Extended Key Usages
ExtKeyUsageCodeSigning
Behavioral task
behavioral1
Sample
2a09209e4e4072ea05bbed0289a41a69_JaffaCakes118.exe
Resource
win7-20240903-en
Target
2a09209e4e4072ea05bbed0289a41a69_JaffaCakes118
Size
415KB
MD5
2a09209e4e4072ea05bbed0289a41a69
SHA1
7ea09e134e3b90da333b0c8c74e6dd29c25f8976
SHA256
7d064b1cb7f1aab0862fe0b1d955756ccf10c8880c0a958bf6bf93b9423bb6ed
SHA512
327f6205b14a6f95fb01d53716e21819b807cbb8984a1df00b2b51b4df140890c7f0e19af267051405cbe47ff0fb2cd1e3cfb7d1ea4925fba116f098166a30f3
SSDEEP
6144:WBQ6Xb2Pjmgz54vU15LFjfuDf0IpmIZQDwYg3hKWbtK5uKtuqEU:WTgjmU50+FjfuAWmcQ3gxj4unql
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IsDebuggerPresent
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
GetWindowRect
MessageBoxA
RegEnumKeyExW
ShellExecuteW
CoInitialize
VariantInit
HTMLayoutGetElementState
GetAdaptersInfo
InternetCloseHandle
��]��?P�v�#A-�O�r-zj�$ت�{JK{K���ђt��q|���0hFZ�����Ui�4�r�R�J�xB�3D�0+����tC�M���7�As�h� �t�-��<� ��vf�f�<��i<�dh�Cl` WCzrT�[��Y��\�]���>i�WG�G=(���\����%�5Z�|^j���.xl���5�_�����guhCN���퍨��Z$7�G�7��k���,��%�2���4oܚ���®h4>�x0��s)ŏ��YvAލDd�1�m�?&*�"�V���m�*:�����&�*�=R/�,��_��_�yV��V�.w6]��eZu?!�,^*CG����hj�C+���K� X�I��6�F�E� G*��y��`��F���,��z�p���w�(ۊ{O]�Z��� ع�Mw����cC-r�w#𱸲=�L�}©���g|=����m�oi��7ej};���ҵ�Q�,nNW�)������������M�;�콿Np����K�U<p�k1�R���-��P6�*w��#FI{�Ы�6��,tǼ���!����Y�F稑 �)=j�ҹb���%��o�a9�X�ĴJc]������;��{6��|��"+�&˩3����N�Rè�p��N��"#,&�m^<��uO���F��쉔y#�Wh��|��Y��l�u(� �f��`����$���Ջ����C4�.�α;�|*F.�W�b�\$�#�I4��~����.C Y71,㬼&��x�)�}�+� h�¶�qË�؟] B �(@%��W�w����Nh�i��W��F�k�n�%3h W��h���p��O�����?����i<��>��4�uՎ%D�3���tH�v=�U�*�T�������*�A�e�'��%���\y���#%0��b��uqש���F9�� Y ���� �&�2���]�h��R#�jP:;9��=�B�2����)ځ7� Y��\�]=��$�⊍��&�a���Z�SY��E�0��b�I��u���@Ƿ�� '2�Ywr�r�ZK`V�ѥ�s!�d5�QC�C����y>��MPi���?&�L�;��Q�{$V�I�c�. ���~iHش�!���&��S��+�>����l�8��y��Fkk���8x��� )������_l�N}�!@�ܢ~�K"i� ��c V�J�Fo$�vTܟ���j�Nv�a�!k�p��`� 7I�$��9;K~3�<�i����{��^��p{��zB�/-��ߓ#�،T��|H �z�?�c�m��^�����*8}ZNU����x��R��+�ڒ�����{�*A5c�ۘc;�_4Z�;W,���[λ^k]���** 0J���F��͐i�J�:� ٿ�,À �bD�9��5$�R����O���'��q�gd�ϡ�'�4�K��9��z��׀�5T�٤5&ũl�Kz�\�H q�W�����"���B���N_=�e��s%IY�o��Gf���{t�n+�*���f:c=�:���`<a���bP~w\w�8�0B=��"z��v�%�7-���pE�"�JF2/�)�s��I�qT���d���C�I(�Z�z�p�ڞ����$d��s��ɞ��A��������Lh��1�yFL�W@��m�WR�#�������n�YY�b;��~s9� ��9�X� � �}̀�K�r�W6�T�&�G:��E����y5��P� ���O'� .On�L8��q��Z���=�x�����G������D:� �.Q]�� �Z!Ț�d$���a�~�k�N�����o��^8����_���5��7�H�(��yB96�)�(�,?!��@��+�b��rQ��Z %�D�w2+�r�\Xٟ_R"�%+k6w��.�5�y����#Fb�����������Qg�zS>ī������D��o��� �=CIk��8��{�����)�J����U� L5잒x*��u�+�7n�M�)Ąd9a�Ѝ�\�棼*UM�^�qď�q�&^�0�ʞ�Sd|�6�{��o�h_�ġB��e��8߉A�7������,�Eh��%iɳ�̈́��3��@�&3��s��7��*��3w�N@�n�����xu�h��'\b��=�����&��8=+i�;1xaǟ��Hm�g�����n�2]�:�¶�R�K��p2m�A]�O 0� ��(#���P,��Rm�4�U��u�u�2%�&�%��l����C7ҧ\�"\���9��DA�S�C��Ub�j�_{I�� �F^'���-��$��p�)8�������1-� �6E�ag{�B2iA���6 ]�:Eb���0b'Tv}enި��������qӡ�W�'���Y.�ށ�gN�`�7\U��'.�2��r���/rK^>���Ca�U%��3��U��M'rD}C�� ��J���Gr�B��q�Ώ�4tM��:}�t��;��d�M�v@�]����O�8�p����t�&Q''nu�lI �n�I��GƾJ�O�ϫ����فݙ�CϽ�CiM��w�_ޭ����6����E��h7t���2Hb�:S#�>����}|�c��`�ř�����l~��~G�t�f`K���E53��ㄻLI&��,��K�G�k�.Ȼ�!����m�#����Av�`Dm0���l˾�y B;~����8�9hh� ��-��Z��y�#�K@(�3ĝg}z{���|������k�js:�E=h�S̷�k�P�U��2�~�0��)T����v��Y���[bnVH����eqy�Һ/^Ѣfosa�T����>/�ytъ�N�DZK^+�I���%=�,@c��UU+����G���c抅2�%�e)h+�JF��V�;'r��L��#�'�B�H�-V�f�Ą����UU������:*�kHLzW���%�L�h�/1C�g" �3H���\3�6�qM�����W�p3qa��H�Lw=��G�d�?�Z'�{G �e��q��3Ԉ��ɮc�� *�=�UC����79L����UWvs|ُ�|���ܷ:E�j=��.��!���M1�d�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE