Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
Static task
static1
Behavioral task
behavioral1
Sample
436ea938302097000fe7f50c2d931c68_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
436ea938302097000fe7f50c2d931c68_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
436ea938302097000fe7f50c2d931c68_JaffaCakes118
Size
717KB
MD5
436ea938302097000fe7f50c2d931c68
SHA1
4bdcda28656d656ecfaad0d24353ae077c793b6a
SHA256
23673fa8838fbf3d659a8e6edea3e55ba1981261024bd873605c133475633e5d
SHA512
2396ca50372925d122a993b194b32906fd5e13abb366f33e25ce782580af853b0137b1a7dcd08e055fae08ea0dc49818cb5450ada5c9697ada604f472d89b4c6
SSDEEP
12288:lQIMG56SGWxpqiCXtpQopV01KeRKTwn/n89Uy5z6MGMbhX:34fWbUxUnmUyM78X
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
R:\TempView\QQ1.84\Output\Plugin\Com.Tencent.Soso\Bin\Soso.pdb
??0CxImage@@QAE@K@Z
?Decode@CxImage@@QAE_NPAVCxFile@@K@Z
?GetHeight@CxImage@@QBEKXZ
?GetWidth@CxImage@@QBEKXZ
?Resample@CxImage@@QAE_NJJHPAV1@@Z
?Encode@CxImage@@QAE_NPAVCxFile@@K@Z
?Destroy@CxImage@@QAE_NXZ
connect
WSAGetLastError
closesocket
select
recv
ioctlsocket
socket
send
inet_addr
??ICTXBSTR@@QAEPAPA_WXZ
??0CTXStringW@@QAE@ABVCTXBSTR@@@Z
??0CTXBSTR@@QAE@XZ
?LoadStringW@TXStringBundle@@YAPB_WPB_W@Z
??BCTXStringW@@QBEPB_WXZ
??0CTXBSTR@@QAE@ABVCTXStringW@@@Z
??1CFmtString@@QAE@XZ
?DoFormat@CFmtString@@QAEPB_WPB_W@Z
?PropertyDWord@CFmtString@@QAEHPB_WK0@Z
??4CTXStringW@@QAEAAV0@PB_W@Z
??0CFmtString@@QAE@XZ
?GetLCID@TXI18N@@YAKXZ
?PropertyStr@CFmtString@@QAEHPB_W0@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
?Mid@CTXStringW@@QBE?AV1@HH@Z
?GetLength@CTXStringW@@QBEHXZ
?ReverseFind@CTXStringW@@QBEH_W@Z
??0CTXStringW@@QAE@PA_W@Z
??H@YA?AVCTXStringW@@ABV0@0@Z
?Format@CTXStringW@@QAAXPB_WZZ
?IsEmpty@CTXStringW@@QBE_NXZ
?Trim@CTXStringW@@QAEAAV1@XZ
??0CTXStringW@@QAE@ABV0@@Z
??8@YA_NPB_WABVCTXBSTR@@@Z
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z
??0CTXBSTR@@QAE@ABV0@@Z
??8@YA_NPB_WABVCTXStringW@@@Z
?SetInterval@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
??9CTXBSTR@@QBE_NPB_W@Z
?GBKToUnicode@Convert@Util@@YA_NAAVCTXStringW@@PBDH@Z
??ACTXStringA@@QBEDH@Z
?GetLength@CTXStringA@@QBEHXZ
??1CTXStringA@@QAE@XZ
??0CTXStringA@@QAE@ABV0@@Z
??0CTXStringA@@QAE@UtagGBK@@PB_WH@Z
??0CTXStringA@@QAE@UtagUTF8@@PB_WH@Z
??H@YA?AVCTXStringW@@PB_WABV0@@Z
??4CTXBSTR@@QAEAAV0@PB_W@Z
?GuidToString@Com@Util@@YAJABU_GUID@@PAPA_WH@Z
??4CTXStringW@@QAEAAV0@ABVCTXBSTR@@@Z
?CombineQNC@FS@@YA?AVCTXStringW@@PB_W0@Z
?ConvertToPureFile@FS@@YA?AVCTXStringW@@PB_W@Z
??4CTXStringW@@QAEAAV0@PA_W@Z
?IsEmpty@CTXBSTR@@QAEHXZ
?GetNumber@NLS@@YAHAAVCTXStringW@@K@Z
ord34
?Length@CTXBSTR@@QBEIXZ
??8CTXBSTR@@QBE_NABV0@@Z
?CreateTXBuffer@Data@Util@@YAHPAPAUITXBuffer@@@Z
??4CTXBSTR@@QAEAAV0@ABV0@@Z
ord26
?MoveDownloadFile@CTXHttpDownload@@QAEHPB_WH@Z
?GetFileName@FS@Util@@YA?AVCTXStringW@@ABV3@@Z
?GetDownloadedFilePath@CTXHttpDownload@@QAEHAAVCTXStringW@@@Z
?EncodeUrl@Encode@Util@@YA?AVCTXStringW@@ABV3@_N1@Z
??1CTXHttpDownloadSink@@UAE@XZ
??1CTXHttpDownload@@UAE@XZ
??YCTXStringW@@QAEAAV0@ABV0@@Z
?Download@CTXHttpDownload@@QAEHPB_WPAU_SYSTEMTIME@@0H@Z
?CancelDownload@CTXHttpDownload@@QAEXXZ
?DecodeUrl@Encode@Util@@YA?AVCTXStringW@@ABV3@_N@Z
?Find@CTXStringW@@QBEHPB_WH@Z
?SetUIInterface@CTXHttpDownload@@QAEXPAVCTXHttpDownloadSink@@@Z
??0CTXHttpDownload@@QAE@XZ
??0CTXHttpDownloadSink@@IAE@XZ
?GetFileHash@FS@Util@@YAHPB_WAAVCTXBuffer@@AAK@Z
??8CTXBSTR@@QBE_NPB_W@Z
?TrimRight@CTXStringW@@QAEAAV1@XZ
??8@YA_NABVCTXStringW@@0@Z
?Detach@CTXBSTR@@QAEPA_WXZ
?OnProgress@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@KK@Z
?Mid@CTXStringW@@QBE?AV1@H@Z
?Left@CTXStringW@@QBE?AV1@H@Z
??M@YA_NABVCTXStringW@@0@Z
??9@YA_NABVCTXStringW@@0@Z
??0CTXStringW@@QAE@_WH@Z
??ACTXStringW@@QBE_WH@Z
?CreateTXArray@Data@Util@@YAHPAPAUITXArray@@@Z
?DownloadToBuffer@CTXHttpDownload@@QAEHPB_WPAU_SYSTEMTIME@@@Z
??0CTXStringW@@QAE@UtagGBK@@PBDH@Z
?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z
??0CTXStringA@@QAE@PBDH@Z
?GetDownloadedBuffer@CTXHttpDownload@@QAEHPAPAEPAK@Z
ord33
??0CTXStringW@@QAE@UtagUTF8@@PBDH@Z
?CreateFileW@FS@@YAHPB_WKPAPAUITXFile@@@Z
?IsFileExist@FS@@YAHPB_W@Z
?AllocSysString@CTXStringW@@QBEPA_WXZ
?Find@CTXStringW@@QBEH_WH@Z
?MakeLower@CTXStringW@@QAEAAV1@XZ
??YCTXStringA@@QAEAAV0@ABV0@@Z
??4CTXStringA@@QAEAAV0@PBD@Z
ord30
?TrimRight@CTXStringA@@QAEAAV1@XZ
?TrimLeft@CTXStringA@@QAEAAV1@XZ
?Left@CTXStringA@@QBE?AV1@H@Z
?Find@CTXStringA@@QBEHDH@Z
?Mid@CTXStringA@@QBE?AV1@H@Z
?Find@CTXStringA@@QBEHPBDH@Z
??0CTXStringA@@QAE@PBD@Z
??4CTXStringA@@QAEAAV0@ABV0@@Z
?Empty@CTXStringA@@QAEXXZ
?GetBuffer@CTXStringA@@QAEPADXZ
?Format@CTXStringA@@QAAXPBDZZ
??0CTXStringA@@QAE@UtagEN@@PB_WH@Z
??0CTXStringA@@QAE@XZ
?Resolve@HostResolve@Util@@YAJPA_WPAUITXHostResolverSink@@PAK@Z
?CancelResolve@HostResolve@Util@@YAJK@Z
?StopThread@CTXThreadModel@@QAEXK@Z
?GetHostByName@HostResolve@Util@@YAJPA_WPAPA_W@Z
?Right@CTXStringW@@QBE?AV1@H@Z
??1CTXThreadModel@@MAE@XZ
?SetAsyncCallback@TXTimer@@YAHP6GXPAX@Z0@Z
?StartThread@CTXThreadModel@@QAEHXZ
??0CTXThreadModel@@IAE@XZ
?Remove@CTXStringW@@QAEH_W@Z
??YCTXStringW@@QAEAAV0@_W@Z
??0CTXStringW@@QAE@UtagEN@@PBDH@Z
??YCTXStringW@@QAEAAV0@PB_W@Z
??YCTXStringW@@QAEAAV0@ABVCTXBSTR@@@Z
?CreateTypedExtensionAgentMatch@Extension@Util@@YAXHPAPAUITXExtensionAgentMatch@@@Z
?ReleaseBuffer@CTXStringW@@QAEXH@Z
?GetBuffer@CTXStringW@@QAEPA_WH@Z
?Delete@CTXStringW@@QAEHHH@Z
?TrimLeft@CTXStringW@@QAEAAV1@XZ
?Replace@CTXStringW@@QAEHPB_W0@Z
??4CTXBSTR@@QAEAAV0@ABVCTXStringW@@@Z
ord25
??8@YA_NABVCTXStringW@@PB_W@Z
?Copy@CTXBSTR@@QBEPA_WXZ
??0CTXBSTR@@QAE@ABU_GUID@@@Z
?CompareNoCase@CTXStringW@@QBEHPB_W@Z
?SetTimeout@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?EncodeHash@Encode@Util@@YA?AVCTXStringW@@ABVCTXBuffer@@@Z
?IsFileSystemFile@FS@@YAHPB_W@Z
?SetCustomData@CTXHttpDownload@@QAEHPAUIUnknown@@@Z
?IsRunning@CTXHttpDownload@@QAEHXZ
??9@YA_NABVCTXStringW@@PB_W@Z
?LoadTinyXmlByContent@FS@Util@@YAHPA_WPAPAVTiXmlDocument@@H@Z
?TrimLeft@CTXStringW@@QAEAAV1@PB_W@Z
?CopyFileW@FS@@YAHPB_W0H@Z
?DeleteFileW@FS@@YAHPB_W@Z
??9CTXBSTR@@QBE_NABV0@@Z
?GetCustomData@CTXHttpDownload@@QAEHPAPAUIUnknown@@@Z
??1CUnZipFile@@QAE@XZ
?UnZipFile@CUnZipFile@@QAE_NABVCTXStringW@@0@Z
??0CUnZipFile@@QAE@XZ
?GetParentDir@FS@Util@@YA?AVCTXStringW@@V3@@Z
?MoveFileW@FS@@YAHPB_W0H@Z
?GetAsSystemTime@CTXTime@@QBE_NAAU_SYSTEMTIME@@@Z
??0CTXTime@@QAE@_J@Z
?GetTime@CTXTime@@QBE_JXZ
??0CTXTime@@QAE@ABU_SYSTEMTIME@@H@Z
?UnicodeToGBK@Convert@Util@@YA_NAAVCTXStringA@@PB_WH@Z
?GetBuffer@CTXStringA@@QAEPADH@Z
?GetLoginServerTime@Time@Util@@YAKXZ
?OnDownloadStart@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@KK@Z
?OnConnected@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@@Z
?OnConnecting@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@PB_W@Z
??0CTXStringW@@QAE@PB_W@Z
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
?CreateTXData@Data@Util@@YAHPAPAUITXData@@@Z
?ConvertTXDataStringBundle@Convert@Util@@YAHPAUITXData@@@Z
??0CTXStringW@@QAE@XZ
??BCTXBSTR@@QBEPA_WXZ
?GetTXDataStr@Data@Util@@YAHPAUITXDataRead@@PB_WAAVCTXStringW@@@Z
??1CTXBSTR@@QAE@XZ
?GetBSTR@CTXStringW@@QBEPA_WXZ
??1CTXStringW@@QAE@XZ
??0CTXBSTR@@QAE@PB_W@Z
?OnError@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@K@Z
??BCTXStringA@@QBEPBDXZ
?OnRedirected@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@PB_W@Z
?Empty@CTXStringW@@QAEXXZ
?Get@Metadata@Util@@YAJPAUITXData@@PA_WPAK@Z
?RawCreateGFElementByXtml@GF@Util@@YAJPA_WPAPAUIGFElement@@PAU3@0H@Z
?RawInitGFElementByXtml@GF@Util@@YAJPA_WPAUIGFElement@@10H@Z
?GetAnchorResult@CGFAnchor@@QAE?AVCRect@@PAVVCalcSizeSupporter@@PAUtagSIZE@@@Z
?AddAnchor@CGFAnchor@@QAEXEEVCRect@@VCPoint@@@Z
??0CGFAnchor@@QAE@XZ
?AdviseWebBrowser@IEEvent@Util@@YAHPAUIWebBrowser2@@PAUITXWebBrowserEvents@@PAPAUIUnknown@@AAK@Z
?UnadviseWebBrowser@IEEvent@Util@@YAHPAUIWebBrowser2@@K@Z
?TopFrameFromPoint@GF@Util@@YAJPAUIGFFrame@@PBUtagPOINT@@PAPAU3@@Z
?CreateObject@GF@Util@@YAJABU_GUID@@0PAPAX@Z
?GetGroupName@Group@Util@@YA?AVCTXStringW@@K@Z
?IsVASFlagValid@Contact@Util@@YAHKE@Z
?OpenUrlInIM@URL@Util@@YAXABVCTXStringW@@W4URLMODIFYLEVEL@12@0@Z
?GetSelfUin@Contact@Util@@YAKXZ
?GetSignFmt@URL@Util@@YAXAAVCFmtString@@@Z
?Get32ByteValueAddedSign@Misc@Util@@YA?AVCTXStringW@@XZ
??1CTXDataReportCodecBase@@UAE@XZ
?GetMsgTime@Msg@Util@@YA_JPAUITXMsgPack@@@Z
?OpenUrlInIM@URL@Util@@YAXABVCTXStringW@@@Z
?CreateMsgPack@Msg@Util@@YAHPAPAUITXMsgPack@@@Z
?IsServerControlBitOn@Misc@Util@@YAHK@Z
?RegisterCodec@DataReport@Util@@YAJKKPAUITXDataReportCodecExt@@@Z
?IncHelper@DataReport@Util@@YAJKPB_WK@Z
?GetNickname@Contact@Util@@YA?AVCTXStringW@@K@Z
?GetIMVersion@Contact@Util@@YAGK@Z
??0CTXDataReportCodecBase@@QAE@XZ
?GetMajorVer@Version@@YAEXZ
?GetMinorVer@Version@@YAEXZ
?IsVASFlagValidEx@Contact@Util@@YAKKEI@Z
?CodeWord@CTXDataReportCodecBase@@IAEXEPB_W@Z
?CodecTLV@CTXDataReportCodecBase@@UAGJKPAUITXData@@PAPAUITXBuffer@@@Z
?GetEditSelTextInChatFrame@ChatSession@Util@@YA?AVCTXStringW@@KH@Z
?ChatFrameEvent@ChatSession@Util@@YAHKW4CFChatType@ChatFrame@@W4CFEventType@4@PAUITXData@@@Z
?IsChatSessionOpen@ChatSession@Util@@YAHKH@Z
?SoSoPicUtil@ChatSession@Util@@YAHKHPAUITXData@@@Z
?GetChatSessionMainWnd@ChatSession@Util@@YAHKHPAPAUIGFFrame@@@Z
?GetIDAndTypeInFromChatWnd@ChatSession@Util@@YAJPAUIGFFrame@@AAKAAH@Z
?CodeServerData_BoolValue@API@AdvConfig@@YAHGHPAPAUITXData@@@Z
?DecodeServerData_BoolValue@API@AdvConfig@@YAHGPAUITXData@@PAH@Z
?GetChatSessionViewFrame@ChatSession@Util@@YAHKHPAPAUIGFFrame@@@Z
?QueryTXChatSession@ChatSession@Util@@YAHKHPAPAUIAFChatSession@@@Z
?GetGFFrameFromHWND@Misc@Util@@YAHPAUHWND__@@PAPAUIGFFrame@@@Z
?SendMsg@ChatSession@Util@@YAXKHPAUITXMsgPack@@K@Z
?GetShowSelTextInChatFrame@ChatSession@Util@@YA?AVCTXStringW@@KH@Z
?MessageBoxExW@Misc@Util@@YAHPAUIGFFrame@@PA_W1IPAUITXData@@PAPAU4@@Z
?IsEnableYaHei@Misc@Util@@YAHXZ
?IsTencentUrl@URL@Util@@YAHVCTXStringW@@@Z
?GetText@TiXmlElement@@QBEPBDXZ
?FirstChild@TiXmlNode@@QAEPAV1@PBD@Z
?Value@TiXmlNode@@QBEPBDXZ
?RootElement@TiXmlDocument@@QAEPAVTiXmlElement@@XZ
?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@PBD@Z
HeapSize
HeapReAlloc
FindFirstFileW
DeleteFileW
GetProcessHeap
FindClose
GlobalSize
WideCharToMultiByte
MultiByteToWideChar
Sleep
InterlockedCompareExchange
TerminateProcess
GlobalAlloc
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentProcessId
GetSystemTimeAsFileTime
FindNextFileW
GetACP
InterlockedExchange
GetVersionExA
GetLocaleInfoA
HeapDestroy
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
SetThreadLocale
GetThreadLocale
RaiseException
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetLastError
lstrlenW
lstrcmpiW
GetModuleHandleW
GetModuleFileNameW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GlobalFree
GlobalUnlock
lstrcpynW
GlobalLock
UnregisterClassA
CallNextHookEx
SetWindowsHookExW
UnhookWindowsHookEx
PtInRect
GetCursorPos
GetActiveWindow
GetMessageW
TranslateMessage
DispatchMessageW
PostQuitMessage
WindowFromPoint
PostMessageW
SetCursor
GetParent
IsWindow
CreateWindowExW
SendMessageW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
CopyRect
SetRect
CharNextW
GetDesktopWindow
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW
SHGetFileInfoW
StringFromCLSID
CoCreateGuid
ReleaseStgMedium
CoTaskMemFree
CoCreateInstance
VariantCopy
VariantInit
SysFreeString
SysStringLen
LoadRegTypeLi
LoadTypeLi
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetDim
SafeArrayGetElement
VariantClear
SysAllocString
VarUI4FromStr
ord23
ord61
ord58
ord32
ord31
ord30
ord22
ord18
ord15
ord64
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
__dllonexit
_unlock
_except_handler4_common
strncpy
fopen
fseek
ftell
fread
fclose
memcpy
_time64
memset
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_invalid_parameter_noinfo
_encode_pointer
??2@YAPAXI@Z
memmove_s
??_V@YAXPAX@Z
wcsncpy_s
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
wcscpy_s
free
malloc
memcpy_s
__CxxFrameHandler3
_recalloc
_CxxThrowException
??3@YAXPAX@Z
_lock
_onexit
_decode_pointer
_purecall
_malloc_crt
__clean_type_info_names_internal
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
GetUrlCacheEntryInfoW
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ