Extended Key Usages
ExtKeyUsageCodeSigning
Behavioral task
behavioral1
Sample
fef97d1d73064e7da7b5ea8b57b0d3b4_JaffaCakes118.dll
Resource
win7-20240903-en
Target
fef97d1d73064e7da7b5ea8b57b0d3b4_JaffaCakes118
Size
145KB
MD5
fef97d1d73064e7da7b5ea8b57b0d3b4
SHA1
9b2879065428b345d7420bad3a99a27ad3136b32
SHA256
4149297ba45d37426df06034c9a3d87fac7394e286fe43861d21168c5afab1b0
SHA512
89d07a8f6c35975dd539549e58aa4cfb9c861b9e43af2b3c4f95908b3b40e8e3e809f4a45acca23215db27127b75f1399873c02d730d45864eaa7ad606e9dc08
SSDEEP
3072:uYeH/pe42Ix5KrXUfnyq80hJzaYmkug5tbHVFCMEac+Ee/6q:neHheGx50kz9hJWYmkugXH7TEel
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
TerminateProcess
OpenProcess
Process32Next
GetPriorityClass
Module32First
Process32First
CreateToolhelp32Snapshot
WaitForSingleObject
CreateThread
TerminateThread
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
CreateEventA
GetModuleHandleA
ExitThread
SizeofResource
GetCurrentProcess
WriteFile
CreateFileA
GetFileSize
GetTickCount
SetThreadPriority
GetCurrentThread
lstrcpyA
GlobalMemoryStatus
GetVersionExA
GetComputerNameA
InterlockedExchange
HeapAlloc
GetProcessHeap
GetCurrentProcessId
GetCurrentThreadId
WinExec
LoadLibraryA
GetProcAddress
FreeLibrary
MoveFileA
CopyFileA
DeleteFileA
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLastError
FindNextFileA
FindClose
CreatePipe
CloseHandle
Sleep
GetStartupInfoA
GetSystemDirectoryA
CreateProcessA
ReadFile
FindResourceA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
SetCursorPos
keybd_event
ExitWindowsEx
mouse_event
CreateWindowExA
CloseWindow
SendMessageA
IsWindow
GetSystemMetrics
SetThreadDesktop
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
GetThreadDesktop
GetProcessWindowStation
CloseDesktop
CloseWindowStation
LoadStringA
GetDesktopWindow
wsprintfA
MessageBoxA
CreateDCA
CreateCompatibleDC
SelectObject
BitBlt
GetDIBits
DeleteDC
CreateCompatibleBitmap
DeleteObject
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegOpenKeyA
RegDeleteValueA
RegSetValueExA
AdjustTokenPrivileges
ShellExecuteA
SHGetFileInfoA
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Xlen@std@@YAXXZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?_Xran@std@@YAXXZ
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
memmove
srand
atoi
strchr
strstr
rand
memchr
strncmp
_ftol
printf
exit
strcspn
malloc
free
__dllonexit
_onexit
_initterm
_adjust_fdiv
__CxxFrameHandler
??2@YAPAXI@Z
strncat
strncpy
sprintf
_strcmpi
time
capGetDriverDescriptionA
capCreateCaptureWindowA
recv
gethostbyname
inet_addr
WSAStartup
closesocket
connect
send
htons
shutdown
sendto
WSASocketA
htonl
setsockopt
socket
WSAIoctl
timeGetTime
.(I� L*wX�[�=��{�'_4{��]�����!=�����=8pA��G@'��r�:̷�� o��W��BJ��' 6��唐s`�݉ w��4��ȿ;�,ό(N(�n���xt��*��d�u(��E�ʳ���qqћ����%Áa���g4|��x#j4�� b���5�RH�G�Q:��r����vL�H���s��#�J�C}��BD�H $۰_r�政�3 ��/��!m�I�`�cأw#};ȼ�E�����HZ�.�/~�x�x�~V���SO�R_݉�� P�]��̝^$�@G�xv7�B� ��!��Y��9��A�9*<�lX?�?x�\���ذ��F���V�>4>�_X���T�W6�=ثU���"���C;�e}H |jo�6k��94���vMK�v���4���>,����0xdV��k��ӫ*��r^͖cMI�����s@��L ���iЂ�����hڜ~������!�a�� �Ń�t���n*�_�Z�����"���(j��XH�[Ɗb4Y}�v��`�{[�R������ �mvA�T�t����"E�8�m+#����lz��b��ǻ�����*�".]�J�m�����̼#�R~m-���4�%y�DUdS�r�r�ր�|�4�]���d��<��$�>�3 �u�e�����{r-� �z@V����ez�!n2�C<��aX�_^�*w�ΘD��oSݖ�W�霻�I�(��{�,Φ�|vā1�p�l4!a��C|K�!���/#�[l�ѧc�+�T��*���>�I��m���{���:q��֊�n�B�<^�T(�V�<h�tBc���������<�ύ�� xV��t'�Ԡ����^���g�w)C���_b�����mD��캦ǐ K�\�n��`n"�+���ޒ���A=8�'|�V:�����N�EڑU�P�iy�=�����3{�ըBcI�Dea�d��d���D4�&����o'�ph#l�)��� �2 ��!>`�j�؝ô앂I�&P��������\�k�\�,�߷76$Q*�յ�f�R�T0{�����Z��j�^^QN&'s�I�s�r�P��1���`ײַ�5���^4�]�|��Ӭޭ��u+0�i2^C!r �N�f>�>�:�B���)�)o���ۨ���k����8w^Nv��ԈqX�I�c�_`˪��ۦ#�AB"�1;H]�I�qM��E�db��Uu�@��BڒkXM�:w`��Vư���Y� Ȑc�h���tv��i%yc�W��/�e���Qp�~[J���w�G/H)ߪQ&'5ۑm���t�A�����r�2׳����dRl|�y��8��J ����I'J(-H�u�LU���}��xo�ހ�>�tL�3G m�ވ�zj�U5Z+�!��f$�u����Y=9 �Kx�dӍ�z��)e!�h��(:�Bᓏ+�D栋q��4cLd��U�|�V�xK�����x�ph\�j���F�Ko��L�gρ�R���.���Ԓ�u���9!a�F�/��t���P�� ���^)�����릴�ϑZ�#ʸ)pv�Hj��,V�܌���0��2ڬIӗ��Nc>ҼC��d��]�A�s�J��bؽ�)���o���D�e�vo�_�4����>���eDU���g;���j���H�0�%�F4���`A� 0œH��ڕ����lc=�a�{L*�u`�k�0��ǮABn���.��ħ��y+�V���Q}�賌��{ agl�:�>.t����� m3\��l����WԮ^sDٹ� �b��ɏ?��[sԫ��s��fT���:�n]^_s�������'5�5�*1����qLظ>��D�wIN�g�ж:X���RJ?����]bS���?@]{a=��"�btI��&�7��t@��5JE�&��9�����K}�ny��<��笲�G*R�ˁ�7��� M*Hd�����w�@�`�5�6f^��0A(oi�(+n]Bx���h�c<�'Q:N2��&q �V�3�<}J�ˆ��q�p�Bjh]��j�E��ϸnl���c�bʬy}����+2HڲU����3��PkN�\h�`��BL�~h�H���i^B��Bb���,�L��?��W���H���6 ���+A%��H=����� 4�;�?0�,� ^s���\~߸o]9���ඟn��Ͽ&ηĬ�'W�S\@���|t ��Ѓ�禂t��z<9O4'�� [>E�<.$Y轒K?FDs��]�聋��S�y �O���L�mf��1�ȏ�������0�1Q��k������E_ę.���@Jj�6��5����c+Enz,|� ��`?��]W�Z�M�܅ERe�v*��-/��#J;0'��O]�Jw�L�Spk;� yaP�Ӡ�LS�]���F8��j���H���.M�dI(7BL'� � XV���˫#��]�~�x;zP�K�J��(�/S,P�aL��;�ԀMxs==��<s|�wO_.`=�p8Ȉ�H�c�|�Mo�N�{Hq���5V�OL�LW�+��FW��-�u��J��M��o�+Dؙ� y�[o���y���[�CW3M����>��y{�R&W�78X���q����`�hk7WG�(�4+y��?�k��!���ޫ���Ш���rգ�<"\�&P�����P�98 �^� � > \��Vȿ�x��.{9Ҕ�Է�A�J�Ukul[����$��řh�]�h����e����;7�x ?�߆"{��6Qb��IݠiE,�D��v�y�9%�w�p��C��D��qs�!�o�M��Sɝ���S�;�o�� �S��!3#�4&}q�������-���*n��M���6��O�$/�:�u��|̲��'�],�h0���(jim���"7QS����"�+ �#��W-`��B2���`��c[ڝF#c�ℾ��u�1į K�li �x̠��%�|O�w�11]���Hl��1��$����e�m�*,�.=�ķl�-�(��p�lM#�Bޙ_�<#n�yi�b��cu�kRWӕ����j��s�)?�u�-HD8���`� �,��`<p�i���<� ��9Id��#�RWFa폦֒����4\
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ