Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
2067f3df259b6aac08bf1e755b265edd_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2067f3df259b6aac08bf1e755b265edd_JaffaCakes118.dll
Resource
win10v2004-20240419-en
Target
2067f3df259b6aac08bf1e755b265edd_JaffaCakes118
Size
1.0MB
MD5
2067f3df259b6aac08bf1e755b265edd
SHA1
980a051823ac621f41b68db42aaa98ea4c1dd108
SHA256
9d10f3830527638dc6518cdc2a5adc2d91aea512d507939678b04c312078b25c
SHA512
acb1a497c0efc0cd5a99a6784b10d1b306bb4d30cd5cb1661529d1d76e236e2590962a7e0df917967b9d7194b8f353554e1a150c5d0411059ba37ba86e3880f8
SSDEEP
24576:QxCjV8F383ji1dSUxhXTXPbFbGPEOsQUVRkUIpg:cn3Oji1xXTlcsQUVRKpg
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource | yara_rule |
---|---|
sample | agile_net |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_CorDllMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ