Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
4d1391704d1d46aa347517f4e4b9bf49_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
4d1391704d1d46aa347517f4e4b9bf49_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Target
4d1391704d1d46aa347517f4e4b9bf49_JaffaCakes118
Size
8.6MB
MD5
4d1391704d1d46aa347517f4e4b9bf49
SHA1
391614e57a54f2c273c87bdea1016714c8f5ae6e
SHA256
f2266544ac79792f4dedd72227e78a3bb042e9ba238c76d528a39a40056e7ca1
SHA512
8dd59f25f51449be81087f7723006a3e2236de1c41a71da611e3ea47dbbca5bffd807f5602de397f4da48a1e7daa16096cf698686811e0b5ab08c0b746f96af0
SSDEEP
98304:xPwbRIKLxV4hWh/CKOQ2VgwYGIeEow3LPmk1jh+3M/oDS+wgCJwSwWS5VvDFzXHk:xIVIa50BEBZtXgHCjabxXCmnJs
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
R:\Jenkins\PokkiJune2019\workspace\build\win32\Pokki\Redist\ServiceHostApp.pdb
SymGetLineFromAddr64
SymFromAddr
SymGetModuleBase64
SymInitialize
MiniDumpWriteDump
SymSetOptions
StackWalk64
SymFunctionTableAccess64
AlphaBlend
GdipClosePathFigures
GdipSetClipRectI
GdipDrawImage
GdipMeasureString
GdipDrawString
GdipFillPath
GdipFillEllipse
GdipFillRectangle
GdipDrawRectangle
GdipDrawLines
GdipDrawLine
GdipSetTextRenderingHint
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipDeleteEffect
GdipSetEffectParameters
GdipCreateEffect
GdipDisposeImage
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromScan0
GdipDrawImageRectI
GdipSaveImageToFile
GdipCreateBitmapFromHBITMAP
GdipSetImageAttributesWrapMode
GdipSetCompositingMode
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipDrawImageRectRectI
GdipCreateBitmapFromHICON
GdipBitmapGetPixel
GdipBitmapSetPixel
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipDeleteBrush
GdipCreatePen1
GdipDeletePen
GdipCreateStringFormat
GdipDeleteStringFormat
GdipCreatePath
GdipDeletePath
GdipFlush
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipCreateSolidFill
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipCloneBrush
GdipAddPathLine
GdipCreateFromHWND
GdipCreateFromHWNDICM
GdipSetCompositingQuality
GdipDrawImageI
GdipGetImageGraphicsContext
GdipGetImagePalette
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipBitmapApplyEffect
GdipCloneImage
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectRect
GdipGraphicsClear
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipCreateFromHDC
GdipSetImageAttributesColorMatrix
GdipDeleteGraphics
GdipDisposeImageAttributes
GdipCreateImageAttributes
GetProcessMemoryInfo
QueryWorkingSet
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
OpenProcess
SetInformationJobObject
GetExitCodeProcess
CreateToolhelp32Snapshot
GetProcessIoCounters
VirtualQueryEx
HeapSetInformation
SetPriorityClass
AllocConsole
AttachConsole
Process32NextW
Process32FirstW
GetProcessHeaps
GetModuleHandleExA
DuplicateHandle
TerminateProcess
GetSystemInfo
ResumeThread
AssignProcessToJobObject
ReadFile
GetStdHandle
SetHandleInformation
CreatePipe
GetProcessTimes
InterlockedIncrement
RtlCaptureStackBackTrace
GetCurrentThread
GetDiskFreeSpaceExW
GlobalMemoryStatusEx
UnregisterWaitEx
RegisterWaitForSingleObject
InterlockedExchange
DeleteTimerQueue
CreateIoCompletionPort
PostQueuedCompletionStatus
TerminateJobObject
InitializeCriticalSection
SignalObjectAndWait
GetProcessHandleCount
VirtualFree
VirtualAllocEx
FreeLibrary
LoadLibraryW
WriteProcessMemory
GetThreadContext
MapViewOfFile
CreateFileMappingW
InterlockedDecrement
QueryPerformanceFrequency
GetFileAttributesW
QueryDosDeviceW
GetLongPathNameW
VirtualFreeEx
CreateJobObjectW
CreateNamedPipeW
SearchPathW
TzSpecificLocalTimeToSystemTime
DebugBreak
ReadProcessMemory
SuspendThread
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleExW
TlsAlloc
TlsSetValue
DeleteTimerQueueTimer
CreateEventW
GetTickCount
SetDllDirectoryW
SetDefaultDllDirectories
GetCommandLineW
SetProcessShutdownParameters
SetUnhandledExceptionFilter
Sleep
GetLastError
OpenEventW
ResetEvent
CreateDirectoryW
CreateFileW
GetSystemPowerStatus
GetSystemTime
SetLastError
GetCurrentProcess
FlushInstructionCache
lstrlenW
GetModuleHandleW
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
RaiseException
FindFirstFileA
GetCurrentThreadId
TlsFree
TlsGetValue
SetThreadPriority
IsDebuggerPresent
InterlockedExchangeAdd
TryEnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
FormatMessageA
OutputDebugStringA
GetLocaleInfoEx
GetLocaleInfoW
FindFirstFileW
WriteFile
SetFilePointer
CreateMutexW
GetModuleFileNameW
CreateProcessW
DeleteFileW
ReleaseMutex
ExpandEnvironmentStringsW
GetCurrentDirectoryW
SystemTimeToFileTime
lstrlenA
LCMapStringA
GetStringTypeExW
GetStringTypeExA
SetEnvironmentVariableA
SetEndOfFile
GetDriveTypeW
IsValidLocale
EnumSystemLocalesA
GetVersionExW
GetNativeSystemInfo
InterlockedCompareExchange
LocalFree
GetVersion
WaitForMultipleObjects
WaitForSingleObject
HeapAlloc
GetProcessHeap
HeapFree
VirtualQuery
MulDiv
GetEnvironmentVariableW
CreateThread
CreateTimerQueue
GetProcessId
VirtualProtectEx
CreateTimerQueueTimer
SetEvent
WaitForSingleObjectEx
GetCurrentProcessId
ProcessIdToSessionId
CloseHandle
CreateEventA
GetSystemDefaultUILanguage
SleepEx
VerifyVersionInfoA
VerSetConditionMask
GetSystemDirectoryA
LoadLibraryA
ExpandEnvironmentStringsA
PeekNamedPipe
GetFileType
MultiByteToWideChar
FlushConsoleInputBuffer
GlobalMemoryStatus
FlushViewOfFile
UnmapViewOfFile
UnlockFileEx
UnlockFile
LockFileEx
LockFile
HeapCompact
HeapValidate
GetVersionExA
GetTempPathA
GetFullPathNameW
GetFileAttributesA
GetDiskFreeSpaceW
GetDiskFreeSpaceA
FormatMessageW
DeleteFileA
WideCharToMultiByte
LocalAlloc
CreateFileMappingA
AreFileApisANSI
SetFileAttributesA
ReadConsoleInputA
SetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
FindNextFileA
GetQueuedCompletionStatus
GetUserDefaultLCID
SetCurrentDirectoryW
CreateFileA
GetFullPathNameA
FatalAppExitA
SetStdHandle
WriteConsoleW
GetTimeZoneInformation
SetHandleCount
CreateDirectoryA
FindClose
FindNextFileW
MoveFileExW
CopyFileW
QueryFullProcessImageNameW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
IsValidCodePage
GetOEMCP
GetACP
SetConsoleCtrlHandler
HeapCreate
GetDateFormatA
GetTimeFormatA
GetCPInfo
LCMapStringW
GetDateFormatW
GetTimeFormatW
ExitThread
FindFirstFileExA
GetDriveTypeA
FileTimeToLocalFileTime
ExitProcess
GetConsoleMode
GetConsoleCP
UnhandledExceptionFilter
GetStartupInfoW
GetCommandLineA
VirtualProtect
RtlUnwind
CreateWaitableTimerA
WaitForMultipleObjectsEx
GetLogicalProcessorInformation
OpenEventA
SetWaitableTimer
ReleaseSemaphore
DecodePointer
EncodePointer
GetStringTypeW
HeapSize
HeapReAlloc
HeapDestroy
InterlockedPopEntrySList
VirtualAlloc
IsProcessorFeaturePresent
InterlockedPushEntrySList
FindResourceA
GetLocaleInfoA
GlobalFree
GetUserGeoID
GetFileSize
GetConsoleDisplayMode
FreeConsole
GetExitCodeThread
TerminateThread
GetThreadPriority
SetThreadLocale
GetThreadLocale
CreateMutexA
GetFileSizeEx
ConnectNamedPipe
WaitNamedPipeW
SetNamedPipeHandleState
GetNamedPipeInfo
FlushFileBuffers
DisconnectNamedPipe
IsWow64Process
VerifyVersionInfoW
GetComputerNameW
GetSystemDirectoryW
GetVolumeInformationW
DosDateTimeToFileTime
CompareStringW
FindFirstFileExW
GetFileInformationByHandle
GetTempPathW
GetTempFileNameW
GetFileAttributesExW
FindResourceW
LoadResource
SizeofResource
LockResource
FreeResource
OutputDebugStringW
LoadLibraryExW
EnumResourceNamesW
GetUserDefaultUILanguage
ord412
ord410
_TrackMouseEvent
ord413
GetPwrCapabilities
SetSuspendState
WTSEnumerateSessionsW
WTSFreeMemory
WTSDisconnectSession
WTSRegisterSessionNotification
WTSQueryUserToken
htonl
gethostname
ioctlsocket
listen
accept
recvfrom
sendto
getaddrinfo
freeaddrinfo
connect
closesocket
getpeername
getsockopt
htons
bind
ntohl
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
socket
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSAStartup
WSACleanup
gethostbyname
getservbyname
shutdown
GetUserNameExW
IdnToUnicode
IdnToAscii
ord35
ord32
ord200
ord30
ord79
ord41
ord46
ord211
ord217
ord26
ord143
ord50
ord33
ord301
ord27
ord60
ord22
ord45
SetTextColor
GetDeviceCaps
DeleteObject
CreateFontIndirectW
GetObjectW
CreateSolidBrush
DeleteDC
BitBlt
SetDIBits
SelectObject
GetDIBits
CreateBitmap
GetTextExtentPoint32W
SetMapMode
GetTextMetricsW
CreateFontW
TextOutW
LPtoDP
GetObjectA
CreateCompatibleDC
CreateCompatibleBitmap
CreateDIBSection
SetBkMode
SetBrushOrgEx
GetStockObject
SetDIBColorTable
CryptDestroyHash
SetEntriesInAclW
GetSecurityInfo
CreateWellKnownSid
CopySid
EqualSid
DuplicateToken
DuplicateTokenEx
CreateRestrictedToken
SetThreadToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo
ConvertStringSidToSidW
GetLengthSid
SetTokenInformation
RevertToSelf
RegDisablePredefinedCache
RegisterTraceGuidsW
TraceEvent
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
GetSidSubAuthorityCount
GetSidSubAuthority
CreateProcessAsUserW
RegNotifyChangeKeyValue
RegEnumValueW
RegQueryInfoKeyW
GetTokenInformation
ConvertSidToStringSidW
GetCurrentHwProfileW
GetUserNameW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumKeyExW
RegSetValueExW
CryptDecrypt
CryptSetHashParam
CryptSignHashA
CryptExportKey
CryptGetUserKey
CryptAcquireContextA
CryptGetProvParam
RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
CryptReleaseContext
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
GetAce
AddAccessAllowedAceEx
AddAce
InitializeAcl
GetAclInformation
OpenThreadToken
RegOpenKeyW
LookupAccountNameW
GetSecurityDescriptorLength
FreeSid
AllocateAndInitializeSid
SetNamedSecurityInfoW
GetNamedSecurityInfoW
RegDeleteTreeW
RegCopyTreeW
RegFlushKey
DeregisterEventSource
ReportEventA
RegisterEventSourceA
CryptEnumProvidersA
CryptDestroyKey
CoCreateGuid
CoSetProxyBlanket
StringFromGUID2
CoInitializeSecurity
OleInitialize
OleUninitialize
CoTaskMemFree
PropVariantClear
CoAllowSetForegroundWindow
CoInitializeEx
CoCreateInstance
CoUninitialize
SysFreeString
SysAllocString
VariantInit
SysAllocStringLen
VariantClear
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SysStringLen
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo
SafeArrayDestroy
VariantCopy
?PluginsUnload@IPokki@@SAXPB_W@Z
?CreateInstance@IPokki@@SAPAV1@PB_W0PAVIPokkiListener@@@Z
?Destroy@IPokki@@SAXPAV1@_N@Z
?SetOSModal@IPokki@@SAX_N@Z
?PluginsRefresh@IPokki@@SAXP6AXXZ@Z
?EnableBrowserPurge@IPokki@@SAX_N@Z
?DoIdleTasks@IPokki@@SAXXZ
?libPokkiStart@@YAHPAXP6AHXZPB_W_N@Z
?RunMessageLoop@IPokki@@SAXXZ
?Pump@IPokki@@SAXXZ
SHRegDuplicateHKey
SHStrDupW
SHDeleteKeyW
PathFileExistsW
AssocQueryStringW
ord176
ord487
StrChrIW
StrRetToBufW
PathGetArgsW
timeBeginPeriod
timeEndPeriod
timeGetTime
ord217
ord173
UuidCreateSequential
UuidToStringW
RpcStringFreeW
WinHttpOpen
WinHttpCloseHandle
WinHttpGetProxyForUrl
ExpandEnvironmentStringsForUserW
CreateEnvironmentBlock
GetUserProfileDirectoryW
DestroyEnvironmentBlock
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
InternetQueryOptionW
DeleteUrlCacheEntryW
HidD_GetHidGuid
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
CertDuplicateCertificateContext
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertOpenStore
CertGetCertificateContextProperty
CertFreeCertificateContext
GetSaveFileNameW
_cJSON_AddArrayToObject@8
_cJSON_AddBoolToObject@12
_cJSON_AddFalseToObject@8
_cJSON_AddItemReferenceToArray@8
_cJSON_AddItemReferenceToObject@12
_cJSON_AddItemToArray@8
_cJSON_AddItemToObject@12
_cJSON_AddItemToObjectCS@12
_cJSON_AddNullToObject@8
_cJSON_AddNumberToObject@16
_cJSON_AddObjectToObject@8
_cJSON_AddRawToObject@12
_cJSON_AddStringToObject@12
_cJSON_AddTrueToObject@8
_cJSON_Compare@12
_cJSON_CreateArray@0
_cJSON_CreateArrayReference@4
_cJSON_CreateBool@4
_cJSON_CreateDoubleArray@8
_cJSON_CreateFalse@0
_cJSON_CreateFloatArray@8
_cJSON_CreateIntArray@8
_cJSON_CreateNull@0
_cJSON_CreateNumber@8
_cJSON_CreateObject@0
_cJSON_CreateObjectReference@4
_cJSON_CreateRaw@4
_cJSON_CreateString@4
_cJSON_CreateStringArray@8
_cJSON_CreateStringReference@4
_cJSON_CreateTrue@0
_cJSON_Delete@4
_cJSON_DeleteItemFromArray@8
_cJSON_DeleteItemFromObject@8
_cJSON_DeleteItemFromObjectCaseSensitive@8
_cJSON_DetachItemFromArray@8
_cJSON_DetachItemFromObject@8
_cJSON_DetachItemFromObjectCaseSensitive@8
_cJSON_DetachItemViaPointer@8
_cJSON_Duplicate@8
_cJSON_GetArrayItem@8
_cJSON_GetArraySize@4
_cJSON_GetErrorPtr@0
_cJSON_GetObjectItem@8
_cJSON_GetObjectItemCaseSensitive@8
_cJSON_GetStringValue@4
_cJSON_HasObjectItem@8
_cJSON_InitHooks@4
_cJSON_InsertItemInArray@12
_cJSON_IsArray@4
_cJSON_IsBool@4
_cJSON_IsFalse@4
_cJSON_IsInvalid@4
_cJSON_IsNull@4
_cJSON_IsNumber@4
_cJSON_IsObject@4
_cJSON_IsRaw@4
_cJSON_IsString@4
_cJSON_IsTrue@4
_cJSON_Minify@4
_cJSON_Parse@4
_cJSON_ParseWithOpts@12
_cJSON_Print@4
_cJSON_PrintBuffered@12
_cJSON_PrintPreallocated@16
_cJSON_PrintUnformatted@4
_cJSON_ReplaceItemInArray@12
_cJSON_ReplaceItemInObject@12
_cJSON_ReplaceItemInObjectCaseSensitive@12
_cJSON_ReplaceItemViaPointer@12
_cJSON_SetNumberHelper@12
_cJSON_Version@0
_cJSON_free@4
_cJSON_malloc@4
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ