Extended Key Usages
ExtKeyUsageCodeSigning
Behavioral task
behavioral1
Sample
ae270b0bb13c2ccf9586be36379986a8_JaffaCakes118.exe
Resource
win7-20240704-en
Target
ae270b0bb13c2ccf9586be36379986a8_JaffaCakes118
Size
431KB
MD5
ae270b0bb13c2ccf9586be36379986a8
SHA1
e365ffc2ec66bb6e82eb93f507762c54af20d05f
SHA256
642a7471803378ddc508aa81431a7433e67274b2c4515f7a6f55b6c68e18969b
SHA512
b56618cf17f6f7df9f477e7d0e2a7aef2017585fb1ac9c14dac145ea601cb8ae52f76685d5e84894bb35bddf232dd23d5d75416d31ac37d6ae8ef6d70b756a75
SSDEEP
6144:lBpfbbYp3swF56vUWMYaYiolvwLvYroYgyr44DGGzHmx3mqb:lLI3sG5i/MYaYPSbg/gEGGzO3/
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
TlsAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
DialogBoxParamW
MessageBoxA
RegDeleteKeyW
ShellExecuteW
CoUninitialize
SysFreeString
HTMLayoutCombineURL
GetAdaptersInfo
InternetCloseHandle
F��$:��)��?enตq��4��܄��I���.tK��α��-I?�a��z���9�e�@��r�� Q[q��c��5H�m�g���x��4�,5/���1�<�Anݪ���m��:D��YD揗�x;��>j����_O���;|��7��ޅ0 �w��l�)4+*�����z7f a���6z� H����FW���5Y� �fI�kEd��r,��m�,J�K :O��R\�&��LjyI5�;.�b�Saݒ�S6N��_J%��Yh�~Zv��]ս{����㭮kЃxgg�Q۹�܍Lm5ي�u�d�&���9��ct�~�s�`�&�����}�uK�)w;Q�]I�4�����1���6��yL�� f�p�n�wԁ6�v݉-�pnԷ����EeW�R��/���V���� �!A�T�f�e�.�JՊM�pF��S�UP_ ���ߖs�fM�=�Ȟ��o�@'�g�k�����v�)[%���pg���n+�O����SG�i��u�g}l%4� �%b�\X��o#�`ϗg^�,����+�=�q2�//�EñwnU��ݖ� ��� ��nw�R(z��vs'�w� t�h��14�)��'��c��D(�X��&�[o��Q@#��2��.*�z�Q�+PV�y>D�������r���tD :c�4�9�Hw����r.�&Kz��xǰ������0�:PE'w�a�h�����#z7�8��-��5/2���1�_�?���W�b���O��r����� �����N��Q����ht���EY�Z��{S��g7i���Mm��)�[�'���+�����!�^)�*o�4��|��R|ǒo�D�L�9�o8{�ͼ(���!Z�%z������]J���%��^��C�� ������y���-�M2� XSD���u�Eŀf�R�%1:���P������U3�\��'`�G��[H3���� �Ƈ���1�a�����)�V瞔C�#���c�Lq��-w_17\��FZ?vtv ���TyG !3�B].���Y��l��;*H�_��噣���>��G~�~����������=9�k��7���݀�vL"'}��$�� ���hE��U�FT�j/Y��Vxe�u���Yo��eWDve�YI���*�R�wʍ�]fMu&^�9�rQ:r����e��ɒ����������ږ/�<Ms�:��R�ݷO������U�����R���}���2?H�㧙@@���i3p'0������՜<OR$n�$��`�g�2�3)�|m��=��q�M$�ャ�)K7�T�fcz���IJ9��{'lЏ���F��ص����+��V�6>�����E��7#]o���Oc��,���`�V��7V\��� V7����6�|Ȏ�����ȍ����T�S5& }]B<�&�Ib�2��\�m�͊kXwD��X0 2jn醃{GP�-ub7���h��2W�����z8I�v�H��OZ9���\='�N�� �p�f��� q�v���)L�)ژ�y� '-�`�N�U��z`E��wa���`�R�_/��la�����rn��a9-`RbY�gCƚT�xź�8��?A�r7eX�R �5�������䝫� ���S9:�.y��)6bb�y� (䳌Z���Q.��A���48MȲ�Zd� �łu?�f�^�L0K��Ob8�r��јԒ�����S0c]Z��5%2�AU��|em��ֺT@�v��J�O/U���M���?:2��Auk���!���u ?/ﭔ��T�9�\�ů�@Ʒ�,��I��wŹY}�����5��%عE�x1�o{m��j =�55�����*�l��Ȇ��?�aӲ�O��dE�x"��K7���[�@hb�4�e~'���jc��{(iʻ�EB-������W��A� c� J&O%y���$e��=�ɀ3���%�<}��v7���!��ײ���=���4~D4���J�?�dܫ@ve9�%�E4&K.'��p�j�"1��Y^�i�}C�}'ڱے&�tM�;C�J`u^M���t�Ť�p���E�ր">��G^B�� �j�`����m Eُ3r�ui��0�œ<����̍���ܪ�z_�8M��\� �O����L[39 �+ S�]VQ�IY��.��7��#���&{P��S0�s��GOQn�a5-MPu��,��Y՜��2?HkTDw��T.h.=����kfu����od�fh�$FH�?qD���4�����杻���KʲosyE�cS*����4�3�V�Z���D$�`���k����Gxă[�jpH)7� ��D�˅��s�f����Op�e%��6��[�d^���`��*Õpq�k�H���a�?�e.�\'��bQ!$���%�- ���Cj�.�RJ�y����j0(��]�l��(�;��m��0�%�6��""�uM��� �'���A,�{yj3(|�T������h%�FYh���� ��e���(ɍ˃��x����0M���e;�$�Վ��ߛ�)ŨM�`�����Ə�m�LE�.��t�Ug��ݰ2�l϶��Rl+CQ�W(8kZ+�Fwݞ�a�S��$�m�S��wYY���%����<�@����a�;�[)J���^Fl��/5��[PB�v�*B&�Z[���+��N^hY��s55e�&^$��� �`�%[��9���I�:\h+Dg��Q�����{���I��ɐ��]WmJ���!����(�< rt���� ���3�� ضQ�؆��D�9�L�ӞШ����tDF�>)�~�2e�2S�z��\=�o���6�ǣpS=�^��j��@�����w��W2�D=��!h�d>�Z���+�������$�Y��G�NE ��c�k���C{:L�.�%��i��I�*���s笵�i(�<4�+�����s����h�Yˏ���C�����2�2B���r-�y���OX��҂�G�����u��b?���݀#N��Ω����G�X���t�(ᷰ֎Wx�2Z�� �Q��h��[����R����:�K]%�:��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE