Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
fe5e9fd459eca69963d33cf58bd7e539_JaffaCakes118.exe
Resource
win7-20240220-en
Target
fe5e9fd459eca69963d33cf58bd7e539_JaffaCakes118
Size
789KB
MD5
fe5e9fd459eca69963d33cf58bd7e539
SHA1
82f7adbb23bd4061dd82c2277af2ebdc773d2bb9
SHA256
6eb059da694e908fca6ca31a5bdf29ebb95ada210e666dfa171f9db4b2205b93
SHA512
cfa369e6d9a9585f11b9b4ada795f2e185c578bd8c07a3e03ef555c5c3bbb5895ff830115ebd9c1f24513011fe2aa56bea93b199c4bee2af5f399673a3bf95a8
SSDEEP
12288:LKmPsNe5DuJIU9NqvDhwZ6nw8u4y9fL0brZpZ40M2TNRCVwrMutT1FEg:LKMaXmvs6nw87Qf6rZpSPwC2MI/Eg
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource | yara_rule |
---|---|
sample | agile_net |
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
C:\Users\Administrator\Desktop\0gFQn07yeO85weM.pdb
_CorExeMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ