Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
3a9503ce79a0ac3b6f2f38163d55554d_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3a9503ce79a0ac3b6f2f38163d55554d_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
3a9503ce79a0ac3b6f2f38163d55554d_JaffaCakes118
Size
1.3MB
MD5
3a9503ce79a0ac3b6f2f38163d55554d
SHA1
338001e7d3e09cd62c6b58090af1d9dc293c86b3
SHA256
9941fd97327d54a18209d0bb1f36992a18a3809aa8d163e7fe80193a4348610a
SHA512
b2ef47a7ed9e8b54a9f362fb8d871adcc371eb4ef1c0e60f414b06049791122d14dac655ca5087a9a524295f070c530b2b7afbff444bc8522c291a0b55082b28
SSDEEP
24576:k6iU++PuVPKcebLkYbff3kI79LKG3++hW5+cZivo7WFlLaBpSv:k6v+3CTkfIwGZ0rElLaBpSv
resource | yara_rule |
---|---|
sample | upx |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
GetVersionExA
GetVersion
WriteFile
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
OpenWindowStationA
CreateBitmap
SetSecurityDescriptorDacl
CommandLineToArgvW
CoInitialize
accept
PathFileExistsA
DnsFlushResolverCache
LsaGetLogonSessionData
GetModuleBaseNameA
NetUserDel
WTSFreeMemory
CreateEnvironmentBlock
VerQueryValueA
Install
LoadPerfCounterTextStringsW
PerfectWorld
ProxyDll
ServiceMain
UnloadPerfCounterTextStringsW
nxProxyXll
z�Lc'T܍������4 {mۦ��WZ��k�z��V8�\0�f���� �����qL)������6^� jn���s�3h�@It�hB����g��Ő�rn�ҋ_��*ϴ��x��A����� o����H1��C��C��@����)]HL�����s�\1#�x�%k=�ʃ�_�d��n�������\��06 Q��F;`T9�y,�x�j���P��S�l��,���]X��]R�yKи�W�qv�V���ŷ/Դ��GL�����0��5h�8QR��N��x��1�P���>����ן��6��|�kU��O^����̙M·�X�M��5H�5��`]� 0����"K�\X��� �N�K�B�:�)!mO'3E0 ��+��CN�V�%�!���; �ɷ�X���Gf]̈�%�ʭJ�gc��I�lC� )r��y{߃p�j� �EM��#!�tn��S�:r}����v�X�1�����L��eq�D�Q�KZ ��VEY��y������R��'h�,y� �"�B����lzJWW �����H�H_wI(��c㮊f�D(g4��h���MZ/N����ȟ���6'KU(]�@Xf����If�trr���K�Y��&�[�F��b��\�2d��6���"�֤*m�BCzu�6�\��k� �V�gP�#$��P~YB�� �6H���/�}����K��98H�6fS�-+�����.���6v�G@3̦A�<�_/�M�qtj���Bm�+���i=E;$�!F�} +�k˷JCwu��-'|�=����%��dE+I�H����mJ��Ϳ��@Xg�r���7q���������Ҷ<.0y�|�����h}���I���K�b�Q��9�:�6�_���M�U�m�2 <Ǐ�G�e���O`]<��4م9�(�N��Ui��Jq���L�O�^(�l�<9h2Y���ڱk�}w?ћfb�=X��g�wc�����IS��$����|�����_��f�6lF�A!�W��.��y�6����> ���$ϕ)A�ES��S��$x���5%�_d����9�Rٯ{Q�u6�����e�.�<`�����W(ચ,�2;>��.A��e�FJ)��-v0����~R�c|�ٓ�KΊ<�V��D��2wh�=�]�%�"����w���D�H����$��5�Cz�o\>ERi�X�Tx���LT���C$J���^�D[T$/^?;�9�G��E�;�fA�U�kϥ"+��qI;rGlP�pA�n 2��dv���p�7�=}�"�2�2��!x,��T��'7i~}��%J���� ���|=Ǎ�! ٚj"����W�� 7 ���e������߆��t����<'�}I�7��;�u�B�Vu �)_g�χ��*0�4� .S��^��lÑ��jw?2�ɗ����ή��P�t��.�Ә_�=�c`�BQX}�@�1�h�n��;##�slʁ��0�鸢�[봽����d4� ��g�Ⱦu6Y<�U��EE�'�Z���ș�(�|��g5l����Ês���_�8��R�gCI�3ݾ~�?d^�����]1�(�6;Dg'��_a�q���Ne��sl�_}���R��)aW���$�{�`@¾[���@�@�)�3d���Z�[�>��a����ݡ�/"��)Ϲq��M_���ߍ�k�wh�G�וww��Ҕv:h�s���'4U��})11�/�xj���b���a]�sa���/��߬c����0�"���w_~I�ѹ=}CC:Q���7T��V'�� ~���s�����Y�ˉt�z� A�����������#m�!�G� ��7�|�G����� ��y�E�S�̟�Lj���)A�>�h�rd� ��S��_���HΙbc�A��ae�i˕B�{�����>g�je��|C���������Lc�`4�*����D���$��]��_�8�d7����p�1�����B2�Qgs*� QMRZ2�t.�<{� {����y����*{7p��V�d}�4�� :�G{���)w�cr�pm�7�m#n���"��eFN]�m�1ӡ�����u�Cz�����$�W����U 载ܺ%P�@=�z��dy!A���;r�R� ��w�~� �'�n�a��?�dd�9@Ⱦ�ҋp���o>����^ӄ�-2�z�z5��ɭk��a!Q����&��Cv }ǜ����* WFu��%��˛l���w���� �E ������E"���>Wa^���F������7;(n���J�j�-�^�e�������.p�**sF�G�GSs�?\ @��ש������6}G�u�5n�>���t��cI�л������{1�� �o�o���J�=�������@ �l��Z,��N������]�X��~𤃥df�QWq���=�r�ZP� �b8�0CvB,U� ���Wf3&�<�n�`If<E�q�?\��]���ǽ�f'5[I��P7e�V��Ca��t���g���h�^�}���#|��a'pﺡ�"�.�kܑ�d��Q?S��A�`R$M�Lp� �(ظ���3?������5��C&�d6GA"��_5,��h.�B���E �` ����{n�Ae�ANE�Nx��%jB�*z+��e�9[vt��KI�MQ=Q������S���"~z�)�\�?���ȑ��<�R�2�����6��~Ն^�:.�2&���z�l f�l�GQ�vw�4�ƴ���|�ղr->���4 ���u���[{\!���z�u��J�Ǝ,`��[\7w:2p��F��u�6'��%��;���j�� ��oA�X��w��h�b���Rp�؆�m��? E���C�vRrR�;���B|��g�ġ`<#�� ���Į�J���z����e��M=�����w�]kW4�r��J���o�[s��� �(����!A������eR�ɲ��yO�i�K^d�3�C�P��7� OVqUd��� �0�oX��`P�E� �Ƭ!^� %�[�\Q���D-��݈�8�� �f_�B��1��%�q4��" h�WruBOLX�&�s�r6��<�P�*���n�:%~�+f�̐��$u%J�Z��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ