Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
b5cd17f1cc78c30e2c2413d1683270b4_JaffaCakes118.exe
Resource
win7-20240704-en
Target
b5cd17f1cc78c30e2c2413d1683270b4_JaffaCakes118
Size
145KB
MD5
b5cd17f1cc78c30e2c2413d1683270b4
SHA1
711b0ac6c63ffa7d04d3cd6541f61bce68ce9f29
SHA256
b75b706db2aa28122dc704e5dcf6819d6a86de7f8ec195e8e09c6cf7a9db089a
SHA512
46651cf9e45cbdeb44f1db30df4d79be8666877bd92c06f7d3d937941064bb3859da67fdbb21fc092018f82c4ae3917b700b501b5de3b16a7b170d1501444636
SSDEEP
3072:3RHi5Q82q3G5697b+bMrTsEW6TWuv4JR1I7zNZ/N:hm1b+4XseKhz27z/N
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
CloseHandle
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
GetModuleHandleA
ExitProcess
WriteFile
CreateFileA
lstrcatA
lstrcpyA
GetModuleFileNameA
GetProcAddress
LoadLibraryA
FreeResource
lstrlenA
GetLocalTime
GetTickCount
FindResourceA
SetFilePointer
CopyFileA
MoveFileExA
RemoveDirectoryA
DeleteFileA
CreateThread
WinExec
GetLastError
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetOEMCP
GetACP
GetCPInfo
CreateDirectoryA
HeapReAlloc
GetCommandLineA
GetVersion
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
VirtualAlloc
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
LoadIconA
LoadCursorA
RegisterClassExA
CreateWindowExA
ShowWindow
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
wsprintfA
MessageBoxA
m���8ݪ��� ������'*®n�P�D��8���д�b����R�)L�&���kj��(׆�D��T������]�3.#����Q�����T��PV�8�F�>��ʼn���J;��N>������DZ��������0��cQ�텑o��(Z�.x��2�j#+RµǮd����Hſ6J;M����� ?BKBB�W�t�8��� z��4z�Dsc�{��c(/�R/\#�7s������r���+[��>���lF$���ñ3�e��1��\��I�FwƩ��',���9���4����tĻ-�G]����C��i�#Ì�v��*��������ʧcܯ���Y~�%�B���B�;����5�J� Œ4�gԒ¹�>�D�� ��}���Z���[����[<e�S7v�R�o�j-��x��n%4�9Hվ�6�A���Hm�%И�p�18���xPg����J�[H}��4�F�;�J��Z�������]�rm�" �MLJ�1=Ɍ��\m��U�Qc>�JCȷ�����K.�t�Z# �G�3�n��,_gl`���U���Nӥ5��Ͽmϖ�y\�$$0�ܟ�����Z�̄�&e����?��m� �H�]/|���B��ަ�# �A��O������lV��l,���Rh�$u;��Yc�Ȏk������O` ���~:~���βO���)�c-�K$� O#�매j߹},�4jPʟą?����_G�� N����� ��� U~~��6��Er2�H���0���I�������C6z����`d3G;������q��u�������K\2"�������儀w(���B|��\9?e%�y���v�Y١�o��/�"��zT�0�?y/~�/���4*\:���N�,�O������j>�O7"/�SE�w7���y?\Iʓ��Q�/���� '��wr����,�h�$n֒A۽� M%���dk^� �b�.U7����>v�B����[��F��,�|Ż/�"h��Y"k����0��p��h���1e����A�ӴƁC���p��y69� Yx��8V���^� m�&�T�+F�.A�O��n�$��,-�/� (Q�E��l��Y��J\�:[����٧m#��#�Ȳ�q�������D�#��h��T��3}w� OYF����� |�|`8rc�v��(��Y�"Vy��7��>��Qv���Ln�_�z#]��)�4�\��M+�)�<F�E����R<��;����c���ő�P�O������rC���$�"f�L��bM���.{Nֺx��'��Z$�>7e�s��D?�4�%���>[�d�p$�\��b� ���;��P2��5М��t�E�g��<�T5�K�ϝ ��#@�OO�}�]��٣\RM�R�6]� HE�����pVY�-��-M��h:��q��yF2�@��^�!��S6�t]u�Ĥ'�ʚ�.Z�;0�ܧ�pfoJ������"���n����26 C9A�[��/C�dد쮘U"߳�Z�*8��(5��%D��V���)�`.��*���/ ��۸T]7AV^̏aׇ���T�E��h#�N#�%C1Ք�wv�n�$���} בABLD# �3�5�j#�$.[�k��J�24�`��/�,��+N��v�������Q��r�:`���FB:!�����ǚ#cНI��@�I7��M�<F�Ҕ�4��^�R��^��� ����-��Q���8�2�V� ,���~^��8fmP�x�-]����)��ZU�Q����8,lqE�f�]h�H�,��A�ډ����k�U��@��52�B���g�jmz��F̭r?u��E+��*��'oT���tn�m4��B^vq2��z(�C���9�Ȏ#b�af��>K�7��ֲ�|h�~8K��;��Pv����sb_�I��L1��֙p���,��s��)�(�� �����T��R)�p�� �9��/(���M.��t���2u@���-����vhO����X�IO2^N<@��`����6U�4�H�N�@��dT֬��n��;���W�q�xAĀ6A�ٮ���W�������zC�P������Ҳ�]�����h�|��4 mþ5����6X��U7�����S�3�JM��r^�:k�yN ^s+�eG����X�Y��2����DL7n���2}P[L h�)t�>�V���� ���$%�'#��!@[�C������I�܁s:T��FǶ+B�.�?\R}�MD���Ѣ��4,�����PsvT���F�!ןل�����Oh�0=V�Hs�3׆�.?x����i��r7���������@�t}���%�6x�j� �`ʅ� ځu}M}�u|;b4�]��/[�9�$�PрR���f�]�{]+gN�l��Й��n�w�F�%�� ����wc�����l�Bd���]m������U!���ޞD�TE�}`o�G�=�Dٳ��h�_!�������G�-PS����e��g:�.���8��̜����!�jq�����RntŹ'F�W�<��N&F�Q��䄫Q�uX1�`�?La~�����?�QA+�(���������������a^�ʤ�����:�a c�W��ott�|Z}�i�i~-L�V`��H٘�D�-�=^������Cq��Uv~����eE��L�\\x�UAFv1�t��4��>]7]� ��q�|@&���;���u[��Ӵ��[2�rP�U2���bo�Aq�`��z+� >и�2@�OC�2��w a��H߁rG��/Q;}�s$��"��֚TK7�Y�s�n��<����]M��QF��_ �xB�B����Z:9��_�Xᜅ��in'f\�Ai'��(�7��ɠT��-Zb�¨8��G��x�Ej4���P{�}:W��'��!<ڃg.����X�|?p5`�by++�� 2Z�[<�(v���� R���m���Y�`��~����~"�\$q��j <И�2q9� �D���'H��ݑ�*�H\;�˜~"�B J�_��q\�q+�)L�I?���i�lʣ��(�|�v��P�����[��&��!3����&
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ