Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
7117de01adc95d547cd669908963b6a3_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7117de01adc95d547cd669908963b6a3_JaffaCakes118.dll
Resource
win10v2004-20240426-en
Target
7117de01adc95d547cd669908963b6a3_JaffaCakes118
Size
264KB
MD5
7117de01adc95d547cd669908963b6a3
SHA1
1b4f015bec2f74fd1958bf9e84a7c466e90e1d3d
SHA256
20ab8acfc4de9498c52fdb8c159862867da68716024ebaae2ae094d4b301263b
SHA512
b8e735804a46bb78efd2421a1cc3166c718ced8d7eb265b7804fc28ab497b9d93703cfe4782fb19527740ddfe69978902aa769200f27a3811b34dcde8e31822b
SSDEEP
3072:+8ZGjlMkPjjIR9hyjrSFVt9UrtKWyI+eNIt8XXDJQ9ZA9C04N5OCTTkqhHE2A4BZ:+8LCCbCSTtCcWyIDNIk9C04O5mHE2VZ
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource | yara_rule |
---|---|
sample | agile_net |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_CorDllMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ