Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
461a9a6569b08cb4bf1b353939c82a3c_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
461a9a6569b08cb4bf1b353939c82a3c_JaffaCakes118.dll
Resource
win10v2004-20240426-en
Target
461a9a6569b08cb4bf1b353939c82a3c_JaffaCakes118
Size
3.4MB
MD5
461a9a6569b08cb4bf1b353939c82a3c
SHA1
d50a4aad4bb50c3fdc366917f72c958d9f081705
SHA256
90d5b63d588a4b07e67fec76e4867ea9959fa716a55185258ce8a8c77e1d6e55
SHA512
2596e7056984328566fb403497c65e7e8f188bf2053d4aa490199a054981e035b8b44568c95cc19236df1cb206cb5f26e465cacbbe0d31ed2c38f8b901f2a3b8
SSDEEP
49152:WPz0C6Mx4kPKdQxsSr1uJ9m1rLVPIPoD7JtJqd9wUL7tPjTj4nJPtkVZ:Uh6Sr1S9mZLVPIPa3Jqd2UL7twM
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
E:\trunk_code_for_safecenter\Rhino\Safe\Bin\Win32\release\pdb\LeakFixEngine.pdb
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
WaitForMultipleObjects
WaitForSingleObject
SetEvent
OpenEventW
CloseHandle
GetPrivateProfileSectionW
MoveFileExW
CreateMutexW
OpenMutexW
GetCurrentProcessId
SetFilePointer
WriteFile
GetModuleFileNameW
CreateFileW
GetLocalTime
GetCurrentThreadId
GetEnvironmentVariableW
VirtualQuery
GetLogicalDriveStringsW
QueryDosDeviceW
GetUserDefaultLangID
GetProcessHeap
HeapFree
HeapAlloc
ReleaseMutex
GetShortPathNameW
GetFileAttributesExW
GetLongPathNameW
FindFirstFileW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
TryEnterCriticalSection
OpenProcess
GetCurrentProcess
LoadLibraryExW
FreeLibrary
MultiByteToWideChar
GetACP
WideCharToMultiByte
lstrcmpiW
GetSystemInfo
LockResource
GetVersionExW
LoadResource
FindResourceW
GetVolumeInformationW
GetDiskFreeSpaceW
ExpandEnvironmentStringsW
FileTimeToLocalFileTime
LoadLibraryW
GetFileTime
ReadFile
SetFileTime
SetEndOfFile
GetFileSize
LocalFree
GetProcAddress
GetExitCodeProcess
GetModuleHandleW
CreateProcessW
GetDriveTypeW
SearchPathW
InterlockedExchangeAdd
CreateEventW
ResetEvent
Sleep
GlobalFree
FindClose
FindNextFileW
GetTickCount
SwitchToThread
FileTimeToDosDateTime
DosDateTimeToFileTime
SystemTimeToFileTime
GetSystemTime
LocalFileTimeToFileTime
FormatMessageW
GetFullPathNameW
GetTempFileNameW
CreateDirectoryW
GetSystemDirectoryW
CopyFileW
GetFileAttributesW
lstrlenW
GetTempPathW
GetCurrentDirectoryW
MoveFileW
SetCurrentDirectoryW
RemoveDirectoryW
GetWindowsDirectoryW
DeleteFileW
SetFileAttributesW
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
DeviceIoControl
InterlockedExchange
SetLastError
FileTimeToSystemTime
GetSystemDefaultUILanguage
GetLastError
ResumeThread
GlobalMemoryStatusEx
LoadLibraryA
lstrcatW
lstrcpyW
GetFileSizeEx
GetModuleHandleExW
InterlockedDecrement
InterlockedIncrement
LocalAlloc
GetProcessTimes
SetThreadExecutionState
DeleteFileA
AreFileApisANSI
GetTempPathA
GetVersionExA
OutputDebugStringA
GetDiskFreeSpaceA
CreateFileMappingA
LockFileEx
HeapSize
FlushFileBuffers
HeapValidate
HeapCreate
GetFileAttributesA
HeapDestroy
FormatMessageA
UnlockFileEx
OutputDebugStringW
WaitForSingleObjectEx
LockFile
FlushViewOfFile
UnlockFile
InterlockedCompareExchange
HeapCompact
CreateFileA
HeapReAlloc
GetFullPathNameA
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
IsDebuggerPresent
EncodePointer
GlobalAlloc
?setf@ios_base@std@@QAEHHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
??0_Locinfo@std@@QAE@HPBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getname@_Locinfo@std@@QBEPBDXZ
??Bid@locale@std@@QAEIXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bios_base@std@@QBE_NXZ
?rdstate@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
?fail@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
?_C_str@?$_Yarn@D@std@@QBEPBDXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?global@locale@std@@SA?AV12@ABV12@@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z
?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z
?uncaught_exception@std@@YA_NXZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xruntime_error@std@@YAXPBD@Z
?_BADOFF@std@@3_JB
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??0_Container_base12@std@@QAE@XZ
??1_Container_base12@std@@QAE@XZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
??0id@locale@std@@QAE@I@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
?setf@ios_base@std@@QAEHH@Z
__clean_type_info_names_internal
_except_handler4_common
__CxxFrameHandler3
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_initterm_e
_initterm
_except1
_amsg_exit
__CppXcptFilter
??1type_info@@UAE@XZ
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
wcsncpy
wcstoul
_wcsicmp
swscanf_s
_vswprintf_c_l
toupper
tolower
memchr
strchr
_splitpath_s
_stricmp
srand
rand
_wcsnicmp
calloc
?terminate@@YAXXZ
_time64
_localtime64
_mktime64
_lock_file
setvbuf
fsetpos
fgetc
fflush
_fseeki64
fgetpos
strstr
ungetc
_unlock_file
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
fputc
_errno
_beginthreadex
towupper
_vsnwprintf
wcsstr
towlower
wcschr
fclose
fseek
ftell
fwrite
fread
rewind
_wfopen_s
memcpy_s
realloc
wcsrchr
malloc
free
iswdigit
_wtoi
atoi
sscanf
isdigit
swscanf
memmove_s
_recalloc
modf
abort
strpbrk
_dtest
sprintf_s
strcspn
strrchr
_endthreadex
_msize
_localtime64_s
qsort
strncmp
memset
memcpy
isalnum
isspace
??_V@YAXPAX@Z
clock
??2@YAPAXI@Z
_hypot
??3@YAXPAX@Z
_purecall
memmove
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
_CxxThrowException
__RTDynamicCast
sprintf
_malloc_crt
SetForegroundWindow
GetWindowLongW
ShowWindow
IsWindow
SendMessageW
GetParent
OpenDesktopW
WindowFromPoint
FindWindowW
ExitWindowsEx
CloseDesktop
GetClassNameW
GetDesktopWindow
SwitchDesktop
FindWindowExW
GetSystemMetrics
IsWindowVisible
GetWindowThreadProcessId
GetWindow
UnregisterClassW
AdjustTokenPrivileges
FreeSid
AllocateAndInitializeSid
GetTokenInformation
EqualSid
LookupPrivilegeValueW
OpenProcessToken
SHGetFolderPathW
RCVBusGetModuleCount
RCVBusQueryModule
RCVBusReleaseModule
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ