Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
179f8339027039863bb21cbf05cb03f2_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
179f8339027039863bb21cbf05cb03f2_JaffaCakes118.dll
Resource
win10v2004-20240226-en
Target
179f8339027039863bb21cbf05cb03f2_JaffaCakes118
Size
1.1MB
MD5
179f8339027039863bb21cbf05cb03f2
SHA1
183e32a22c21743b0b4dde9d186450a53cacc2d0
SHA256
10b7655d26c3a7fc23ea6179c7853f1ce073511a9785a3dc54670daff521291d
SHA512
0141796b8f06ba7a8ecfaaac63b6d7c2a567e50d0ee99ac7f8a242093b31c74e17c9150efe800ed2ab015dbb23ab8fed8b5b08331829788dbbeb4bd275b3d33c
SSDEEP
24576:x5ZIU3ZZYvxM5n0gF97oIlYIJxrzkpakUwguJjf6:FIMegfF9ze65zkAkUI6
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource | yara_rule |
---|---|
sample | agile_net |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_CorDllMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ