Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
162dd5fedc022f4b312101de5663f411_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
162dd5fedc022f4b312101de5663f411_JaffaCakes118.dll
Resource
win10v2004-20240226-en
Target
162dd5fedc022f4b312101de5663f411_JaffaCakes118
Size
1.0MB
MD5
162dd5fedc022f4b312101de5663f411
SHA1
041ab5c400b21de3b95d9e6d2f0d30e88a12c74e
SHA256
10d942c3ac86f4061555e81b5971a943679ff0b3606d75276d6d92b18d3a3af2
SHA512
55af24a97062687a5678896d2446d6c313703728140dbcbaf860a028d6987628b300601b989f8243a6f367b08b75a441a98a5d4e37ab84e3a64f8c7181a0ee8f
SSDEEP
24576:K45U2MJPlSBJsPoT21bm1eKbk5/JnNIIJ7uOXCA1hIS/:zqPlSBkqpbkJJn6WaOXFX/
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource | yara_rule |
---|---|
sample | agile_net |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_CorDllMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ