Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
71f8fb73be84e3d5045d4cfbf7ed4f53_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
71f8fb73be84e3d5045d4cfbf7ed4f53_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Target
71f8fb73be84e3d5045d4cfbf7ed4f53_JaffaCakes118
Size
1012KB
MD5
71f8fb73be84e3d5045d4cfbf7ed4f53
SHA1
731335466523a958c16a512c3ebf244823d6b85d
SHA256
7eecb8af098ead93e9bf2d5a4e86ff3f172e94566d296f061971410036a22a0f
SHA512
29d279032c9424303242fa2160863674e7bd541ff54e20cc0b5af668a110191023ce5523c5a4d9c6406e916d22af9839bb8fee246c53cdb9e9d471762bc2a2ff
SSDEEP
12288:WpX2pFipHXSQGf881mYqrwEnWO1yfiD6tlTmQdgtxWO85ryJ3ZZHXaay4J7jXyHd:WQG3fGF1wF61mbxWORh1x7jiHNe4/X
resource | yara_rule |
---|---|
sample | upx |
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetCPInfo
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
wsprintfA
CryptReleaseContext
SHGetFolderPathA
g�Ǽ���PF� �Z���Q��UD�$7�1C��7-b�ֱ�Ԇ��:�@ش��_S��|�nv ��5��ܰ!�����/v��FOQ����G��u�1pjφ/�s�nL�O�)���B���v�5r��2%�v���w����-����Q��I��-w���PFg-T��:?�[��8��O�����-�]d4��䘛UK���'5�EJʬ]��C��4 �[L�n�Wk ˅�`��i�M+���� ���8��xz-ᦃi���1v;��@�ϖ��An�jJ�2A���DY�س_`F�gf�������;C���f1b��h�^�S`��LgF� [;�ܳ���Q��T����cRH�R��D�Q�t�����"y֞���xh�2����9;�i��t��t�4��;�~�(�We�kW3_`JU��s��al�zv�KDB���`7�A[��^�xWz�̣ڎ��-�률��J�\P���_ ��[nR��A����?/�|A��N���iL@��DB8�ڜ�@�Cݞ��OX�ҽC���̣�}ږ��=�-�[x�7H=i��O���0�� o�yj�R] +=T��g�'��A���-�3r�����9�������Ҵ���5KI��h�`�y.,)?��fx¶G�@��#�}t��ْX"�\�SW�G����q ڛLØdL��@3����؍n��6�^�RSsO��8=��$<:���_pR1�C�*��x�Q.@�"�����{=}`n� �|X"�\��-6��fwD��(�`�M�Ǧ�1�ef$���4�<՟�U]Ge`Ö��u ��. '���$3� $&[(�D<�x�����Ev�S;D��`S۳z8E"0���*��o��QV�������ˇ+lM��a-w M:���,��l���B��%�T�5�2����Z�vX�hhr����c�̥C��`$Y:'̹�t�n�hx]��ȯB���"�5n_�O�F8� ���fv!�D���f.s?�f��� �n#�:���ǿ��pP����χ�L�ӡ���X᭨��9����P֤L�Fx�b�����e�l.�����tmm`���y�՟�?��p���f<̫�E����_m�Y k���ЧA�h%���J�[&��^�m��~��?�@\���tݶ0��E0pj��si<ú-�Ҷ�"�����A��s�3�6��Y��Zd٧Z]�W�!� �aBCI^�D/��MϠ�]�M&ڧ���or��TmU*K#Q�%�RK�vW3�H�76�t�� ��,�x=���I?�ʸ���^��[�t=sNp�r74T�?�]Q���NPtob�>�t���^nQ�dzN�@ϟ���F$ #�������4��r{Ho1�a�C�c2$��pfɥXUT�-��D���axf�M�9f^ �����'Ք��ģ����tn#�����P���R���C�:t��o�� �:tK�!�7�'�T��,�6�3�ֈ����y:=-� ��!~?���r�����Ԓigs���CL�ɸN�69����^�a'���&Dũ����\��S�Մ�ѐ� "����Q֯*�U�:��pq��w�kx�hz����F�Cg0����+��`�36�a洂C,ex��C�<��;/B���q�����p#^�S��4�=ܽ��ɢp)��������Hf�2|{��s�����l����`���MrIf��*�!M���V0BGa�-c��� ����م�cp]�F 0��W<�?�V�H���f@�dv�a;��T`#�pTy��D����Q����Sg��ۻs���A�r�QX���a4`�F�Y{�*i��u�]=����wEj��ᡞ��G��)�"b-�ɞﮇT�U���}@��(ի9��??��%-˚������� e]��o"��U�8яk���!��h��\o�ag t�2����T����G�SQA�w��6�A��ht����7Kwhpuc�D�G���2���h?*@B��V�lfY��Ma�}�1V�6|�,��VļyT~S}d�0�&a������Wm����P����,`/�J��ҫ��봎�26���w�ESI@߱|k[)m������f�2�u�ouf�#����ŴH�fW����h�S�U8*J���Ia��<�n�k�¡����82?5��K"5��� `'WFPD{Cv�0��I�'�3j��7�ԭ�]V�,�U�u�=���Z̉F:�9��FԮEx~��,$�y�e��r�������qD�jT���o����j�3��O��T�a.[TMI��������C�M����T�����q���@�/h�t�����ط�P��WU�f�]�S�7Q���:�)�^O�5Q�n���� �Of�:�l�Y���5k�!�ʮ�*�pzh<H��_ ���-v��5<�(� �@�&%���p� ^�k{�}�i"��F��î9c75ō�`ͼ�8�D�/��4����W��ޣ�d�'��xN�8�h��'��RYkJg_�G��d�����/*��~5 P�E�,$�/�\�E�!���1�y@����=+�<���AcX�Ch��a��uBj1��r�����4Bu)�:���<%��A4G�$+�fy�Xq������>�����\j��p��j��?h�>ՙqWzA�K/(��M �w�]���\�{[ ��jډ��>fio���d��^��&+$��FoW�����7���|ݻ��<��Kmq��y��ߧ,t��ƈ7��i��էK� �M3jOL|��c�KV��'ܯ'U�q�ܹc�(�ez��2^}�A4<�Hv��� ��7�Ag߸�6�_Ԋu�����v|XV�T�8�� kof��m�*��q����Kta��b�X;PX�QF ����܄��z�V湲���E�m�f3��U�p��O�I1|>��L��o�8q4��bu��]2!�)Cla�I&X�߫neIJ�BsZ}>y������d�����|/��A������,'�[ǜx��*q2 +Cܴ��X�<�VQɾ"J(`�}qx>���=��ʰ`4�N�mux��v*L�R�_ �n
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ