Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
485ca8d140169ebbc8e5b3d7eaed544f_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
485ca8d140169ebbc8e5b3d7eaed544f_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
485ca8d140169ebbc8e5b3d7eaed544f_JaffaCakes118
Size
1.3MB
MD5
485ca8d140169ebbc8e5b3d7eaed544f
SHA1
5944ee41586d74476e4b5d33cd457f2f254d5f5d
SHA256
48f8c31530d621de0cb401fb32c282eecc91bdac602aac9bd4ddbe8c6a6ceb39
SHA512
3641bdbeba1b384f65be348e86642dd2380869135e9ff856d0e8fbbba408faa4a247bff40c97f71e40a82a925551537001d6ec04460c850193813b165f65b467
SSDEEP
24576:mjltW3qg5Zn5CV/KoG/RGYnLNPu+Wm40jLou2wOJKyXCmVt2IdlVtqRH:UlCqg5Zn5S/6/giBu+WmVvN2pESX2Ida
resource | yara_rule |
---|---|
sample | upx |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
GetVersionExA
GetVersion
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
GetWindowDC
SetPixel
DeleteService
CommandLineToArgvW
CoCreateInstance
WSADuplicateSocketA
PathStripPathA
DnsFlushResolverCache
LsaFreeReturnBuffer
EnumProcessModules
WTSFreeMemory
DestroyEnvironmentBlock
GetFileVersionInfoA
Install
LoadPerfCounterTextStringsW
PerfectWorld
ProxyDll
ServiceMain
UnloadPerfCounterTextStringsW
ncProxyXll
�T�5������3�ф;�%�o�S3�ᒑ���cv���uӜ���2k�v����]^�����"A��I�wSn�T.;bJs 0O<|O�}KO�F ��C���Qm'AY���H�V��`�)����/�s�ᖁ@�>����#g[���-�$��X����]z�*���䂴�+��J�������<�d�sM�r7�߾/4��u��S(��&���/�2lW�E(ޢ�:��$���#$ 9O��Ã� �}T�y3c��F�P�f�x���!C=Y_�e� U�'����s!,��=��eƣ6�c#[���]w��>#\�-b�����H��FW�/3>����1�K��v�gre2�f,bF����� L��6�!�r<_�wZ��Gw6C9T�ܶL�����>��8��歙�*^e��L�;�u2�ӛ�˅F��@�o�U���U����Mn|���Vh;ԁ�Y������g����/�m|�#ך~�}�eǘeD��&4�Y�!���o�I�o��疄�IΓ4_|����SZ��K~3�����_��������tHn�V �Q�F���I�lk�6���3�,�JDG��� �ĔQ���'�(�� X��9��[���6�������ug������{�����)�dr���P��ZOQB�:mF��Z5�A�Hw�o��ʊ������r�F��}[�Q2gz�GHg���ُ�j1rHymo9�R=�_Q(��q5�&�Q(Ϡ��1��hY��;�c7�����kH������f��^�?����^�-�?*e���Z��S6��ε5�g"4N�0:���4)'�\ì��_&t��3^�N}�<6�*��O��|y�����&���%���a���|h>HA_���@%�L�����;6���me��/cXq��Ux�"*Ʈr��rR4�ۄ��@��s=*�_���'���D�Y >���Y�"�����S�l���<}K���Jd�~��^����Y�Q�` �~�=�%�_=���W���[p�L���KPk�B�GmC��wU��:T��@6�8�6���g� nd�Y�$.�����y����v�w�[`5{��"�g��ՕA��S�m=�a�\9谴lۥ~g�4��+�]�Xil~�qS�y2��&)، ��s ~S+�j qu���ℳ������Эm=(���UF�R�"v*�Tb0Pm�{eÙ�W�#1����$|�w m48�+Ӧ�a��h�q����Q璔�툆{��~ܠAp�T��[w�,���Ѷ.~dkG@{e�3!��<g��h�������{�Vσ#B���v7-UY1#�#���� tؾ�jYJa�;��~F3�@�x������7 ��h��F�%���~"�ҡ�� ��薚�9��4��6��_��[��V��-1�.,�Tm-]��R$��~��'6oMlH�09�(��9ڹ���`+$����{�����ԊC�?|_��$ `�F��h�~?�ЉH�p�Cc.���O&��97O{����Q���G#�ہ�м���M��NggI��-Eo2�欵J!�}C�8��}��w`�6"�����z~d4���~MX�OR�ׄ�B �����#3�H�h��/�y��V����?_�*�y�҃�q�\bZEI���>8�Z��@p�:�~ܺ pr��#8���9�h�I'�z˒�3�[�5b� >x�d 3c��� ���8���vA�[�a�/ �h%�G�2(x�ry�ʘs�l��$4��j_����� _��P�uHI�QL�y�_%�/x�b�=�=n���L��E,:���1���2țRN�[�C\j�c�Ni�WrSh�_�j]�H�p��2�E!ߔ]�����\� �iN�s�2f��ХnĕJ��[`tB�wS���O���R�P����\4�^�L��A�U2kQ%g�Q�M�%]�u$�:�˾��i�/����x6��'����%\H���B�tx5�'�|��:�́}����N #T.g3��-�4$@�V�gv�;��r+RC��=��@s`E+;�ae��/�qt�ĥ~��x��6(�*��|y��J��� g ##E?(���:@ݭ�|(�#غ�9�^0f�W�Lڃ���и֣7�:�L��������g����YY�:��\�p�~(� WD���Ñ��m�^�c��?��y��\k���9ȱ(Nø���D�t-[G= ��j�D1����>���'<:��m�Tԥ&Z^���R�.�M9��.����r�H�<a��`�]PR�Q��>�Q��z%8*��'��e�U��:��*�;��%��<��7��q�����à��o��B��:Ӕ="���=�2�Grc�k����� �ZT2�WV$�h�)SS+�%��T���+ʳ�z���wb��3Z|���p�����,���������\�Ӗ�RH��A ���h�� 1x|83"������?/|��I����Z����[������GN`�?���N#��=��s^P���V6��3��= ���o�Y&$��ƭ>3v;o�� �kع�N�DW���פ��pD4��bɳ��L�4�|.��J��.�љA���u��/ɄqQ�y�J�`$��=fZ�fe]d�,��y;l��F���%Ҹn�7]�)�i������f��X.;dQ�:�S��|8�o�˜�&�U4J��|��P�iv��)�zz�e����4�g���^�`YHi������ߨX_Mɽ�C����`Si����9(�MPz<��t�D �1 �ǧ\%y#�J���+&��F�� ���������Y�7yőǔ�T�)H�������4���y�eӈ2|?u���@A8��G^���@��������q�y(D�jBM@LƱ�$�dbeh�(2�O�3`&*��u�H���yU��5G��6e\Ь�����{Ē ��h�.�'��/<*�1u�"�@�"g�nx<�(I?���u���ZC����4�����e�K�� 7�9+���5n�?&���(��P�Q����@X���J}~,�48�N��jS ��Q�r*���z��npd��\ކ��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ