Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
Behavioral task
behavioral1
Sample
2966eb74a150cb8305d0cb7f6c89ed02_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2966eb74a150cb8305d0cb7f6c89ed02_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Target
2966eb74a150cb8305d0cb7f6c89ed02_JaffaCakes118
Size
638KB
MD5
2966eb74a150cb8305d0cb7f6c89ed02
SHA1
fe920933fc907a50dc1d323af44d07aa9bc434e7
SHA256
42c31bbee2afa891065790c363b28c2fad625526a0fe9de7d1c89c0aa7f38479
SHA512
b6651998f62e5922a5d2ba8e1839fa48552e2e31bb036ea1f47ced62676b1cbe5a6ba88355a1c23080fdce86e6d6776fff4a3816ea5ae5fe277c9f156eab0bdb
SSDEEP
12288:EtukbimSiaAtjSfpOmLxJwOocQ3jAUhOccll:SoAGp8O5QzLHcll
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaAryMove
__vbaLenBstr
__vbaStrVarMove
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
ord517
_adj_fprem1
__vbaRecAnsiToUni
__vbaCopyBytes
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryVar
__vbaAryDestruct
__vbaOnError
_adj_fdiv_m16i
ord303
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaStrFixstr
ord309
_CIsin
__vbaErase
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaPutOwner3
__vbaVarTstEq
__vbaI2I4
__vbaObjVar
DllFunctionCall
__vbaRedimPreserve
__vbaLbound
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord608
ord716
__vbaFPException
ord717
__vbaInStrVar
__vbaStrVarVal
__vbaUbound
ord644
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaInStr
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord681
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord100
__vbaI4Var
__vbaVarCmpEq
__vbaLateMemCall
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaFpI4
ord617
_CIatan
__vbaAryCopy
__vbaStrMove
ord619
_allmul
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
MessageBoxA
�>S���A1V?�%&S뒗���?�������t�A���p�y�O������C�=f��ު_<��&�Wnҭ9����,}�ɭހ#��=������ Z}C��6ٖ�F�s�^��3����R��bĞ���������ԕ8��WM��"���w%��0�1L����?ju�uY���/yD�sx� ʑ�Ve�"WE����Y�h�0��\�*}�?�i�J m�r*������,a!I�{�i��j� +��g�!1�O@�uW�n�E��&`'?����m�� ��jL���҈c�kG�*}�V��c7����&gd���s��Ш^�\/�[��W���&aE|`�R/>���*�l:i���e'�I�I�6q�ZuyYHa���e���q�� i�/��?�M��ƜBn[�$~����U[��EۃE��������hճ���u��w_�]�~:k��ٕQZà���G`s̾� Р��l�І�\9���0�$"�����b �����JR�T]�d�a0�c�u���3���pa�:#�_��p��n#���ف��S�#��G<I�Gj': ��2�q��A�)o%���2?S�'n>�A��&iM���������.�����tZ�)دLM�B�*9��S�q���k�1�_���4ƈ�!�d��J�)��N϶�u#����A�o���>�����G�*p�Y�c\v2���&L��O&}*��V���p@�;��4��'�!ϴ6�bqq�F���]"y�s&�?� v]�+毭�]~!5�2<'�/�7>"{��|�f�B�0��n?lrc*����������g������)���J�)�c%���@D��.><��B;�����k�B���p�����tV�äʒ�'G�渁Y@����\����� �ă���5P(]Z�I!Z��=�Ľ�f1����F�^'J��>7��%r�c�8�$�3�/�w����UB�<�Ԃ#�-ޭ\ǁ41�+�V��$4��D�|�H��S L*zh�S��I$�W_hlB<�fx_��i���:f��/'S�ͻ���Fc��wT$���;��8#x&b������`��-�rz.y�4�����7%�k�iN�4���4��zEYB�xo���b�#�E���^T cU}H敻\%��!.�Mq���v��G�i`�[t���+��jL��4N؛L��=�d�\nV/�K�R&���~���4DS��dx��LV��N�T�F���7��wNs������+�m����1>���߂h=cr����ܑ���ԑJ���u�VC��!XV�O��ì��BѸM�+�&��������|ۮ����y��Z�^=,sڜ죍0ơ�hv���߬h�91�+a����iKW�s{���憃<����n��na�����!���vf��ۼ N�h�﹎UڑH�BAd��k&�5��r��e�ɇ^.J�� !��s็Y��j�.Ԋ������2n�<6W����L������0%1�LovW-q��z;�acև�����Y��-{������n'��zq��f�̟�ʊ�� P:��M!k�=Uf��'w#Tj��S������<��z���@���i��~��C�b��eV�v#�=�=�2z��=T��3!l��Cv���r� �V�z�X]��09��ڥ�6D]�ZMȲ�S�$�p�E��X88�����t<L\cGd^�~T4_vE�����T����h�7���I�j)��������������y�Q�T�ڎ�"��Z��[0����0��r�C��q�� ��Qܫ��%����G� i /4��"9^M�d`�F�>��%��ۊx�#��S���A��`$��P���')��9��:F�D ���FRR��`����(���e�&��,�h���ф��[̌]�����L0Q�2��3C ���s��!O��ɣ�I�Oj$� �V�q�]��ݿ���ņ�ef�S�vDpVu��˶� ��d9��ִvL��S�-���D0��5��6b��c���dTa �d@3���P��+�Wn`{���Kz^2�=���x"%ޤ�:�T��*����R�Dť�TY�Һq����:��CF�,���ޜ��"b�V�hT,7䣝�D�"F������#�����Vizv� �1�w �0`�?.��*�HLI�F�a�=}az�go����߁��MlU�G��7��Tޠ������`�b� R�j�V�Ѓ����a��9b�m������\�����F |�P��|��m����J�ޟ!��zB�a��T=$��a���^��;m'�+�� �w�%��U)�C����f�ĩA7��GQ����5<���)�)��%^h��j"[rQ�q7��hw���MڍX~�%-���I�pV��j�~����D�s������.�2����V��3��T��_�Ez� �4�+;��S��E1T�:�"29�aG{xW>Z�J(ʕ�!izKV�zH�5\*�����yR��FԵ$%Bp�^vR0 ���~�mP#�J������X<�����I�� �F�N��*c g I��������,^�}2ߎ,�����5�zg ��ꦠ��PH4 ާ�cWj0Ĺ�N�T;P�k)��<�`��Ry�L�H���|��&�~nTE�k�gT(�`0 VNm���h x��|��W���JT|�t;�b^%4)�sG-��~,�Z Cu/��&A���@kql���$����+} / �80�T�O�7/($��މ����lqp��_&�$�Ӂ�kF�"D�'(���|���g՛6?Pp�?�:d��c4M>��k��}s1�1��J�YU�d�%uIZ����˭�L�t.I#���Cy���F'\��M�2�zl���n~�斜sW��Uz�3p��j<V]X�ڠ�g�R�F�K�5�S��9>��4А _��e�?��?� 7���[?�&l��Q�j˙�����jі�*`�l���`��S�A6A}�p���E=�T곃/)��y��H&��ă+�t������h�~,A� xR5a��T���I�]�EK�c�� H�d}Z��C��!6�D֫�w�p4XvĈ-�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ