
DeleteFileA
WideCharToMultiByte
TerminateProcess
OpenProcess
FreeLibrary
GetProcAddress
LoadLibraryA
GetPrivateProfileStringA
InitializeCriticalSection
CreateMutexA
GlobalUnlock
GlobalLock
LeaveCriticalSection
GetCurrentProcessId
GetCurrentProcess
FindClose
FindNextFileA
FindFirstFileA
lstrcpyA
FreeLibraryAndExitThread
GetCurrentThreadId
GetModuleFileNameA
GetModuleHandleA
CreateProcessA
GetLocaleInfoW
SizeofResource
GetLocaleInfoA
FlushFileBuffers
SetStdHandle
LCMapStringW
LCMapStringA
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetStringTypeA
HeapCreate
HeapDestroy
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
MultiByteToWideChar
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
HeapAlloc
HeapFree
GetOEMCP
GetACP
GetCPInfo
ExitProcess
EnterCriticalSection
DeleteCriticalSection
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetVersion
GetCommandLineA
RtlUnwind
LoadResource
Sleep
GetFileSize
ReadFile
VirtualFree
GetWindowsDirectoryA
CreateFileA
SetFilePointer
WriteFile
GetLocalTime
CloseHandle
GetLastError
VirtualAlloc
CreateThread
WaitForSingleObject
GetExitCodeThread
TerminateThread
GlobalAlloc
GlobalFree
lstrlenA
DialogBoxParamA
EndDialog
wsprintfA
MessageBoxA
GetWindowLongA
FindWindowA
FindWindowExA
GetWindowThreadProcessId
SendMessageA
IsWindowVisible
GetClassNameA
GetSystemMetrics
IsRectEmpty
ShowWindow
MoveWindow
GetWindowRect
keybd_event
mouse_event
SetCursorPos
GetCursorPos
GetKeyState
PostQuitMessage
EndPaint
SetActiveWindow
CallWindowProcA
ScreenToClient
SetFocus
BeginPaint
PtInRect
DefWindowProcA
TranslateMessage
DispatchMessageA
GetMessageA
SetWindowsHookExA
IsWindow
CallNextHookEx
SetForegroundWindow
CloseWindow
DestroyWindow
SetWindowLongA
UnhookWindowsHookEx
GetForegroundWindow
DestroyCaret
CreateCaret
SetCaretPos
ShowCaret
DrawTextA
GetDC
ReleaseDC
EnumChildWindows
GetWindowTextA
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
UpdateWindow
GetDlgItem
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
CreateDCA
GetCharWidthA
GetSystemPaletteEntries
GetDeviceCaps
TextOutA
BitBlt
GetStockObject
DeleteDC
GetDIBits
DeleteObject
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA
DnsRecordListFree
DnsQuery_A
setsockopt
ioctlsocket
select
inet_addr
WSAStartup
WSACleanup
socket
htons
inet_ntoa
connect
gethostname
closesocket
send
recv
gethostbyname
EnumProcesses
GetModuleFileNameExA
EnumProcessModules
HttpQueryInfoA
InternetReadFile
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ