Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
b44409f4c122ada7dde26034f29f1983_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b44409f4c122ada7dde26034f29f1983_JaffaCakes118.dll
Resource
win10v2004-20240611-en
Target
b44409f4c122ada7dde26034f29f1983_JaffaCakes118
Size
383KB
MD5
b44409f4c122ada7dde26034f29f1983
SHA1
829d89620fdab4ce41bf7a357d1a083481f93dc0
SHA256
bdce7a58d57dd3db2aabefbe5416f36b6b9912d4c4c64759ea35af086ff157e6
SHA512
d93d290bb76199f7f8623cd611d9af643d9edeef73b74607c825d3b349de7e3bc367d22c724d5ae09b6ac8c5705fbec76ff8248282e7c74922b5ff926bbf2434
SSDEEP
6144:6BvGvMM7Oi7cuFQF6/MyT6QEzU56NgLgohbVyGTmMSZvAXDdU:6BvGvMGOGJCsT6QgaLBivAdU
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
C:\Users\vagrant\src\client-win-deps\pywin32\build\lib.win32-2.7\win32comext\shell\shell.pdb
ShellExecuteExA
SHGetFileInfoA
ord28
SHGetPathFromIDListA
SHFreeNameMappings
SHGetSpecialFolderLocation
SHBrowseForFolderA
SHGetDesktopFolder
SHChangeNotify
SHAddToRecentDocs
SHFileOperationA
DragQueryPoint
SHGetPathFromIDListW
DragQueryFileW
SHGetInstanceExplorer
ord191
DragQueryFileA
VariantInit
SysFreeString
VariantClear
CoTaskMemFree
CoTaskMemAlloc
PropVariantClear
??0PyComEnumProviderTypeObject@@QAE@PBDPAVPyComTypeObject@@HPAUPyMethodDef@@P6APAVPyIUnknown@@PAUIUnknown@@@Z0@Z
?Unwrap@PyGatewayBase@@UAGJPAPAU_object@@@Z
?InvokeViaPolicy@PyGatewayBase@@MAAJPBDPAPAU_object@@0ZZ
?InvokeEx@PyGatewayBase@@UAGJJKGPAUtagDISPPARAMS@@PAUtagVARIANT@@PAUtagEXCEPINFO@@PAUIServiceProvider@@@Z
?Invoke@PyGatewayBase@@UAGJJABU_GUID@@KGPAUtagDISPPARAMS@@PAUtagVARIANT@@PAUtagEXCEPINFO@@PAI@Z
?InterfaceSupportsErrorInfo@PyGatewayBase@@UAGJABU_GUID@@@Z
?GetTypeInfoCount@PyGatewayBase@@UAGJPAI@Z
?GetTypeInfo@PyGatewayBase@@UAGJIKPAPAUITypeInfo@@@Z
?GetNextDispID@PyGatewayBase@@UAGJKJPAJ@Z
?GetNameSpaceParent@PyGatewayBase@@UAGJPAPAUIUnknown@@@Z
?GetMemberProperties@PyGatewayBase@@UAGJJKPAK@Z
?GetMemberName@PyGatewayBase@@UAGJJPAPA_W@Z
?GetIDsOfNames@PyGatewayBase@@UAGJABU_GUID@@PAPA_WIKPAJ@Z
?GetDispID@PyGatewayBase@@UAGJPA_WKPAJ@Z
?DeleteMemberByName@PyGatewayBase@@UAGJPA_WK@Z
?DeleteMemberByDispID@PyGatewayBase@@UAGJJ@Z
?PyCom_RegisterExtensionSupport@@YAHPAU_object@@PBUPyCom_InterfaceSupportInfo@@H@Z
?ThisAsIID@PyGPersist@@MAEPAXU_GUID@@@Z
??0PyGPersist@@IAE@PAU_object@@@Z
?ThisAsIID@PyGOleWindow@@MAEPAXU_GUID@@@Z
??0PyGOleWindow@@IAE@PAU_object@@@Z
?ThisAsIID@PyGatewayBase@@UAEPAXU_GUID@@@Z
?QueryInterface@PyGatewayBase@@UAGJABU_GUID@@PAPAX@Z
?Release@PyGatewayBase@@UAGKXZ
?PyObject_AsPROPVARIANT@@YAHPAU_object@@PAUtagPROPVARIANT@@@Z
??0PyGatewayBase@@IAE@PAU_object@@@Z
??1PyGatewayBase@@MAE@XZ
?AddRef@PyGatewayBase@@UAGKXZ
??0PyComTypeObject@@QAE@PBDPAV0@HPAUPyMethodDef@@P6APAVPyIUnknown@@PAUIUnknown@@@Z@Z
??1PyComTypeObject@@QAE@XZ
?PyCom_BuildPyException@@YAPAU_object@@JPAUIUnknown@@ABU_GUID@@@Z
?GetI@PyIUnknown@@SAPAUIUnknown@@PAU_object@@@Z
??0PyIUnknown@@IAE@PAUIUnknown@@@Z
??1PyIUnknown@@MAE@XZ
?compare@PyIUnknown@@UAEHPAU_object@@@Z
?getattr@PyIBase@@UAEPAU_object@@PAD@Z
?iter@PyIBase@@UAEPAU_object@@XZ
?iternext@PyIBase@@UAEPAU_object@@XZ
?repr@PyIUnknown@@UAEPAU_object@@XZ
?setattr@PyIBase@@UAEHPADPAU_object@@@Z
?type@PyIUnknown@@2VPyComTypeObject@@A
PyCom_InterfaceFromPyObject
PyCom_PyObjectFromIUnknown
?PyCom_SetAndLogCOMErrorFromPyExceptionEx@@YAJPAU_object@@PBDABU_GUID@@@Z
?PyCom_InterfaceFromPyInstanceOrObject@@YAHPAU_object@@ABU_GUID@@PAPAXH@Z
PyCom_VariantFromPyObject
PyCom_PyObjectFromVariant
?PyCom_SetCOMErrorFromPyException@@YAJABU_GUID@@@Z
?PyCom_SetAndLogCOMErrorFromPyException@@YAJPBDABU_GUID@@@Z
?GetWindow@PyGOleWindow@@MAGJPAPAUHWND__@@@Z
?PyObject_FromPROPVARIANT@@YAPAU_object@@PAUtagPROPVARIANT@@@Z
?ContextSensitiveHelp@PyGOleWindow@@MAGJH@Z
??0PyComEnumTypeObject@@QAE@PBDPAVPyComTypeObject@@HPAUPyMethodDef@@P6APAVPyIUnknown@@PAUIUnknown@@@Z@Z
?is_object@PyIBase@@SAHPAU_object@@PAVPyComTypeObject@@@Z
?PyCom_SetCOMErrorFromSimple@@YAJJABU_GUID@@PBD@Z
?MakeOLECHARToObj@@YAPAU_object@@PB_W@Z
?GetI@PyIOleWindow@@SAPAUIOleWindow@@PAU_object@@@Z
?type@PyIOleWindow@@2VPyComTypeObject@@A
??1PyIOleWindow@@MAE@XZ
??0PyIOleWindow@@IAE@PAUIUnknown@@@Z
?PyObject_FromOLEMENUGROUPWIDTHS@@YAPAU_object@@PBUtagOleMenuGroupWidths@@@Z
?PyObject_AsOLEMENUGROUPWIDTHS@@YAHPAU_object@@PAUtagOleMenuGroupWidths@@@Z
?type@PyIPersist@@2VPyComTypeObject@@A
?GetClassID@PyGPersist@@MAGJPAU_GUID@@@Z
??1PyIPersist@@MAE@XZ
??0PyIPersist@@IAE@PAUIUnknown@@@Z
?GetI@PyIPersist@@SAPAUIPersist@@PAU_object@@@Z
PySys_WriteStderr
PyExc_RuntimeError
PyMapping_GetItemString
PyMapping_Check
PySequence_Size
_Py_TrueStruct
PyEval_CallObjectWithKeywords
PyErr_Print
Py_InitModule4
_Py_BuildValue_SizeT
_PyArg_ParseTupleAndKeywords_SizeT
_PyArg_ParseTuple_SizeT
PyModule_GetDict
PyDict_SetItemString
PyDict_New
PyList_Append
PyString_AsString
PyString_FromStringAndSize
PyCallable_Check
PyLong_AsLong
PyExc_NotImplementedError
PySequence_Tuple
PyDict_GetItemString
PyLong_AsUnsignedLong
PyInt_FromLong
PyBool_FromLong
PyLong_FromUnsignedLong
PyTuple_New
PyErr_SetString
PyErr_Format
PyArg_ParseTuple
PyArg_ParseTupleAndKeywords
Py_BuildValue
PyEval_SaveThread
PyEval_RestoreThread
_Py_NoneStruct
PyExc_MemoryError
PyExc_TypeError
PyInt_AsLong
PyGILState_Ensure
PyGILState_Release
PyList_New
PyErr_Occurred
PyExc_ValueError
_Py_ZeroStruct
PyLong_FromLong
PyString_FromString
PyErr_NoMemory
PyErr_Clear
PyObject_Size
PySequence_Check
PySequence_GetItem
PyLong_FromUnsignedLongLong
PyLong_AsUnsignedLongLong
PyLong_AsUnsignedLongMask
PyObject_IsTrue
PyLong_FromLongLong
PyArg_Parse
?PyWinExc_COMError@@3PAU_object@@A
?PyWinGlobals_Ensure@@YAHXZ
?PyWinObject_FreeResourceId@@YAXPAD@Z
?PyWinObject_AsResourceIdA@@YAHPAU_object@@PAPADH@Z
?PyWinObject_FromULARGE_INTEGER@@YAPAU_object@@AAT_ULARGE_INTEGER@@@Z
?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z
?PyObject_FromWIN32_FIND_DATAA@@YAPAU_object@@PAU_WIN32_FIND_DATAA@@@Z
?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z
?PyWinObject_AsFILETIME@@YAHPAU_object@@PAU_FILETIME@@@Z
?PyWinObject_FromFILETIME@@YAPAU_object@@ABU_FILETIME@@@Z
?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_WH@Z
?PyWinObject_FromHANDLE@@YAPAU_object@@PAX@Z
?PyWinObject_AsTaskAllocatedWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z
?PyWinObject_AsRECT@@YAHPAU_object@@PAUtagRECT@@@Z
?PyWinObject_FromHKEY@@YAPAU_object@@PAUHKEY__@@@Z
?PyWinObject_AsULARGE_INTEGER@@YAHPAU_object@@PAT_ULARGE_INTEGER@@@Z
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z
?PyWinObject_AsBstr@@YAHPAU_object@@PAPA_WHPAK@Z
?PyWinObject_AsPARAM@@YAHPAU_object@@PAI@Z
?PyWinLong_FromHANDLE@@YAPAU_object@@PAX@Z
?PyWinLong_FromVoidPtr@@YAPAU_object@@PBX@Z
?PyWinLong_AsVoidPtr@@YAHPAU_object@@PAPAX@Z
?PyWinObject_FreeString@@YAXPAD@Z
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z
?PyWinObject_FromIID@@YAPAU_object@@ABU_GUID@@@Z
?PyWinSequence_Tuple@@YAPAU_object@@PAU1@PAK@Z
?PyWinObject_AsIID@@YAHPAU_object@@PAU_GUID@@@Z
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z
?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_W@Z
?PyWinObject_FreeWCHAR@@YAXPA_W@Z
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z
?PyWinObject_AsReadBuffer@@YAHPAU_object@@PAPAXPAKH@Z
__clean_type_info_names_internal
??3@YAXPAX@Z
wcsncpy
free
malloc
__CxxFrameHandler3
memset
strncpy
_except_handler3
memcpy
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
__CppXcptFilter
_amsg_exit
_malloc_crt
_initterm
_initterm_e
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
??2@YAPAXI@Z
?terminate@@YAXXZ
_except_handler4_common
LocalFree
GetModuleHandleA
GetProcAddress
LoadLibraryA
IsBadReadPtr
EncodePointer
DecodePointer
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
IsDebuggerPresent
IsProcessorFeaturePresent
initshell
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ