Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
2361c1a4cb711ebf1a801ca53d5ab6f8_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2361c1a4cb711ebf1a801ca53d5ab6f8_JaffaCakes118.dll
Resource
win10v2004-20240426-en
Target
2361c1a4cb711ebf1a801ca53d5ab6f8_JaffaCakes118
Size
675KB
MD5
2361c1a4cb711ebf1a801ca53d5ab6f8
SHA1
5c55161a9bda565e832f0a1b14a9b6c44d04dbd1
SHA256
d48309254e53b06491cddb5a217cbac1f2a53edd5f01a662be1da12b6fc3d29b
SHA512
b3696a61cc01655f7aba14e6b361d6b8b9281f07ea4640ed31f2ea8908e5b2ae569fee5a2198ec6495e35d8465f9f41b568d8160856e731c438ecb2f84b31b0a
SSDEEP
6144:/u2w1dbZtfzKzu5mptyVvJPxShsLK1HRYvmFRmI0JS+baHOAbfccMxwOdj:/uDdvzKK5mptAFkhsG1HR5ccMxwOdj
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
R:\TempView\Output\Plugin\Com.Tencent.Soso\Bin\Soso.pdb
??0CxImage@@QAE@K@Z
?Decode@CxImage@@QAE_NPAVCxFile@@K@Z
?GetHeight@CxImage@@QBEKXZ
?GetWidth@CxImage@@QBEKXZ
?Resample@CxImage@@QAE_NJJHPAV1@@Z
?Encode@CxImage@@QAE_NPAVCxFile@@K@Z
?Destroy@CxImage@@QAE_NXZ
connect
WSAGetLastError
closesocket
select
recv
ioctlsocket
socket
send
inet_addr
?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z
??0CTXStringW@@QAE@ABVCTXBSTR@@@Z
??ICTXBSTR@@QAEPAPA_WXZ
??0CTXBSTR@@QAE@XZ
?LoadStringW@TXStringBundle@@YAPB_WPB_W@Z
??BCTXStringW@@QBEPB_WXZ
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
??0CTXBSTR@@QAE@ABVCTXStringW@@@Z
??H@YA?AVCTXStringW@@ABV0@0@Z
?Format@CTXStringW@@QAAXPB_WZZ
??4CTXStringW@@QAEAAV0@PB_W@Z
??0CTXStringW@@QAE@PB_W@Z
?IsEmpty@CTXStringW@@QBE_NXZ
?Trim@CTXStringW@@QAEAAV1@XZ
??1CFmtString@@QAE@XZ
?PropertyDWord@CFmtString@@QAEHPB_WK0@Z
?DoFormat@CFmtString@@QAEPB_WPB_W@Z
??0CFmtString@@QAE@XZ
?PropertyStr@CFmtString@@QAEHPB_W0@Z
??0CTXStringW@@QAE@ABV0@@Z
??8@YA_NPB_WABVCTXBSTR@@@Z
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z
??0CTXBSTR@@QAE@ABV0@@Z
??8@YA_NPB_WABVCTXStringW@@@Z
?SetInterval@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
??9CTXBSTR@@QBE_NPB_W@Z
?GBKToUnicode@Convert@Util@@YA_NAAVCTXStringW@@PBDH@Z
??ACTXStringA@@QBEDH@Z
?GetLength@CTXStringA@@QBEHXZ
??1CTXStringA@@QAE@XZ
??0CTXStringA@@QAE@ABV0@@Z
??0CTXStringA@@QAE@UtagGBK@@PB_WH@Z
??0CTXStringA@@QAE@UtagUTF8@@PB_WH@Z
??H@YA?AVCTXStringW@@PB_WABV0@@Z
??4CTXBSTR@@QAEAAV0@PB_W@Z
?GuidToString@Com@Util@@YAJABU_GUID@@PAPA_WH@Z
??4CTXStringW@@QAEAAV0@ABVCTXBSTR@@@Z
?CombineQNC@FS@@YA?AVCTXStringW@@PB_W0@Z
?ConvertToPureFile@FS@@YA?AVCTXStringW@@PB_W@Z
??4CTXStringW@@QAEAAV0@PA_W@Z
?IsEmpty@CTXBSTR@@QAEHXZ
?Copy@CTXBSTR@@QBEPA_WXZ
?GetNumber@NLS@@YAHAAVCTXStringW@@K@Z
ord34
?CreateTXBuffer@Data@Util@@YAHPAPAUITXBuffer@@@Z
??4CTXBSTR@@QAEAAV0@ABV0@@Z
ord26
?MoveDownloadFile@CTXHttpDownload@@QAEHPB_WH@Z
?GetFileName@FS@Util@@YA?AVCTXStringW@@ABV3@@Z
?GetDownloadedFilePath@CTXHttpDownload@@QAEHAAVCTXStringW@@@Z
?Format@CTXStringA@@QAAXPBDZZ
??0CTXStringA@@QAE@XZ
??M@YA_NABVCTXStringA@@0@Z
??1CTXHttpDownloadSink@@UAE@XZ
??1CTXHttpDownload@@UAE@XZ
?Download@CTXHttpDownload@@QAEHPB_WPAU_SYSTEMTIME@@0H@Z
?CancelDownload@CTXHttpDownload@@QAEXXZ
?DecodeUrl@Encode@Util@@YA?AVCTXStringW@@ABV3@_N@Z
?Find@CTXStringW@@QBEHPB_WH@Z
?EncodeUrl@Encode@Util@@YA?AVCTXStringW@@ABV3@_N1@Z
?Length@CTXBSTR@@QBEIXZ
?SetUIInterface@CTXHttpDownload@@QAEXPAVCTXHttpDownloadSink@@@Z
??0CTXHttpDownload@@QAE@XZ
??0CTXHttpDownloadSink@@IAE@XZ
??YCTXStringW@@QAEAAV0@ABV0@@Z
?GetFileHash@FS@Util@@YAHPB_WAAVCTXBuffer@@AAK@Z
??8CTXBSTR@@QBE_NPB_W@Z
?TrimRight@CTXStringW@@QAEAAV1@XZ
??8@YA_NABVCTXStringW@@0@Z
?Detach@CTXBSTR@@QAEPA_WXZ
?OnError@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@K@Z
?Empty@CTXStringW@@QAEXXZ
?Mid@CTXStringW@@QBE?AV1@H@Z
?Left@CTXStringW@@QBE?AV1@H@Z
??M@YA_NABVCTXStringW@@0@Z
??9@YA_NABVCTXStringW@@0@Z
??0CTXStringW@@QAE@_WH@Z
??ACTXStringW@@QBE_WH@Z
?CreateTXArray@Data@Util@@YAHPAPAUITXArray@@@Z
?DownloadToBuffer@CTXHttpDownload@@QAEHPB_WPAU_SYSTEMTIME@@@Z
??0CTXStringW@@QAE@UtagGBK@@PBDH@Z
??0CTXStringW@@QAE@PA_W@Z
??0CTXStringA@@QAE@PBDH@Z
?GetDownloadedBuffer@CTXHttpDownload@@QAEHPAPAEPAK@Z
ord33
??0CTXStringW@@QAE@UtagUTF8@@PBDH@Z
?CreateFileW@FS@@YAHPB_WKPAPAUITXFile@@@Z
?IsFileExist@FS@@YAHPB_W@Z
?AllocSysString@CTXStringW@@QBEPA_WXZ
?Find@CTXStringW@@QBEH_WH@Z
?MakeLower@CTXStringW@@QAEAAV1@XZ
??YCTXStringA@@QAEAAV0@ABV0@@Z
??4CTXStringA@@QAEAAV0@PBD@Z
ord30
?TrimRight@CTXStringA@@QAEAAV1@XZ
?TrimLeft@CTXStringA@@QAEAAV1@XZ
?Left@CTXStringA@@QBE?AV1@H@Z
?Find@CTXStringA@@QBEHDH@Z
?Find@CTXStringA@@QBEHPBDH@Z
??0CTXStringA@@QAE@PBD@Z
??4CTXStringA@@QAEAAV0@ABV0@@Z
?Mid@CTXStringA@@QBE?AV1@H@Z
?Empty@CTXStringA@@QAEXXZ
?GetBuffer@CTXStringA@@QAEPADXZ
??0CTXStringA@@QAE@UtagEN@@PB_WH@Z
?Resolve@HostResolve@Util@@YAJPA_WPAUITXHostResolverSink@@PAK@Z
?CancelResolve@HostResolve@Util@@YAJK@Z
?StopThread@CTXThreadModel@@QAEXK@Z
?GetHostByName@HostResolve@Util@@YAJPA_WPAPA_W@Z
?Right@CTXStringW@@QBE?AV1@H@Z
??1CTXThreadModel@@MAE@XZ
?SetAsyncCallback@TXTimer@@YAHP6GXPAX@Z0@Z
?StartThread@CTXThreadModel@@QAEHXZ
??0CTXThreadModel@@IAE@XZ
??YCTXStringW@@QAEAAV0@_W@Z
?Remove@CTXStringW@@QAEH_W@Z
??0CTXStringW@@QAE@UtagEN@@PBDH@Z
??YCTXStringW@@QAEAAV0@PB_W@Z
??YCTXStringW@@QAEAAV0@ABVCTXBSTR@@@Z
?CreateTypedExtensionAgentMatch@Extension@Util@@YAXHPAPAUITXExtensionAgentMatch@@@Z
?ReleaseBuffer@CTXStringW@@QAEXH@Z
?GetBuffer@CTXStringW@@QAEPA_WH@Z
?Delete@CTXStringW@@QAEHHH@Z
?TrimLeft@CTXStringW@@QAEAAV1@XZ
?Replace@CTXStringW@@QAEHPB_W0@Z
??4CTXBSTR@@QAEAAV0@ABVCTXStringW@@@Z
ord25
??8@YA_NABVCTXStringW@@PB_W@Z
??0CTXBSTR@@QAE@ABU_GUID@@@Z
?CompareNoCase@CTXStringW@@QBEHPB_W@Z
?SetTimeout@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?IsFileSystemFile@FS@@YAHPB_W@Z
?EncodeHash@Encode@Util@@YA?AVCTXStringW@@ABVCTXBuffer@@@Z
?SetCustomData@CTXHttpDownload@@QAEHPAUIUnknown@@@Z
?IsRunning@CTXHttpDownload@@QAEHXZ
??9@YA_NABVCTXStringW@@PB_W@Z
?LoadTinyXmlByContent@FS@Util@@YAHPA_WPAPAVTiXmlDocument@@H@Z
?TrimLeft@CTXStringW@@QAEAAV1@PB_W@Z
?CopyFileW@FS@@YAHPB_W0H@Z
?DeleteFileW@FS@@YAHPB_W@Z
??9CTXBSTR@@QBE_NABV0@@Z
?GetCustomData@CTXHttpDownload@@QAEHPAPAUIUnknown@@@Z
??1CUnZipFile@@QAE@XZ
?UnZipFile@CUnZipFile@@QAE_NABVCTXStringW@@0@Z
??0CUnZipFile@@QAE@XZ
?GetParentDir@FS@Util@@YA?AVCTXStringW@@V3@@Z
?MoveFileW@FS@@YAHPB_W0H@Z
?GetAsSystemTime@CTXTime@@QBE_NAAU_SYSTEMTIME@@@Z
??0CTXTime@@QAE@_J@Z
?Encode16@Encode@Util@@YA?AVCTXStringW@@PBXI@Z
?GetTime@CTXTime@@QBE_JXZ
??0CTXTime@@QAE@ABU_SYSTEMTIME@@H@Z
?UnicodeToGBK@Convert@Util@@YA_NAAVCTXStringA@@PB_WH@Z
?ConvertXMLStrToTXData@Convert@Util@@YAHPA_WPAPA_WPAUITXData@@0@Z
?GetBuffer@CTXStringA@@QAEPADH@Z
?GetLoginServerTime@Time@Util@@YAKXZ
?OnRedirected@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@PB_W@Z
?OnProgress@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@KK@Z
?OnDownloadStart@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@KK@Z
?OnConnected@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@@Z
?OnConnecting@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@PB_W@Z
?ReverseFind@CTXStringW@@QBEH_W@Z
?GetLength@CTXStringW@@QBEHXZ
?Mid@CTXStringW@@QBE?AV1@HH@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
?CreateTXData@Data@Util@@YAHPAPAUITXData@@@Z
?ConvertTXDataStringBundle@Convert@Util@@YAHPAUITXData@@@Z
??0CTXStringW@@QAE@XZ
??BCTXBSTR@@QBEPA_WXZ
?GetTXDataStr@Data@Util@@YAHPAUITXDataRead@@PB_WAAVCTXStringW@@@Z
??1CTXBSTR@@QAE@XZ
?GetBSTR@CTXStringW@@QBEPA_WXZ
??1CTXStringW@@QAE@XZ
??BCTXStringA@@QBEPBDXZ
??0CTXBSTR@@QAE@PB_W@Z
??YCTXBSTR@@QAEAAV0@ABV0@@Z
?RawCreateGFElementByXtml@GF@Util@@YAJPA_WPAPAUIGFElement@@PAU3@0H@Z
?GetAnchorResult@CGFAnchor@@QAE?AVCRect@@PAVVCalcSizeSupporter@@PAUtagSIZE@@@Z
?AddAnchor@CGFAnchor@@QAEXEEVCRect@@VCPoint@@@Z
??0CGFAnchor@@QAE@XZ
?AdviseWebBrowser@IEEvent@Util@@YAHPAUIWebBrowser2@@PAUITXWebBrowserEvents@@PAPAUIUnknown@@AAK@Z
?Get@Metadata@Util@@YAJPAUITXData@@PA_WPAK@Z
?UnadviseWebBrowser@IEEvent@Util@@YAHPAUIWebBrowser2@@K@Z
?TopFrameFromPoint@GF@Util@@YAJPAUIGFFrame@@PBUtagPOINT@@PAPAU3@@Z
?CreateObject@GF@Util@@YAJABU_GUID@@0PAPAX@Z
?RegisterCodec@DataReport@Util@@YAJKKPAUITXDataReportCodecExt@@@Z
??1CTXDataReportCodecBase@@UAE@XZ
??0CTXDataReportCodecBase@@QAE@XZ
?CodecTLV@CTXDataReportCodecBase@@UAGJKPAUITXData@@PAPAUITXBuffer@@@Z
?CodeWord@CTXDataReportCodecBase@@IAEXEPB_W@Z
?GetSelfUin@Contact@Util@@YAKXZ
?OpenUrlInIM@URL@Util@@YAXABVCTXStringW@@W4URLMODIFYLEVEL@12@0@Z
?GetSignFmt@URL@Util@@YAXAAVCFmtString@@@Z
?Get32ByteValueAddedSign@Misc@Util@@YA?AVCTXStringW@@XZ
?GetMsgTime@Msg@Util@@YA_JPAUITXMsgPack@@@Z
?OpenUrlInIM@URL@Util@@YAXABVCTXStringW@@@Z
?CreateMsgPack@Msg@Util@@YAHPAPAUITXMsgPack@@@Z
?IsServerControlBitOn@Misc@Util@@YAHK@Z
?GetMinorVer@Version@@YAEXZ
?IncHelper@DataReport@Util@@YAJKPB_WK@Z
?GetNickname@Contact@Util@@YA?AVCTXStringW@@K@Z
?GetIMVersion@Contact@Util@@YAGK@Z
?GetGroupName@Group@Util@@YA?AVCTXStringW@@K@Z
?GetMajorVer@Version@@YAEXZ
?GetEditSelTextInChatFrame@ChatSession@Util@@YA?AVCTXStringW@@KH@Z
?ChatFrameEvent@ChatSession@Util@@YAHKW4CFChatType@ChatFrame@@W4CFEventType@4@PAUITXData@@@Z
?IsChatSessionOpen@ChatSession@Util@@YAHKH@Z
?SoSoPicUtil@ChatSession@Util@@YAHKHPAUITXData@@@Z
?GetChatSessionMainWnd@ChatSession@Util@@YAHKHPAPAUIGFFrame@@@Z
?GetIDAndTypeInFromChatWnd@ChatSession@Util@@YAJPAUIGFFrame@@AAKAAH@Z
?CodeServerData_BoolValue@API@AdvConfig@@YAHGHPAPAUITXData@@@Z
?DecodeServerData_BoolValue@API@AdvConfig@@YAHGPAUITXData@@PAH@Z
?GetChatSessionViewFrame@ChatSession@Util@@YAHKHPAPAUIGFFrame@@@Z
?QueryTXChatSession@ChatSession@Util@@YAHKHPAPAUIAFChatSession@@@Z
?GetGFFrameFromHWND@Misc@Util@@YAHPAUHWND__@@PAPAUIGFFrame@@@Z
?SendMsg@ChatSession@Util@@YAXKHPAUITXMsgPack@@K@Z
?GetShowSelTextInChatFrame@ChatSession@Util@@YA?AVCTXStringW@@KH@Z
?MakeCfgData@ChatFrameExtMatch@@YAXIPBW4CFExtEvent@ChatFrame@@HPAPAUITXData@@@Z
?GetCodeByUin@Group@Util@@YAKK@Z
?MessageBoxExW@Misc@Util@@YAHPAUIGFFrame@@PA_W1IPAUITXData@@PAPAU4@@Z
?IsEnableYaHei@Misc@Util@@YAHXZ
?IsTencentUrl@URL@Util@@YAHVCTXStringW@@@Z
?GetText@TiXmlElement@@QBEPBDXZ
?FirstChild@TiXmlNode@@QAEPAV1@PBD@Z
?Value@TiXmlNode@@QBEPBDXZ
?RootElement@TiXmlDocument@@QAEPAVTiXmlElement@@XZ
?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@PBD@Z
GetProcessHeap
HeapSize
HeapReAlloc
FindFirstFileW
Sleep
FindNextFileW
FindClose
GlobalSize
WideCharToMultiByte
MultiByteToWideChar
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentProcessId
GetSystemTimeAsFileTime
DeleteFileW
GetACP
InterlockedExchange
GetVersionExA
GetLocaleInfoA
HeapDestroy
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
SetThreadLocale
GetThreadLocale
RaiseException
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetLastError
lstrlenW
lstrcmpiW
GetModuleHandleW
GetModuleFileNameW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GlobalFree
GlobalUnlock
lstrcpynW
GlobalLock
GlobalAlloc
CharNextW
UnregisterClassA
CallNextHookEx
SetWindowsHookExW
UnhookWindowsHookEx
PtInRect
GetCursorPos
GetActiveWindow
TranslateMessage
DispatchMessageW
GetMessageW
PostQuitMessage
WindowFromPoint
PostMessageW
SetCursor
GetParent
IsWindow
CreateWindowExW
SendMessageW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
CopyRect
SetRect
GetDesktopWindow
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW
SHGetFileInfoW
StringFromCLSID
CoCreateGuid
ReleaseStgMedium
CoTaskMemFree
CoCreateInstance
SafeArrayGetElement
VariantClear
SysFreeString
SysStringLen
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetDim
SysAllocString
VariantCopy
VariantInit
ord58
ord32
ord31
ord30
ord61
ord64
ord22
ord18
ord15
ord23
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
_encode_pointer
__dllonexit
_unlock
_except_handler4_common
strcmp
strncpy
fopen
fseek
ftell
fread
fclose
strlen
labs
memcpy
_byteswap_ushort
_time64
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_lock
memcmp
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_purecall
??2@YAPAXI@Z
memmove_s
??_V@YAXPAX@Z
__CxxFrameHandler3
wcslen
wcsncpy_s
wcscpy_s
free
malloc
memcpy_s
_recalloc
memset
_CxxThrowException
??3@YAXPAX@Z
_onexit
_decode_pointer
?terminate@@YAXXZ
_invalid_parameter_noinfo
_malloc_crt
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__clean_type_info_names_internal
GetUrlCacheEntryInfoW
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ