Extended Key Usages
ExtKeyUsageTimeStamping
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe
Resource
win7-20240903-en
Target
JaffaCakes118_6da5cd2f797bd2f7dbaadba3d332f986bcd7462e844093fc80642e457e2ae161
Size
8.6MB
MD5
2644bcbbd338237d64fffec3bc67ccb9
SHA1
e76746be2a9593643c8a719a14f32dc82bfef8bc
SHA256
6da5cd2f797bd2f7dbaadba3d332f986bcd7462e844093fc80642e457e2ae161
SHA512
5046cdc0cb1fac2c7e68941c8da06f6eb8cc8ebebe8853e8c08df0f310245e6d1b1ca8a6539dc9ea7b8a60d602ea12c8ebdd7c0f70174149f8c339bf46e9b820
SSDEEP
196608:BZd27AWBcN9llETG9uT5oIiyzQ9D+2up/0+xKMoN9hz2QVJg04HrlQF:BZd27x+N9lN90+Iij/axKbBO5Bg
ExtKeyUsageTimeStamping
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
strlen
malloc
memcpy
__argc
__argv
_environ
_XcptFilter
memset
__set_app_type
_controlfp
__getmainargs
exit
Sleep
GetCurrentProcessId
OpenProcess
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
WTSSendMessageW
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
/T�J�RWݝ��w�;Z^�������j5bJ���v���H-#�����+ ��/�o�?��@o�L=��FR0.��DF�� 9�<��-�pD��4BG��1�]���JI�\L���qQ�хq�{T?Z�y�B�i�}��tK��I�� �E� �U��v!�L��b].ڒ!O M���W���Q���^�=� ������k_��5):��5�!�Bur�@x��Ps �!���(l��d��p ��r�Vis�qO{i7|e���W����]v�s���_��� #��*T�Mhy$>D�g:�rd��D~�":��� @/�-[���d�����4���Z-z8�f0D�y~��]�G�!��~�"[� �i/�����{�8Y�;^�Ώ���d�?��l�?�WT�[l<������@��8�Ń��MQm�,*㖽<��]5���ڬBݼ�1u��9OVa/=��+����0�J���%]�!�Ð��iA�����협> �B'��;=�+iV�ҏ�X�mk�r?�=];�Ho�u��8Wz�'h��~x��麕`^3�t��3ýF�k�D~Իo=�M�+����O��_�v�u{�����O3)�-2�m}}�)g��C��ۯ1ܘ�A�F�<������k�<R@�߄&�D�����9�̠ߢ�� a��e��QQʻ3`E�V��*�>�H�i[��xb���pʉ湟;�mdj��c�ܗg&���O��fo����-�U�:Ō����%��{%{y�ibS���!I4�~Z� yA �Z���I�L��l���ӱ����z�]흕�����ۯ�k��<���_�txF�wHġs[~r�����p��G�PҊ.������N����hCfR�D]�hYwF�)�)qG�>}"?�� �G#����W6�M�J�Pql���}���։_����}K�X!_��7���}"G6E֨ ��U&j?��@�\�X�R���w8t?�ێ��$��ӹ�!)8j�鹲|��zg��h�r�Oi�A��u�%�c�lE��;����K�ջAYn^�p����Ōޚ9�s������y���H�Չ��&� �,t�l�ɤaw�*�p�V�G�7�U~-�] 2�F!���JL$!��������5"��*�h�6#u����p�06�S���(W���3�������L�?�s��{��}�-�C� �M(~�h�|S٪O0%�(QF���-w�-Z\�2�PcPz?"�1N����̲ ���_���S����ַ� g�a?�=�ͥ� �-���0<�[���p��k�c^*���aqZ���& ڲ=,�8��3�+�g`6C�c���'�@9%u���O�}/cQp�`�(X� M�b�h���Q�.;������=LA>������D�`��R��%g�t�s������zƘ\�!��x����uC�����B���㽝��m���?[_6���.2;�r<��^���W^"O&.<�C8<d�{wd�f �2�sn���I�K!0+�T��ϼ�#O3+��'�#�~k"���2��7�(ka!�?�'"~Z7��yt�,@���5�~ 4铚�|�<Yϰ�5o#�|�� <���6���ι.<H�)��)h�$��~J��c�L_�~qC��Bz�vjuc��}������Sf�k ���z(�����L�Q��� TW�=StW'��#���wL#%�=թMky:2pJ�����z`��{���H�L(7�I}��&����IzNejO���?��dF�Jo�`GJ�|犋���4w�"�{���7z��1��ҧ�6f����*��k@ z�HDw��Ӑ�<�w����~J�Z�i2Y�m��X6������)��!`���H�8,�����r��N؞������]NFlI���Q ?�W��pA��i�����n�u����*�� �Nb/I �K���r�b��e�P l�`h�c���P�^�Y�����/},���4bO��)l�p�̛�p@N6a/2}+ۖG�M�,�Z�D\T�W� }���Ȝ�.%�~:r��ĭ����׃�t���mfz�|���� ��7�_���"�4���~s�K�(�o��X?�ZHN��{�\��`�y2I����ݴE��/r����z���녂��b��p�Ft 1�5%��q)�/N�6N�vE���Quɼ���>0�SM_'�k�j_�r�!�RFF*/ù-�怵� _϶�1�qJ+�W��Rq�y����g����s%B��z�k����n��23�3����Sg��5v��� ���"jB��^�#s�ç����P��cKX7��ҳN��i��Ц��*)��x�����l��2�伃f��K��u����S�'����H�#h�P��+���u(����Op�ك��3N �������5�r3�`���\������?��?߲�� ���k�Y(g*n��?��8y�`}�P����@[�ڭ��3>C6s�l�� ;˽O��u`�z��e��\�Q���yX�mA^ Qx�-)�bU~a�5i��W�L `���Dc��~�+��E$o�4���o|(�/�������O9P��=����ݢ�9M睜3�t�#%h��A�W_[����|~�!�o���i\��`n ���}�*��/��:T\���t@�=�@P;���岦���ȯ����]:XA\�}���t%xj)ݯ��x��K�,�s�(a�Z���[�Pq�g=:~;�[%�;$b�_bCv��g��c ����z����&,t &�M8)�T�S06ni�S~�g/\sl/ʸ�C\��ͳg��X1 #9���=�������|ɣ�w����r����h�Ӑ�F� �%F���l��cE����j�}*NUVs�� �%���y�`�C�?�C������?8~�V&���r�̭K=Z�����$�|(�0@6!���oNY�F/:����i��)��h��鮘a��9��G���ձ!���0xN�?(���7�˛Uf����Z�@S$��&���ݺKKc�Hu F���a>��Qʔ��dݿ6+��<�8��$9χ��+=Z�|�Aϱe
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ