Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
1635a433281238b10cb0d21ffed0055b_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1635a433281238b10cb0d21ffed0055b_JaffaCakes118.dll
Resource
win10v2004-20240426-en
Target
1635a433281238b10cb0d21ffed0055b_JaffaCakes118
Size
1.1MB
MD5
1635a433281238b10cb0d21ffed0055b
SHA1
036a24f91d872246f8d2ad0281c8014485e8fd3e
SHA256
84f22017f37b08a2bdd739a323f49e999b4d10ff2b66c0d7a122ce2b96771c2b
SHA512
4a2d4890043364d73236dc7ff91cc0f571c94a0d7344da7f703ccd386c9c4739fde5a4b6d2fcf5141dd8a0f3c7e0d874690b604a41224bc640aaee4dc46b6c2c
SSDEEP
24576:f85aVxdXTOncL9vLm9EnZKlVW5ri3vg7f5DsBr29y6n0ig1gcyY:FVnhv69WZKlVWpAg7fS129rnC1gcyY
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource | yara_rule |
---|---|
sample | agile_net |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_CorDllMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ