Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
16c9d69251bb1084269d787478d17be0_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
16c9d69251bb1084269d787478d17be0_JaffaCakes118.dll
Resource
win10v2004-20240426-en
Target
16c9d69251bb1084269d787478d17be0_JaffaCakes118
Size
1.1MB
MD5
16c9d69251bb1084269d787478d17be0
SHA1
34ccfe984fb47e0b9ff1574b8632992a5ddc1659
SHA256
065d45fe809eb111fcdeb7ec6ee7a23141ff58e27d2443286d0465dd84467d5b
SHA512
b16f039e2c0caee55e27f7e03a4e9488e35d47e72545b35739a5e954b6a5249fda7ff21a8a423a2eb8d795c9ceb18d466fbd5dcfc76b249dfe603184fb30b363
SSDEEP
24576:C0ucFLJjPM0C1/KDwEo5TCG5ST33w1tJnIHVNlUzNVSXiKu7eTl8JRWyXIK+b0:UCjPM0CMkEm5Sj3w1tJI1DkVEiKu7TRp
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource | yara_rule |
---|---|
sample | agile_net |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_CorDllMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ