Extended Key Usages
ExtKeyUsageCodeSigning
Behavioral task
behavioral1
Sample
JaffaCakes118_dce4e4783ab5819869baae8b98812aabe7654ba2ff9d1e033548a52af93e89a5.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_dce4e4783ab5819869baae8b98812aabe7654ba2ff9d1e033548a52af93e89a5.exe
Resource
win10v2004-20241007-en
Target
JaffaCakes118_dce4e4783ab5819869baae8b98812aabe7654ba2ff9d1e033548a52af93e89a5
Size
727.3MB
MD5
881cbc2da4c6467aec519f4909371af8
SHA1
ec9c0f602456802254ac2659cd0b42ef97d32b62
SHA256
dce4e4783ab5819869baae8b98812aabe7654ba2ff9d1e033548a52af93e89a5
SHA512
e1d3221d3663e09b8258a4b3ad77a201e18a7cc880b359edf1dd9a2123ed48c6b4888f27f7f9bad9b2da6328f5211fe709e94195e76288c9255997612415b098
SSDEEP
196608:M+saKEuW2K/olbQ1fYyKl//g8I62RZeD0DESWxb:MtEufKQlU1fYyyg8I62Ro0ZW
raccoon
517bb0d640c1242c3f069aab3d1018d6
http://51.195.166.178/
mozzzzzzzzzzz
resource | yara_rule |
---|---|
sample | family_raccoon_v2 |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetProcAddress
FreeLibrary
lstrcpynA
GetUserDefaultLCID
GetSystemInfo
LocalFree
LoadLibraryW
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
WriteConsoleW
SetStdHandle
IsProcessorFeaturePresent
DecodePointer
GetCommandLineA
RaiseException
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringW
GetStringTypeW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapSize
WriteFile
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
CharUpperBuffW
rK�-D�_�Ց?�'�'m�a�S�����_Zx(�(x��� �c���J����$m��l��L b���^��:/m=��t�V���t������ $O=e�$��c�!�۔�ٔм�/��|�r��wפ�����J���%��5=M�v��8S�K�t���ۮ����V��" �C1�����BcXZG9����t�[� ��3B����ߝ�J�R��t���w�矙Z'u��)����yP��;Bz6�;�FH�5�����Z�y����Sy�.���w��l�����BJ���]Xt��=��� #,L�|���^s�Y�~�8`+,���Xw�4��`��:�����^i8d$���.KQ���Z!��cE��bd��|� Shh�<�f���a}~S����,i �C��-�턙�m�[ni��ן1��$p�ϴ$�G�<�!�0<���{�uY���`R_�ڦ?�F�un�<t�l^�5�؆��z���0,�G�w�����!�=��z�qWw�x�:�lʼn_���t��C��82�og��Sxr�m�Jm�?���Z��#]@�sK�y�Cf,��T-��{�N(��x��|�ep�vNO6����|iO� �J��ML/�f���Uk��9j���n�f�%;�� �� "fb������Ȝ^|�o��HÕ:!�!9O�e�y �}hU��*^�����ҊF�+Q���� Y��x�FlR�$�d�C�`w�d$5ij���ݹ���]0��a�L9|hcPr ��whzYi�>h:$[�����nc�oO���?��3��U��>��R[�YU���t� �z�}l��2s�߰.^����(�I�����SC��5�A;�*t�T�8�<̓\sނCŅ�g #�;%��g��3��W(O�<����@����$��XӋ0I�9��hn�-_V"�w~y{r��h��P���j����qK��Ź�w�x�W�md�Ϝy��B��1�y�_%?���}��k����6�/�8���` v�j|d���X�_6���o����C������LO��%*uW,�nMC���f����?sއ���[|p�؟_|�˄p���T�ֺ9�X&��NE���Q���;���J; [�;���,��z1����?#:��]Y�Fo�r���!�੭���I�:��?N5�5`�l<j����Ҕ���&N��\�B5Ar�#�Ah���DWuLXM��O��}�M��A�2l��A��[�R�o4�W�+Sё�O�ed��[�%ȅ�S��.qeMJ�e�U�~֭�ή=����� �:)��rM�b�݈:r�(��! �0�^^7�x^�HQ.��u2�xVg̾[N�!�xQEL�)�<j��s�/��e r٘�D9F�Iq쇎.�\�<��2{� ��ީI���-�#R��e�l����1HxȐ�t�o�0���gn!E@�<0����l�����M:�XX��N��CŨ��b��m���5Oz�_�yJ���'+�%��8}�����M瑐!���Ɓ�?�1�zf��$�u�>���g 2<���u��a�kp~�C�I��N��<�������l����V��E־��ǎڷ�i�M���[ϴ������Ē�D�PJhǸ�B;��=��)s��G�<�^�U� ������Ǹ�D@@������wF9�A��e�V�$%!b,\��I���s�V�s����J�� ���+���q�o�����I�O�T7�m���D�����ˠkӝN~,�����h���$�c93�t�}""$B����,`�qn�~c�17��X��(��/ǬK� i$<5�qc��M[EO����Ah�J��\��8'r�|_w�7m��P{�3ڽL����M��8��L�4 V�R�V�~��H#0����50��7�Ja��l����>���3�z7V&�6��W��O����D�����P�uۘX :�\�7)J:��Z��4��Ԑ(���č/l�`�<�e��?<�Nb�I��)�d�my�L&�6�#}�C)4A��-�8a`-��� ��_�-�:u>�w ��R��%���7� m5�p�����Ɠ������zD�R�|��{b<5U1D#g^3�5�s��� �� !V�jh)`��cR"��4� "sw��rg1Q[����̪T ���!cG���$@����a���XP�D���lY1���퇩ٙ����Uu(�F�V��P���ꃨ5uǂ�NBƐ槼[c&�D:�؟�jJ3�'<;�̢K����)3KW� L*�S:��sR�nA6�q�+�9����k �]\=�ĈkJ�����^���7��x�S��D����=8�u�O�/�%�K��R���x>�kr����5<��۷b��ҡNk9�)L ���EXQ�Ϩ� �ZՎke��*���2[�� �6G�S�s �vK�S��v�6O��dI J�oKn��O�� ΜU}�F"e#|�Fh�������|�|������+Ue������E�o��t�&�V� '����+��Y6Fi��縲>���8I���B`&�W49�����B䄧B�c߾8/��c,�V��!/U�_�3�����wo���p�K�G�*�6�}h�1~q��n��v����z徯?*�Ye�<(�յ6ށ�G�Zpl].��z�t+��R�)(W�7�y���X�e*�����[p?�M<c#�%"G<�Va��vQ*\�9�V6�2r�奈l���~�77�����?��r-��U�*;�Tmn�!�q5��^����г0�ʾ(J���W��!-VK�����a��0�/�C%��{�i�=ʹm;�K Kabo2��s�Y�~��K{H�4���)�}���o�A�?��(Ծ,kq��袸[j N�J��Y�%B�#���,nw^���b{���n�'��������Q����<s��P��.��r�!�$s���Ҳ�n(��b�b��S�D��] ���Z%H�;�A��.�JO`t����2���{���k،��2��t�M~��i)ꈦ=W#ZlʕdyV�#���q��f�_K!�����:2�DL��lY�.�K�a�;�i����T�U��@�m�OWm�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ