Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageKeyEncipherment
KeyUsageDataEncipherment
Static task
static1
Behavioral task
behavioral1
Sample
msvcr710x64.sys
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
msvcr710x64.sys
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
sqlservr.exe
Resource
win7-20240903-en
Target
JaffaCakes118_fd93b2ad4fe7d789cbd26c84f657e8eea418cc3fc8631ad52b8a197d06387c87
Size
3.7MB
MD5
97c869f246c2828be42d007003ddf77e
SHA1
7963231154c1fd76a38f8f0ea5e965ad04ac12da
SHA256
fd93b2ad4fe7d789cbd26c84f657e8eea418cc3fc8631ad52b8a197d06387c87
SHA512
cae307c832b75a49704428f5285ff95efcdf74c01193920c94716fc21df0f60b328ef47208240263749e45095c36f795794eb8e1753c04d349fdfa87fd985614
SSDEEP
98304:pwxG5NfYebWQJzl6ogplLjy6DtaQZFMQgDGh:pwMvZXClR1MM
Checks for missing Authenticode signature.
resource |
---|
unpack004/sqlservr.exe |
KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageKeyEncipherment
KeyUsageDataEncipherment
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IoCreateDevice
MmMapIoSpace
KeBugCheckEx
IoCreateSymbolicLink
MmUnmapIoSpace
IofCompleteRequest
__C_specific_handler
HalSetBusDataByOffset
HalGetBusDataByOffset
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
ys��_T�s&[����n��z#ؾg�P6��x����� $�p��B����-3ٙ�m\�����C�K �4�%�����:\����^v�U,�b!3ה��I-��\�g����V�b] H�K������$+�45���6F��ɕ/N5Ú�wm����X�Y%T��a;6��&`��6��@�2�I��ˌr��>m���G��?���x.��m�Y-@9��WijX�U�yvj�,���1���7z� ӝ������q��G�������A����%�[dU�A�K������52^ndק8�XO�ᅴMk1�ڏ�U��2C=��t�.���k1~��Gدt=i���_ܖ��`��g���_�`o�"��\ᜁn,vX���Aj��1k-���B��{J]�TdO�JڗHݵ4`lo�Zrao�NO>��,����GKϵ"����ܗW���!e�N�h�m��>u&\����س��[]�?��e6+�;Ku��y^g���w��KW�VW� V�{��m2,>��F���Db�KY!�O;�v 2���K.X۶�q�D���c/�xC�g��2���|s����-��Rݼ���=����ᙩ��FB�dE����u����h�����H�Q261�1�Mg�G�kf�K�xt̻n��k�@��ͣe�Ӵ��C�6xW��^��S2��m��E�x���ă�P�V��:�����,v��?�f�~�>����f��u�F���'�� ��M�G#g��3}�Ts���dKO�6�_�z^.$�.���뎊;D7����[��X<)ׅs,8aZv�.}!��Fc��t}7>�/��~��d�9�8��TX�6ukf��m]���"��`��+z^�۞l�ɠ��I)��Ұ�e�1V%'/iv#��L���&2�b�Z�xe[�R���RG� v�X���S/Y��cR�K�8`�;�|-_\��u��7��S��6�U!��G�� ;@��*����;z}�Q��Tx���`wb2��a�����o���y�-�D����*�ɱ�*Yv7�! |j��xu�������n~ԕ0.�=��mO��J��<�jġ�J����q٫�ɵCTX� ��,Y�|�½WS��!I�#K���s=,�:��~"�.���9h��#Xf�T���\�%�����b��(���Z�� A��)�y�2�#39t�q-CR�\��̧���� �>P��s�{��cN?��H%s'�z�zݡɒ~d��dP��O<0�nZ�oS�j�M{rN ��%�.όw_h���*��F�{��t���ƍ�<�s��^j���s�J��1������צʲ�O���qf�Gj���⢖Q�@��\�ha�� ���P�%0W���{n>��RGE�hU:�ξ�Z���#�1�e���ߢ�����c5��5i��îw�8:�����=N[��~m^���reS��t�I:"��Y:A>*�b�2F�=�@��~�c��ZL��(wI��F��!�&���t�w$�@�m}��s���^5&���֛I�j�q���ə��-&t>&�/a���yPe*��f�)2e�VR��χCLZ��'Ըx��k���z�!�c"�^���zu�e����?:G��s��&�EY�����l �w���ܒ����II֗qd�)����T��}��[ZHΧ��SY%�AО�$����r�q��#Ё��������~lb(GCM��� ��g�U8W1�5�7<Hq�tZgE9��?�_,Ǜ��ڙ��oC!�R!rf�H@`�DbX�3 �w��������Q��-I�x�����B4�����G�J��j�^��ݨ�����A��hy��nn����w�@�����L՞XW�f[�a��q�g*k����R��M1����^�R���<`90�L��: �"�kJ�K[.<�c�}\6eJ�.�����A�[��r^0�����l����)X]F����H����1���:>���kֲ����$<�ߖI����:c�rL�D &� ��.���Q}/n�L@�H��f�v�Jg.�d�r�����x`� ���NE ��H@ή(�Lʰ����M`� !��v��x)���!ED�؛K16OCb��6�8k��A�d@YieG�zێ����������g+%u�J����Wni�6�v���OC��/�h��� �T�[�]~y@�/�9.h $K�\��_��T+Jo�-�g҇���w����,�����ɽ=N.�� y���Yp��0����/�;����In+g�O ^lǨ��d��0��(��^�??���d�!��� ��r�����_��Ki���6R�872��=knX䝣�2�H��;rQ��c]q�Έ6�b��눼M���k��`ZW�0���1}�H��rN84�w�E������͏��� �I� �q=.� L�!�i_�2�;�����n�[�8��<Խ�GW��A�G�����8��$���r:�Qj��V��ܘ��� 4��:���j���=h���]�{�̥X�иv�L9�!*��=�yBx� ���\̾��q����o�'(� ��N����} ���͂�[e��ag䙎y9�-�R\'9u ߥa$S��$�F��V��3���������l��X�����p��N�[ ��m֢��G�����bC��`��~9D���P�� �٠���e�Ec����l�c��L�6-���e�-�P*�������%H���Z�d�Ɔ����$3I,��W�O���D�C�]kG�.(x��4|��Շ���q���w��G��v��XR��c�$ձ��� ��r`��9c�����3d��6�S�>� ���V]0�49b:�*�����E-���= 0��#���Ay�oH�k��>�I�+g{_Iڂ�o��(�|����r��{0 �6��"FU�͔��S5F��T��x�]���$��&� 3�G�P�q~GXGi�G��|,�0���-���f�[��b��x�̓=IS�eLm�5�����'���~r���c#�pm�7��r�5d)~)���� ��c������"1����d(1}2S�-������S��O�~`���y� ��e(�������V�)�¶�*�j�s��p�0��s��fFX<ћ{�ij�lU���>��u���={Ԓ/����̒v!KB�X����o�`��M4�&���ҵ��_��E�q��� -�:�=9I3��i�ZѴa�hB���b����bV�-&P$����!*�|��i �ۘ���ŝ*��E��|��bDօ��Q�.'+�]n �Cω�7������Q ?(���l��d����ӧZDÎW� �H��(��Q���W��i�B��;m��z�f606�bz ���ĭ}�HLJ[_W.ٓ*QDU!�$t 1Y����7����-L�E��Ծ����ﱊ� �a�M'�,~�O��u��Q��f�H�K1���f�`YsJ�쏦b5`�u������.��Ieҭ�x)H�����I�pHa!nmI��[�@�m]O�:nH �����1&�-���������G&R��v��}�m�"1`�'�)Q)W��bV@�`��ok��Qw\�:0qx&K)���bf"U;"X�(C�d����Ȓ=i��(0T��w�T7�j���`��xSWo|�<2�,)U��;P-Xh7�a�.�U���\�dw����H���(^�,VBh���l������;;�H��D��(Q�J�X��8��C�sck'�:�R�Ru6o��q�?��d{ք���|�]�G��n�
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE