Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
c3375b8045b3f2270eeb142f597ad104_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
c3375b8045b3f2270eeb142f597ad104_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Target
c3375b8045b3f2270eeb142f597ad104_JaffaCakes118
Size
7.4MB
MD5
c3375b8045b3f2270eeb142f597ad104
SHA1
889752eb7caa5594487eb57e80b066402ee35ff4
SHA256
7c661d72d4d758842c49d3e40aae3d460130bbfebfcaf42cb16c34efb20ff356
SHA512
1f0812548384bf6914d583858c8b54cc25fa9ddaa1f29cf11798808e6c594a7d85f130c88899c498ec18f299423c104a6068434718e420ca05bd562580b4e590
SSDEEP
98304:gEKzRx2TN654sl4qG3X3z6eG7Eg3Z+m+Du02OhjOpVRpZo9ePRANJXlirI:gg654slQa3gDuQjkp4hsI
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
RaiseException
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
OleInitialize
SafeArrayCreate
WTSSendMessageW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
��7?Xh�AG�+"�N� ���B71�E��d�q���ik|���|E��)jX `0����Z:�M��������"��=��;�f�,ꓝ�m/�#p3(�@ظ'�odb������5���8�`^�[��5-H���Z���6>S��}�:�~x~���*���܁:.�����w��9��Pm�u ����1"A*�I�d)�)��*�);u*'|�����}ښÀ�����b�k_D���w�< G����B���Q��>�4ԅ���Z"6*�����N.ҽ�2F�ߒV������M7�-G-����[O5�]|q����¯SDZ����N`��a���`&,�, |n�8+����r��px���L ]�6�'�,��� ��(F_<_ |��T�"к�fLc��û�>�Te��5�|��+eِ��C�&���zӈ0��wSk��3�}�Y�ݲ��' zJ��j��d�@w ?)�����5-YX(�o�a��й�棈� �^��#��+�X3k��R��*��x�'�T9�\���U,��*�22$��l �6H:���}n)9��I�+{�l^r�QGbo�-LJ���I�g5m�~@8Xp���2 �U@!����R��+~�z�x�p!��FtSG���K�P[���������!�h�v��j��R�\m���UYP7� V��*h���{�8x,���i�-�_��'���"XR.�Z�T���'w��R[�,�@�P&�����T�=h��E�k���<�#��� 4!�b�*��Ɗ#f�� RAϤ�|�~M���%��i�Y8a�_IUh;����cϗ1 pYG;���<���P$j�)��;��Y5��� �����6�,�����[��Rݘ�!-m��i�p����=��\eǼ�$jG�'���p2�yꫦ;je0�����:�8����E�FL�?�{dB*�(56D����G}_��bq��K�f���n�wFO}�%��Hm�݈���d}�Ѓ>E9c*���gs�t1A{1��rD�=CcR��j(c{��@�M�U�r*Յ���U�B��l���5֕��Q����s(��^� �E$�dsh�^��A�Q�wuF }�f�|]�#����`2��Vo�i}*x g�3��~�H�5�7䇉�k�dx����wH[�� v���`�|���]��4�:�-�p�p��?^5ɏ�:|��&�x�����g ?��1#˻8n��섭el��)���&ZR������|%�b/d�b$U����%�`�I;D�kw%��1E��b4�1u�� �<hE8y ��i�L�.��=c�"#_�r������fG� V��w�Y���9�<�K�>Ǜu��7�}�&���iM��L#���wH��N}kK�����+���e1w,��&H�>=��*/�K�� I=��c�%�q�H7��FRa)SA��J`u-7�cΩG�j��<p�>�]O480�ǔ�"�����f�Zx�~u�L뮅>��3�3�=�JcTs����� (ؘ�}���z�w�#���1e���4���[6#��Hiȿ���9n����1�]��0g���fk:"U��Za�i��� �I ���I���h������,N����5Dd��0y�j�H6�� �#up)����Pd��K��}�vO.w���m5����Aӡ*�LMs���� mf�I�?#2�"��� Y�� $��e�P��8Vg���8r�eN�v�Ŝ�Fq�5��=��1 �h�Sq�n�� ���8��/�g� �V�P� }կW��, *3���K����u��*1X:�V��̈́./���O�B�+%��$�\�k]���J�gi�E�,�<�;;�Qyn�S�P�A���Q��4���e �H'b�U���=+7S��?�'KPU�� �<�!��~�xh��_�kE�pE��ڰt)߶��G���C�,�^Ӗ� Z���Ά��G���c�;���JǞ���9#��� b�e�te��Yv��,+���f{xDp�]�XԂ>�i��fT||��?~��_���)w���N�b����%u�6���-�R�bY����p�ҽU����lE$q#�V�ۋ�:*��D�蠃 l�#2�9�5��@W��u����Bߣd�X�ʇ�ˢ3�+m^��m0�6>[H��dL ���Bɶ��O�h��k~]@��2-��V�A2�[��'E�*�?��1�h$����Л�JU�/���M�6f��1Z6S � <����0��ݭ�|gcB�2*}��Un���J��ԅ��r/����nZ�p�#�1�N�wl�ڱ��e?��gCrC����d%�� *"��h���损hq��b�M�QGm������9G��;�S�[~ yZc���yMB�����wt_�p�����ܲdS\�|&&6g2���i$-7�1���u��B��w �[��˨v���Yӕ��v1o�7@.���0��#οJ�T��>��� �w>H}ز�+���I/͛������y��'��O5�sۮ���џ�xZ��l v�1��Vi�3��y���5p�Q6:���4v=�*1;a�����A���k�h�I -V����<#���ܐ[^��Pfb�����R�9��J�Gz�����7֓�JF���߂21��̞�$�Dt���{}"_�h��W� "6g�� ɽ�1}��:i�Qd�@��Ԩ�s�'|CY_1�1���E%����)@�w��m��%���G�.�4�-��ѻ3��u��`�Y��n���FN a����Z�́�@2R��Q[W�`Grj_��`ky%2�Ќ��K�0�W�AX���� /m�䅊pM�T��9�pW�����YL<(�gl�Y'/��c��Ϋ��C1L����0�3~I3i<�d���S `�ߌ�r���_��������8Q�.�i�7����7��fω���<��ܟ�]k!%��Z�JW�u��`�z�I���\+�[��8�����$Yy 6��Ji�@s�w���J������.�7p?i]��6C�>o{��)���1%��v��G�1j�,'�d'*.[67J˩��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ