Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
6d4404bc663984984441c8752b95acc1_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
6d4404bc663984984441c8752b95acc1_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
6d4404bc663984984441c8752b95acc1_JaffaCakes118
Size
2.2MB
MD5
6d4404bc663984984441c8752b95acc1
SHA1
70faa345a2f6b6c7c9008a135fca4f1b321ad4de
SHA256
95462d89c2718811c6d59e922f5da20c35c491075d2b6cee51876431e01ba299
SHA512
b029646eda1f363580f7b041fdf68b602395e5fce6ce2554436b4c8edbafc9001509d4277d2fc2a42c4519a99f316159a1e5d2dac1b45702b55dd7ab817fc5b1
SSDEEP
49152:pyrWH6dvSmOM4LFE/E1R42M6lHbwzeoz1+QvoXTx640TvGm5yLz15W6:7KO9FE/EL42M6l7wzeozV5i
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
F:\branches\4.0.2\Rhino\Safe\Bin\Win32\release\pdb\UsbGuard.pdb
GetProcessImageFileNameW
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
OpenProcess
GetModuleFileNameW
CreateFileW
GetLastError
DuplicateHandle
CloseHandle
GetCurrentProcessId
Sleep
DeviceIoControl
InterlockedExchange
GetDriveTypeW
SetThreadExecutionState
GetSystemDirectoryW
LocalAlloc
GetCurrentThreadId
LocalFree
GetModuleHandleW
GetProcAddress
SetFilePointer
WriteFile
GetLocalTime
FreeLibrary
LoadLibraryW
FileTimeToSystemTime
CreateFileMappingW
FileTimeToLocalFileTime
GetEnvironmentVariableW
GetLogicalDriveStringsW
QueryDosDeviceW
HeapAlloc
HeapFree
GetCurrentProcess
GetUserDefaultLangID
GetTickCount
GlobalAlloc
SetFileAttributesW
DeleteFileW
GetWindowsDirectoryW
RemoveDirectoryW
SetCurrentDirectoryW
MoveFileW
GetCurrentDirectoryW
GetTempPathW
EncodePointer
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
GlobalMemoryStatusEx
SetLastError
GetFileSizeEx
WideCharToMultiByte
GetACP
MultiByteToWideChar
SearchPathW
FindFirstFileW
GetLongPathNameW
GetFileAttributesExW
GetShortPathNameW
TryEnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
OutputDebugStringW
GetSystemTimeAsFileTime
WaitForMultipleObjects
WritePrivateProfileStringW
GetPrivateProfileStringW
GlobalFree
FileTimeToDosDateTime
DosDateTimeToFileTime
SystemTimeToFileTime
GetSystemTime
GetProcessHeap
LocalFileTimeToFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
EnterCriticalSection
DeleteCriticalSection
GetDiskFreeSpaceW
GetVolumeInformationW
InterlockedExchangeAdd
FindClose
FindNextFileW
WaitForSingleObject
SetEvent
ResetEvent
CreateEventW
OpenEventW
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
ResumeThread
FindResourceW
LoadResource
GetVersionExW
LockResource
GetSystemInfo
lstrcmpiW
ExpandEnvironmentStringsW
CreateProcessW
GetExitCodeProcess
GetFileAttributesW
lstrlenW
lstrcatW
lstrcpyW
CreateMutexW
OpenMutexW
IsDebuggerPresent
ReleaseMutex
LoadLibraryExW
LoadLibraryA
ReadFile
FormatMessageW
GetFileSize
SetEndOfFile
SetFileTime
GetFileTime
GetFullPathNameW
GetTempFileNameW
MoveFileExW
CreateDirectoryW
CopyFileW
UnregisterClassW
GetWindowRect
GetFocus
AttachThreadInput
SetFocus
GetForegroundWindow
SetWindowPos
GetShellWindow
SetForegroundWindow
GetWindowLongW
ShowWindow
GetWindow
SendMessageW
OpenDesktopW
WindowFromPoint
FindWindowW
ExitWindowsEx
CloseDesktop
GetClassNameW
GetDesktopWindow
SwitchDesktop
FindWindowExW
GetSystemMetrics
IsWindowVisible
GetTopWindow
PostMessageW
GetParent
GetWindowThreadProcessId
IsWindow
SetEntriesInAclW
AllocateAndInitializeSid
SetNamedSecurityInfoW
GetTokenInformation
LookupPrivilegeNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
FreeSid
CoCreateInstance
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_C_str@?$_Yarn@D@std@@QBEPBDXZ
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?fail@ios_base@std@@QBE_NXZ
?good@ios_base@std@@QBE_NXZ
?rdstate@ios_base@std@@QBEHXZ
??Bios_base@std@@QBE_NXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?_Getname@_Locinfo@std@@QBEPBDXZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@HPBD@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?global@locale@std@@SA?AV12@ABV12@@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z
?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z
?uncaught_exception@std@@YA_NXZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xruntime_error@std@@YAXPBD@Z
?_BADOFF@std@@3_JB
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??0_Container_base12@std@@QAE@XZ
??1_Container_base12@std@@QAE@XZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
??0id@locale@std@@QAE@I@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
_Nan
_Inf
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??7ios_base@std@@QBE_NXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?setf@ios_base@std@@QAEHHH@Z
?setf@ios_base@std@@QAEHH@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
isalnum
sscanf
swscanf_s
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
__CppXcptFilter
_amsg_exit
_malloc_crt
_initterm
_initterm_e
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__CxxFrameHandler3
_except_handler4_common
__clean_type_info_names_internal
wcstoul
wcsrchr
sprintf
_wcsicmp
wcsncpy
_localtime64
_mktime64
_splitpath_s
_stricmp
calloc
_vswprintf_c_l
_wtoi
_lock_file
setvbuf
fsetpos
fgetc
fflush
_fseeki64
fgetpos
ungetc
_unlock_file
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
fputc
toupper
tolower
memchr
strchr
strstr
?terminate@@YAXXZ
_beginthreadex
_wcsnicmp
_time64
srand
rand
towupper
_vsnwprintf
wcsstr
towlower
_except1
fclose
fseek
ftell
fwrite
fread
rewind
_wfopen_s
_errno
strtoull
realloc
malloc
atoi
??_V@YAXPAX@Z
free
memcpy_s
??2@YAPAXI@Z
_hypot
??3@YAXPAX@Z
_purecall
memmove
abort
modf
sprintf_s
__iob_func
localeconv
fprintf
_dtest
strpbrk
memcpy
memset
_recalloc
memmove_s
_CxxThrowException
__RTDynamicCast
wcschr
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList
CM_Request_Device_EjectW
CM_Get_DevNode_Status
CM_Get_Parent
SetupDiEnumDeviceInterfaces
SHGetFolderPathW
RCVBusGetModuleCount
RCVBusQueryModule
RCVBusReleaseModule
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ