Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
38c59a4398c144434f205f0512bee95b_JaffaCakes118.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
38c59a4398c144434f205f0512bee95b_JaffaCakes118.dll
Resource
win10v2004-20240426-en
Target
38c59a4398c144434f205f0512bee95b_JaffaCakes118
Size
874KB
MD5
38c59a4398c144434f205f0512bee95b
SHA1
7ae4f7cb8e11f73c2b4e7e28d8eb4823952e1c0b
SHA256
2156730ca68ad9a3649a1ec077ed37f80e37ede0ec78add6ac6949ed2bc3a4aa
SHA512
64b3d09e81153eb513dabb232cb2d5b817917279a08e8f30b7702e269e094abd9aa0f33f2edbcf29973d5d3d5d79d51d2481dfac3f0f5ebe35a4dfb70380ad47
SSDEEP
12288:R+u4qdn/5Mo1T+J23BK3GWLsYGGnV+sBmzE/+zbVIGqV/BIBKZBQvFOVT6hUu1xy:R+tCdwpGZ1xtcDNshzSSRtB8boNMkRU
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource | yara_rule |
---|---|
sample | agile_net |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_CorDllMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ