Extended Key Usages
ExtKeyUsageCodeSigning
Overview
overview
5Static
static
3517vpn.dll
windows7-x64
3517vpn.dll
windows10-2004-x64
3vpnclient�...mp.exe
windows7-x64
5vpnclient�...mp.exe
windows10-2004-x64
5�...��.url
windows7-x64
1�...��.url
windows10-2004-x64
1�...��.url
windows7-x64
1�...��.url
windows10-2004-x64
1�...Ӱ.url
windows7-x64
1�...Ӱ.url
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
517vpn.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
517vpn.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
vpnclientᰮ.vmp.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
vpnclientᰮ.vmp.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
ʰQ.url
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
ʰQ.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
QQ.url
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
QQ.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
ѸӰ.url
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
ѸӰ.url
Resource
win10v2004-20240802-en
Target
0a63282a8cbcea9f675985a26db6d7ee_JaffaCakes118
Size
1.5MB
MD5
0a63282a8cbcea9f675985a26db6d7ee
SHA1
1f3e2802c573cc51302c84a1e2c6cc39ca19ea8e
SHA256
9f5386b79836098af157db7f3e3e0761fa615d2d3f7999e4bc737078e856dbe9
SHA512
2930b9cd3bca82ab3f0cba8abd55c06a87793bd0100b334581869c0ee07e285b83ab9c80c157fe1af7962409839b6ef29aef0f5b794757500fdd60c254973c44
SSDEEP
24576:L/41qmzGRlXIG6euHqpIAeKgP4kSDkrHcLWt2ss/IZ02WZOuX+BBiLR/muN/7FfO:L/41qke367HqpfeK7Zkr8SUBf25daR+R
Checks for missing Authenticode signature.
resource |
---|
unpack001/vpnclientᰮ.vmp.exe |
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WaitForSingleObject
OpenSemaphoreW
CreateThread
TerminateThread
CloseHandle
Sleep
GetModuleFileNameW
FlushFileBuffers
GetStringTypeW
GetStringTypeA
SetStdHandle
RtlUnwind
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
RaiseException
HeapFree
HeapAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
SetUnhandledExceptionFilter
VirtualAlloc
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr
SetFilePointer
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
CallNextHookEx
RegCreateKeyW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RasEnumConnectionsW
RasHangUpW
RasGetConnectStatusW
RasDeleteEntryW
ops1
ops2
ops3
ops4
ops5
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
GetStringTypeA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
RegDeleteKeyW
ImageList_GetIcon
GetFileTitleW
CreateSolidBrush
CreateIpForwardEntry
CoRegisterMessageFilter
VariantClear
OleUIBusyW
ord251
RasDialW
ShellExecuteExW
ExcludeUpdateRgn
GetFileVersionInfoW
sndPlaySoundW
DocumentPropertiesW
send
ntohl
�}�2��+��rW �,��\�P��/M(fzVz��IN �(��kF]����J���R��n�@��6���;Z�E-��b����G��8�: �N�j�W� �Ҳ���A�_������>K]8Lt4�I�d�*zc`��x�Ȍv���a�&R>xr��W,�3��T_��9�U� ��5�B͛�7QsX��,�`��Ƥg�����Gi���V��?��m�^��A�Z��CPd^ &V�#��s#��_�x�w��$��)c��[��/��6=k�@G+����.�4�T��G���qh�F�����mVYo�c���c)cվ��L#m��ݘ�n�p�@�1�ˑ�x�P�n6���K�� ���2J������� #�~��5v���w�UV�§i�r]T��520��~:x�q�Ws��5���CM 2�)qG ������ ���b��"�]�"�oLU�a@ �0��xzV��Tߜ?�뤉&�����K���0�жN4d����-�s ��pһs���?B���<����)�!��ɕ��쬎���Ӯ������ <��j��8u [*<���� U���_��v�+xZ8�_�,xk��L��[3��O^�ѼQ����n <L������麤{��pkm�i�X��Q4�d��!/ r����wX��F:���e�n|�ʷ���2�ь�k�;�{������<��,_�2x@E4�� ��V��������w���*s9B����J%�J����W[}.[p�U�S��V�.�=O{g��X?ch���5]AҠ�w������- b������~���H&R6@�=���3~(̽O9 �,~a�A�VR,����)��=sJģ��ϐ�В�VnRd=tt�J�#�? ��RD8����W��8=�ݦ(�`N{L E�!�T��t����+���B��C��OYݡZٺKZղ��?�*ł�1PG3Gm�k����O5W� �z[�V^3�q����_��lLm���߅d��K^������wڛ�櫍���Q�P�� ~!,n�4�!M��8��^�ௗ�膼e��$�x�{�";Կ��W��˂�6�f;��ZB�wC���f�{t( rr�>�r6�,$r}�� ��d�d�5�D�Q�G�ξz^a��$ �w@�t�����?u�wT��LC�j����;��/!�xw3��4w�@�G�.��NQ��;.?6��0�4����:G~�/=8P��>�6�NX[�#S;�<��SF}�K\ش�� *���*J�TZ�Nz�H\̤S���r�����(���Aѹ���I���<����V�FqjEu%j�&�i����T��~�=��鸘���Aُ�_U�K:���x�PMj|ali?�w��ǂtށ�P%��b=��,�eW��IҢ)=����{���������P�hw��|E��,��og�=�b�=� �=�p����:2�+&s��h�.S1��X{��`�.���/&#�o�=^����-6�3�mߘ�3����J�[%�2]@u���U�f�z+��q#+��%-�>k� l��$�@�L�����E*��M��ER�p,��ch�a��(6�N:��V��\}���NI��b����]��Zj�;B���]��� �y�L�#^>�Ir��ql~ٽgO��\|�z� ,�9gnX��m�c�g+ua� 'J��P�6��:��/P#�k�EB��l82e��T1����6���\�����<v�ʶ�����-��2����� {i��"\m��qKzq��:2\�L����k�g�aӣ5>����^��;7N��e�� ��^�{�u� @_g�v��_&d1�|��-L�Dh�zM�N�Dh"�C�o1[{$v�{�wݯb�����b���o��l[�*3ּ��[��6az���Z���"�� <�2�4ْ2��=��j����.��=l���RY]�.�n�r����S���7��:��Q��Q#�b����R��9����=�D8�@F���2 nW�#��6#$��n( a�_ G����{���{! ��,[�]�k����M��F�O�l�t~Pt�گ��A2RR.��N:S���}�0���g�����[QiH�e���d'u��ti27nCѷ�=�A �V5|���?�B^�!aj�>��(W[��szՈ~�m�Ì�f��\jV�D:�ï8�����/d}��0ǹ�l�u���SO@J<&���{bzB�ڤ��������0�C��iY��P�� �`�G��{�Po���z���-|r�\Z�UB����� �BrЋM(@ti�ý:r�% H�����k�/<ꂖ��80s43�;��v��JC�D�{x�%�ǗA���w� \�SZQ��{�V��摂��i��7PJ�^R5�� |CPg�Z���^A�.���U�A�|+�MD�p�yeMܛ*����}��b�\dl�gկ�x-�0�uPoҧv����k�W邞`�=�[ӚN%J� �R=T�It��9'��� *V�z~��j[-te'����h}������b��Y�v0��L�L$w�̘w� ��h<���1z���J,`N��p@�'���CsS�k���� ���=����E0��� �fyM�|�w�'�_����ڡ�Lg ���z�� �S�o��0�v� ���[����g\� �IJQU�N�'�L��((�4�G��q�2�ά��L��+����d�V���t�0 �m�n�S �t�%Qu��O��$@̃��zl�j}�p��� m��g�Q�j�)��A�F+�:w(r��ƽ�U��Y`l�K���0�Jd��/Y1�oCL[a��>Պ-q�9��#r��s�AT��b�^�b|j_������7����CQ�+���v�����Խ�C��0 r���}:�A3�n��Y��� ���p�ߌ��}�������i7�p���t�y��ѱ�����[\2Rd~��>���F�<�x]�����4P��#"���U�Y�A���X�L]���ia���-�,�P����l����nT��� Y���a��U�Up�:v-���h+���"�;L
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE