Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
Behavioral task
behavioral1
Sample
5da36a8ca25fa99555e138f85202bfba_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5da36a8ca25fa99555e138f85202bfba_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
5da36a8ca25fa99555e138f85202bfba_JaffaCakes118
Size
2.0MB
MD5
5da36a8ca25fa99555e138f85202bfba
SHA1
77d9537c56a9ef5e17fab745329e4bb45f59ded0
SHA256
47d35eb47851fd0c2e9a8094556b419e67f045c0d2513364d259e72f9765417e
SHA512
becdf30bd79903e19305c3729f092bbef25a535bcca21a13a4150cd121536d74ce992632ce90df0bd4e988a96eba0cc01cbbd62cb3f5eb927bd453bd5ef44401
SSDEEP
49152:a/i1e4QqI1G0qLozZMxtPWBtxWtSO1/Ghw3M0TgUTZFdDQZ:a/2EG0qLozZMWBtx41/GW3MKgb
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetComputerNameExW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
?width@QPixmap@@QBEHXZ
??1QDomNode@@QAE@XZ
?peerCertificate@QSslConfiguration@@QBE?AVQSslCertificate@@XZ
?entryList@QDir@@QBE?AVQStringList@@V?$QFlags@W4Filter@QDir@@@@V?$QFlags@W4SortFlag@QDir@@@@@Z
wsprintfW
MessageBoxW
CreateItemMoniker
VariantInit
RegQueryValueExW
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
_invalid_parameter_noinfo
NetUserGetInfo
'HA�o��e��Z6nl�Z�)���:���-|��,�`�V"�^H�MZBQ�/�r���=}r�*�����m��5��m�;���N������*4_��O����F8��:�8+Ȃ=/RM�|��o�ɤӆZ��ڨ ������%����{P�x�8h��<�e]Bi��k���e$ À4h��j�tD|US0��K$��U��n��)I�Ul��4+;O�*����馠b��i��dPElp��������r)�.�+54��n�etgB��ƽ���r.m��=MJT� .��>jA�ڙ�QÉW2#�(�I��h$�������X���P�4\��C��H�7lM'��9�0�#�"�|�D@QB����.]��w)� OG?��9����W2p�����P�;�v��yd�R49�����I|����EY��*�? #�_L:dS72���ȵ���W�v�� �����9�J� �`�hLt�{zHq�]�ֿb�yY�ڨz��D]�Vԇ˪�'��AG�mdw1m=���������n���Hg�&�̫�7�D@0j�R��{̩NGƺ&�������>5~-<�Qڷ��~7�d4ݾmI�j&v\������ޏ��V����z0&���H�pa��t�3'-Ր&8J����q)��t25Qm�]lF��`�os>���J�mK��q�P;���s�����&7����}Wԙ�q3�Xp��.�*�1�MV�@5#[v�ٳ�4Ͷ�7+b�{E�9RB;�: C)7;�z����Y\�A�C�xv�tײ��nJZ����y�t�ekٹ��jSF�hqS4,&1XCS���s���O����ԅb �*Hɩ�e�^/�9Zo��hU�<xIB���:$f�EQW��&�3�~����t�t]� 7���ֿ�먍����1v$��Ԁ�c�����`GT}+`��`a����9�0Y$uO?hIs�[����T]��n/�� %O�{�#=d��#+<�QM0"�BZ/Ȣah֡��K��C���ы!�����%��q���X��&m�k�!�Wh�'��K8����s�t6Ö�(G�?\�v�v����>���0 h�� �^��rs㶇�f�x����.�"�����;� V��u-Sfb����Ž4+,��m�U0d-�)�5��:�@���QK˵�R�|ιa���������M@�>�)`�UqtcW��5D^��Cg�,01��0o�����8[�t;i�yt�i9�Q}��;���?rL>���h� t�iH|{{w�'W"v���H=�x��G���f�K[/L�`)�3<��!l��Rv�"\8�%�P�����+����h��Q��� J���������Tqk�����e˳�&{�H=j^��ͺ+C�{Ӭ��-����f��SLp0��J�Fn����x �K���W���2 ��8��[$�@_�^����nCn[�?��8�H����)�Ν��'���'��u�#o�������D��?K�oAI��0���ի�E�*���GnNf|~���"�87�/A� JKu5Ǐ��=OVXî�IP�4ޅ",3��Y�������M�6lB7��Z���#���,�؆w�_�|�65��hWg̰�'���I�d���s��1����c�Q��C4(� a�J�Zϴ[V� ("�������ꢀ�#���?�q�ʑ�1��==��)Z�� G���>=a��.�ytW�_5�2�l� Q�W�d�Y-+�@yCY���B�:W��H�ظ4��7D�o�&��*/vS��:�UMZ�j}1�u��@�Í�2�{�F������*��C�F��,Az���ҽ�0��ӿw��>B�f^5��7��Fr���L��Eu�t)��S/|��r��G����^"�*�l6b+��?rC����4����&^��pC=��$��`S�c�Y&ۥ�O������r�p���t�)5�%T]��ӂ�#����.ބ/ާ'4b���*10 ���Y@�N�ρ6��sV��Z��W��ơ)0��)��3�����Jb���+ME��~q���e�h.��\�%�ϰLS+:<!X��H3<KT�wз���E.5�L�\<����o�H5�aqv$��y�~��:��G���ʰ���������ꄉ��3���c����&o�z�y�������@T���� y̑p�n#c>ȉ ���ء��{�N���n#:{� ��<�J���Q�Ŭ~q�*�aw���b3�]�k!�5S�}E~а�@�q�q�&~iPim�����e%lAɒ�)��E���sɵ��zẶ�G��N8��%+��f�������;d�`���X�C%"$�=��{A*����k�3=���bg�����|��nC3ۣ@�Ͻ�� /��VC8w�O�Z���sC��* ]aGX���)�o/�&g\�%!����}�\�_K�D-��qE [ҡ����B���������V��m=���p]v��h���V���M�����~Z�;���#q��7�G�/�X��"���m.e#��[ط�eU��:$8��,4偑*{�"��w ���=�`�����v�#���6���\~֩�*�ڻi��b�4������ՈM*� ������i:��=t!�$�������ğZ���}_1����qaЉ-�ᯋ��X�ו��7M����0+B�6w �[�R�/V/��������=�fkW����0�ί#|���D��"귫�R/P����.�t�t�ޓ��6�� ,����Dv~�3��\��������Rv�W��%��i�_O�z�T9&c��TqN-\�cN���� ��������P����&n���B�����ְ�ouS��!,H�wA����sIӭ�|Jy�A1����qԌ���t-4֥?��q�Y@�-�r�7��L"u8L�m��SQS��U+C<~l�\r�N�r��g�1D���D�K���G��}�~�|D�q�ud���,����jyy'���WɌ��ѱoͺZ��|VvA���`��,��q�<%*���ֹfڑ�Z�==��'�|w�;�e��%͘y}t{�\��.l
?biometry_adapt@@YAXABVQString@@0PBVQByteArray@@PAUKLFaceInfo@@HHH@Z
?biometry_autenticate@@YAXPBVQByteArray@@HHPAUKLFaceInfo@@@Z
?biometry_cleanUsers@@YAXXZ
?biometry_detect@@YAXPBVQByteArray@@HHPAUKLFaceInfo@@@Z
?biometry_enroll@@YAXABVQString@@0PBVQByteArray@@PAUKLFaceInfo@@HHH@Z
?biometry_init@@YAXABVQString@@0@Z
?biometry_register@@YAXABVQString@@0@Z
?biometry_unregister@@YAXABVQString@@@Z
?coreRegister@@YAXPAVIAsyncGeneric@@@Z
?coreSetIAsync@@YAXPAVIAsyncGeneric@@@Z
?coreUnregister@@YAXXZ
?core_checkLicenseAvailability@@YA_NXZ
?core_getComputerInfo@@YAPAVKLComputerInfo@@XZ
?core_getLicenseInfo@@YAPAVKLLicenseInfo@@XZ
?core_getSystemInfo@@YAPAVKLSystemInfo@@XZ
?core_getUrls@@YAPAVKLUrls@@XZ
?core_isComputerInDomain@@YA_NXZ
?core_isEndOfTrial@@YA_NXZ
?core_isSurveyAnswered@@YA_NXZ
?core_isTrialVersion@@YA_NXZ
?core_refreshLicenseInfo@@YAXXZ
?core_surveyIsAnswered@@YAXH@Z
?currency_getSymbol@@YA?AVQString@@V1@@Z
?data_checkPassword@@YA_NABVQString@@0@Z
?data_cleanHijackerFolder@@YAXVQString@@0@Z
?data_countHijackerPictures@@YAHVQString@@0@Z
?data_deleteKLProfile@@YAXPAVKLProfile@@@Z
?data_getAllKLProfiles@@YA?AV?$QList@PAVKLProfile@@@@XZ
?data_getApplicationVersion@@YAABVQString@@XZ
?data_getApplicationVersionCode@@YAABMXZ
?data_getCommonDataFolder@@YAABVQString@@XZ
?data_getCurrentApplicationLanguage@@YAABVQString@@XZ
?data_getCurrentKLProfile@@YAPAVKLProfile@@XZ
?data_getCurrentUserId@@YA?BVQString@@XZ
?data_getHijackerPictures@@YAXPAPAVQStringList@@VQString@@1@Z
?data_getInstallationFolder@@YAABVQString@@XZ
?data_getKLProfile@@YAPAVKLProfile@@AAVQString@@@Z
?data_getModelsCount@@YAHXZ
?data_getSettings@@YAPAVKLSettings@@ABVQString@@@Z
?data_getThemesList@@YA?AVQStringList@@XZ
?data_getUpdaterInfo@@YAPAVKLUpdaterInfo@@XZ
?data_getUserDataFolder@@YAABVQString@@XZ
?data_hasStationLockedFlag@@YA_NXZ
?data_initializeWMIInfo@@YAXXZ
?data_putStationLockedFlag@@YAXXZ
?data_refreshKLProfile@@YAPAVKLProfile@@PAV1@@Z
?data_refreshSettings@@YAXXZ
?data_removeAllHijackerPictures@@YAXVQString@@0@Z
?data_removeStationLockedFlag@@YAXXZ
?data_saveHijackerPicture@@YAXPAVQPixmap@@ABV1@VQString@@2@Z
?data_saveKLProfile@@YAXPBVKLProfile@@@Z
?data_savePictureAtPath@@YA_NPAVQPixmap@@VQString@@1@Z
?data_saveSettings@@YAXXZ
?data_saveUpdaterInfo@@YAXXZ
?data_writeLog@@YAXABVQString@@@Z
?data_writeRegStr@@YAXW4KLRootKey@@ABVQString@@11@Z
?license_activate@@YAXABVQString@@@Z
?license_checkUpgrades@@YAXXZ
?license_decrementTrialUse@@YAXXZ
?notifyRegister@@YAXPAVNotifierCallback@@@Z
?stat_getValue@@YAHW4KLStat@@@Z
?stat_incrementValue@@YAXW4KLStat@@_N@Z
?stat_refresh@@YAXXZ
?stat_setValue@@YAXW4KLStat@@H_N@Z
?trial_activate@@YAXXZ
?trial_rememberActivation@@YAXVQDateTime@@H@Z
?video_adaptModel@@YA_NABVQString@@0@Z
?video_deleteModel@@YAXABVQString@@0@Z
?video_enrollModel@@YA_NABVQString@@0@Z
?video_getBiometryAuthScoreThreshold@@YAMXZ
?video_getDevicesList@@YA?BVQStringList@@XZ
?video_init@@YAXXZ
?video_isBiometryReady@@YA_NXZ
?video_isBiometryStarted@@YA_NXZ
?video_isStarted@@YA_NXZ
?video_registerModel@@YAXABVQString@@0@Z
?video_resetBiometry@@YAXXZ
?video_setAuthenticationThreshold@@YAXM@Z
?video_setBiometryMode@@YAXW4KLBiometryMode@@_N@Z
?video_setBiometrySecurityLevel@@YAXW4KLBiometrySecurityLevel@@_N@Z
?video_setDetectionThreshold@@YAXM@Z
?video_setDevice@@YAXABVQString@@@Z
?video_start@@YAHXZ
?video_startBiometry@@YAXPAUKLFaceInfo@@@Z
?video_stop@@YAXXZ
?video_stopBiometry@@YAXXZ
?video_unregisterModel@@YAXABVQString@@@Z
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ