Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
bd2704cb90dc30c1bdc3dfa53261fc9c_JaffaCakes118.exe
Resource
win7-20240708-en
Target
bd2704cb90dc30c1bdc3dfa53261fc9c_JaffaCakes118
Size
781KB
MD5
bd2704cb90dc30c1bdc3dfa53261fc9c
SHA1
3f3c3847da7dadddfebca219701aaf6a08176126
SHA256
b0f08503b2c16f2313c1824700bc950ea166349fff5384ad77d79bb3e49d3874
SHA512
5df7b03fa72ac718c3da1a82b00e14eb079db7fb4a072d5bad598a78ea95aeeba4fa1474ce3b7ff0f261526d56fb07753fefd30fb7d517abf6b29ac8665b030b
SSDEEP
24576:qhB2uantzDseb7tlvgdQFI8xd/93MzYfRsOkUm:qb2uaJlf7gBUm
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
ord1
VirtualQuery
SetFilePointer
GlobalMemoryStatus
WideCharToMultiByte
GetSystemInfo
GetVersionExW
GetLocalTime
GetCurrentThread
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
WriteProcessMemory
VirtualProtect
GetProcAddress
LoadLibraryA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeThread
WaitForSingleObject
TerminateProcess
SetUnhandledExceptionFilter
DeleteCriticalSection
InitializeCriticalSection
CreateProcessW
GetModuleFileNameA
LoadLibraryW
GetLastError
MultiByteToWideChar
GetFileAttributesA
FreeLibrary
GetFullPathNameA
GetEnvironmentVariableA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetTickCount
GetCommandLineA
CompareStringW
CompareStringA
GetTimeZoneInformation
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
InterlockedExchange
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
CreateFileA
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
CloseHandle
WriteFile
CreateFileW
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
SetStdHandle
GetSystemTimeAsFileTime
SetEnvironmentVariableA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
RtlUnwind
UnhandledExceptionFilter
IsDebuggerPresent
RaiseException
HeapFree
SetConsoleCtrlHandler
ExitThread
ResumeThread
CreateThread
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
SetHandleCount
GetStdHandle
GetFileType
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
ReadFile
HeapDestroy
HeapCreate
VirtualFree
FatalAppExitA
VirtualAlloc
HeapReAlloc
Sleep
ExitProcess
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
FreeEnvironmentStringsA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
MessageBoxA
GetWindowTextA
DefWindowProcW
PostQuitMessage
DispatchMessageW
TranslateMessage
PeekMessageW
CreateWindowExW
LoadIconW
LoadCursorW
RegisterClassExW
GetSystemMetrics
GetStockObject
RegCloseKey
RegOpenKeyA
RegQueryValueExA
RegEnumKeyA
MiniDumpWriteDump
SymSetOptions
SymGetModuleBase64
SymFunctionTableAccess64
StackWalk64
GetProcessMemoryInfo
qS|�I�^����Bɢ��)��V���5}R�S���d,wQ���\�0k9Y\�K�X8��)�$HSB>�)� 7��� ��G�e���&�6ȸp#E� �.G������������ �2�L�,h�Z7G���|�]E�F���q�<UW*? b'���|H�t��9)бF>d� ҙB�&�!�Bd\��v�R�����z�����IMh��D\>߱�DG��g������$O��z( K�I/��SB8�"�����*m�40@U'�k�� b��F;T[$��"�$�8+�K?����m�(�����:�,v�閥>G�����^O��1��oV��H8+[WY>�6��4nA������h����<�n g������>� ����À�5I�V5���摀{g���wwm~fB�G���Ɖ2��5݆�(���#ẃ��r� �4\���0Vx�������t���d��M����2٩��%�����Qa�Y�X����]9r,�`��|�W(zJ$���|�t�x�H*����_<�ͳW(9!p2�F��ޜ��|gItswG?t�RX�����3��1�wtrZ~�ħNa% �>/���F��{*W�m�{4_~;o����|ϲ�@p���ٙ��k��e�����P������s4dC���.B?8ց<�!Ju��1+qB�(���l��W� ����K�Ɏ�EFu��ymU� i�Qߟ�ou@�і��Q��A��8�91�<G�X���2��b�����,O0:n2��132��)���P��*�nӥ����~�m��)��&8I��7�62�>F=�J/��U�o�Oh�v[ͱ�������9X#�n9�\T[���* �]+mRp�.T�v���+��]ҡ"L�u:���/�H�����5� H�˪��¤L�d��R���7��Rנ������Z�er���GJs����O���0�c�o��'��E�V@���\tP&2��7���x���B+*d������.Vh����.F��Ў:5�Y��[\*�:��Z�|���N�P�Z�P�yF�0t�&��w��K�* ��5��ԑ�������7UxhS �(t���>�bL�����؍#��hJ�Z.�އTTf�H<ir~'��Q�����1����V�l�Se��M�1��Oo�[P�?�Nm����Qt5����� c:+�`x�`17���!���������C''����C.p���Tύ��=nB=��.�+lަXG�3�R�n���ˉS<�-�]BC"�.BM͜E����&����9RD3��f-�?�s��Ej�a�8(@3��K���1V�@�����nb�Њ�^ug�A����{���*�q��FY�b�@Z���������n>}Vo�Ά���̹��4xLb����.9,WU۽x@�=k���u��I��"߮�|�1���y!���uz���\���6=띘]u� �� �C.�6u/V�ʤ6��[�J�VDz'��;gr���s�Ӓx���&��<T~��M��������5%P0���Ƭ�� p��%���m���~HJ��o�?��N�!-�"$-�Ō�G� b���Ƀn:l,�AY���g�|�%��꛴� ��!^���;�++��@�;��X���H���:��3ݹ�@�o�@%�����`���p~70�Wg'k:y������q�֜�"E���E��蠝������ �1*1��$8�.+-5uw����>�a]��?�O�a�OP���n�5��{��� �B���D��-$��3��BӶ�,�Y�K���B�d�����T�dsy�d�Xר����gĿɻ��H=�����ŒmC Moy�����:|���r��~�YZF��V1S'��~��^����ɬ]R�K��|V��0�C 0�[4�!lؼ瀹CC��wa-��u] C"_ő��+X�����3�0����E �bi �������A��ӽ`E�f�a ��X��k}h��%��#� ����/,ױ�F��{�b���!�_���:����[|b�����b�'�i��IU*�PI���<�3��J�f���v��אb�����-��x��^��a��4w�x�G����3~�`�}�3��M2\?����?�}�F�o���Vo�5��\�Y������Lw�1݂Z���C���S��M}{���cm�@E����V����9�&σ;V�f����t���s����{����}�\�p_ۊ2���]��}jҥ����@%����Wѥ�c������|�{�R�� ��efD�}�������`yD��S��f�r����������������������.�Q���$b��z�y�2�q#��n��;r\%�Q�V���5]@*�q^Q*R� �5�Mh"M�ߐ~J��aEƮ�Р��� g����P�~ ���L'����W�,U�z<a��Uf:jT�������8����E��K�����/�q.ȕ�ޫF2�ٷ�sQ�#�o��O�*��3CN�<a�\�����F�V��:����!y �)SWR=.�����}������n,���r!;@�ӑ�����d�e�NUpC�~�~|�D�9DL�4k�&��3�A��Fn|8#�2X�y<��a���yA0*�x��87dTߨ]����882f������( �� ��w�䞄+��v�4k�sXU�i*\�J[`=X����m�n?������;��|B����ߓ�� Ng�|�z���Y��;��0������� ��`��oC-���/s�t��`3����;��$� "����<d������di�(�}<UΕ T��@撧j�$�bOjꔫ�o��:��{9��M�FSB�V�֔��n�r�w�?��En�:I��So�v*0�����"KcX�1�=����E�F-Y悹�ʭ(n�m/��E��ܓ�H+�u�lx:@1n��]��Lx�v�r�� r*ՙ�H͞��K� �)�NC^���(ؗ�a:���@���L�i���t�SP�������;��ĸ>�pOhMO�l���\R恧�5[go�7'+,� ԚO��1xf 9�EǦ�D��K���iYr
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ