Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
164d3eb9295c58aa47f7184482e837c6_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
164d3eb9295c58aa47f7184482e837c6_JaffaCakes118.dll
Resource
win10v2004-20240226-en
Target
164d3eb9295c58aa47f7184482e837c6_JaffaCakes118
Size
1.0MB
MD5
164d3eb9295c58aa47f7184482e837c6
SHA1
8dd418f665e6d0b3d9ad06dc5c0a0291283c9d7d
SHA256
e7d58bf051b2020e2ffab143e64867c1c752f2f53e41b7213187291396a68ff4
SHA512
e480adf4796fe72f4fef227cf450c552189ddfa52a14ea92c0009362b1824845d8d70c9c0683177022d47d920246549e48adea043e5a9c79a76faefac8282de1
SSDEEP
24576:RgDKNwzqg57SKQeNbhq0HgKsOwYGLD0MCg:67qg57Jjq05sO+W
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource | yara_rule |
---|---|
sample | agile_net |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_CorDllMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ