Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
Static task
static1
Behavioral task
behavioral1
Sample
88f1c9399a1f3b602da9bd5b6730c711_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
88f1c9399a1f3b602da9bd5b6730c711_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
88f1c9399a1f3b602da9bd5b6730c711_JaffaCakes118
Size
553KB
MD5
88f1c9399a1f3b602da9bd5b6730c711
SHA1
e7aa17c826f5530cd079c977549f0cce22d05f90
SHA256
7d0eb3d2293efa997ff0c7d553129d5a9f2f966b04a6bead55bbca65f53f0f39
SHA512
af3d8a059b38247cb5693dcb59f3fac68f3b010bc9748cee9ad0101b622886afcdfc039b29b7ad464a5404881a905ce9338da66b78f54a70ea3cc00012893366
SSDEEP
12288:cR8MDPIBUOkvkgS4zjdySyPh7iSabKMI1c2ltVKYKkxGa:rjUOkc4zjdzyPoSa2N11tVKYKTa
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
R:\TempView\QQ1.82\Output\Plugin\Com.Tencent.MMOG\Bin\MMOG.pdb
?PropertyDWord@CFmtString@@QAEHPB_WK0@Z
??4CTXStringW@@QAEAAV0@PB_W@Z
?DoFormat@CFmtString@@QAEPB_WPB_W@Z
??0CFmtString@@QAE@XZ
??0CTXBSTR@@QAE@ABV0@@Z
??4CTXBSTR@@QAEAAV0@ABV0@@Z
??M@YA_NABVCTXStringW@@0@Z
??0CTXStringW@@QAE@ABU_GUID@@@Z
?CreateTXBuffer@Data@Util@@YAHPAPAUITXBuffer@@@Z
?CreateTXArray@Data@Util@@YAHPAPAUITXArray@@@Z
??H@YA?AVCTXStringW@@ABV0@0@Z
?SetInterval@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z
?GBKToUnicode@Convert@Util@@YA_NAAVCTXStringW@@PBDH@Z
??0CTXStringW@@QAE@PB_WH@Z
?Utf8ToWS@Convert@Util@@YA?AVCTXStringW@@PBDH@Z
?Decode16@Encode@Util@@YAHABVCTXStringW@@AAVCTXBuffer@@@Z
??0CTXStringW@@QAE@PA_W@Z
??8CTXBSTR@@QBE_NPB_W@Z
?Format@CTXStringW@@QAAXPB_WZZ
?Length@CTXBSTR@@QBEIXZ
?IsEmpty@CTXStringW@@QBE_NXZ
??0CTXStringW@@QAE@ABV0@@Z
??1CFmtString@@QAE@XZ
?Encode16@Encode@Util@@YA?AVCTXStringW@@ABVCTXBuffer@@@Z
??BCTXStringA@@QBEPBDXZ
?Utf8FromWS@Convert@Util@@YA?AVCTXStringA@@PB_WH@Z
??H@YA?AVCTXStringW@@PB_WABV0@@Z
?PropertyStr@CFmtString@@QAEHPB_W0@Z
?IsFileExist@FS@@YAHPB_W@Z
?Base64Encode@Encode@Util@@YA?AVCTXStringW@@ABVCTXBuffer@@H@Z
??8@YA_NPB_WABVCTXStringW@@@Z
??4CTXStringW@@QAEAAV0@ABVCTXBSTR@@@Z
??0CTXBSTR@@QAE@H@Z
??YCTXStringW@@QAEAAV0@ABV0@@Z
??8@YA_NABVCTXStringW@@0@Z
?LoadXmlByName@FS@Util@@YAHPB_WPAPAUIXMLDOMDocument@@@Z
??YCTXStringW@@QAEAAV0@PB_W@Z
?CreateFileW@FS@@YAHPB_WKPAPAUITXFile@@@Z
?CombineQNC@FS@@YA?AVCTXStringW@@PB_W0@Z
?Left@CTXStringW@@QBE?AV1@H@Z
?ReverseFind@CTXStringW@@QBEH_W@Z
?PropertyLong@CFmtString@@QAEHPB_WJ0@Z
?AllocSysString@CTXStringW@@QBEPA_WXZ
??4CTXBSTR@@QAEAAV0@PB_W@Z
??8CTXBSTR@@QBE_NABV0@@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
??0CTXBSTR@@QAE@PB_W@Z
??0CTXBSTR@@QAE@ABVCTXStringW@@@Z
??BCTXStringW@@QBEPB_WXZ
?LoadStringW@TXStringBundle@@YAPB_WPB_W@Z
??0CTXBSTR@@QAE@XZ
??0CTXStringW@@QAE@ABVCTXBSTR@@@Z
?IsEmpty@CTXBSTR@@QAEHXZ
??ICTXBSTR@@QAEPAPA_WXZ
?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z
?GuidFromString@Com@Util@@YAJPA_WAAU_GUID@@@Z
??0CTXStringW@@QAE@PB_W@Z
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
?CreateTXData@Data@Util@@YAHPAPAUITXData@@@Z
?ConvertTXDataStringBundle@Convert@Util@@YAHPAUITXData@@@Z
??0CTXStringW@@QAE@XZ
??BCTXBSTR@@QBEPA_WXZ
?GetTXDataStr@Data@Util@@YAHPAUITXDataRead@@PB_WAAVCTXStringW@@@Z
??1CTXBSTR@@QAE@XZ
?GetBSTR@CTXStringW@@QBEPA_WXZ
??1CTXStringW@@QAE@XZ
??1CTXStringA@@QAE@XZ
?CreateObject@GF@Util@@YAJABU_GUID@@0PAPAX@Z
?RawInitGFElementByXtml@GF@Util@@YAJPA_WPAUIGFElement@@10H@Z
?RawCreateGFElementByXtml@GF@Util@@YAJPA_WPAPAUIGFElement@@PAU3@0H@Z
?IsMaskFlagValid@Contact@Util@@YAJKEKAAH@Z
?GetMinorVer@Version@@YAEXZ
?GetMajorVer@Version@@YAEXZ
?IsNewFlagValid@Contact@Util@@YAHKK@Z
?AddReport@URL@Util@@YA?AVCTXStringW@@ABV3@0@Z
?GetSignFmt@URL@Util@@YAXAAVCFmtString@@@Z
?GetStringFromBuffer@RichStatusHelper@@YAHABVCTXBuffer@@IAAVCTXBSTR@@AAIH@Z
?GetSelfUin@Contact@Util@@YAKXZ
?IsOnline@Contact@Util@@YAHK@Z
?IsVASFlagValid@Contact@Util@@YAHKE@Z
?IsVASFlagValidEx@Contact@Util@@YAKKEI@Z
?OpenUrlInIM@URL@Util@@YAXABVCTXStringW@@W4URLMODIFYLEVEL@12@0@Z
?GetMaskFlag@Contact@Util@@YAJKEKIAAK@Z
?Get32ByteValueAddedSign@Misc@Util@@YA?AVCTXStringW@@XZ
?DecodeServerData_BoolValue@API@AdvConfig@@YAHGPAUITXData@@PAH@Z
?CodeServerData_BoolValue@API@AdvConfig@@YAHGHPAPAUITXData@@@Z
InterlockedIncrement
InterlockedDecrement
SetThreadLocale
GetThreadLocale
RaiseException
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetLastError
lstrlenW
lstrcmpiW
GetModuleHandleW
GetModuleFileNameW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
DeleteCriticalSection
GetLocaleInfoA
GetACP
InterlockedExchange
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSection
LeaveCriticalSection
GetFileAttributesW
EnterCriticalSection
CharNextW
UnregisterClassA
GetDesktopWindow
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
SHGetFileInfoW
ShellExecuteW
CoCreateInstance
StringFromCLSID
CoTaskMemFree
VariantClear
SysAllocString
VarUI4FromStr
LoadTypeLi
SysStringLen
SysFreeString
LoadRegTypeLi
ord58
ord30
ord15
ord31
ord32
ord64
ord22
ord61
ord23
ord18
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__clean_type_info_names_internal
memset
__CppXcptFilter
??3@YAXPAX@Z
_CxxThrowException
_recalloc
__CxxFrameHandler3
memcpy_s
malloc
free
wcscpy_s
wcsncpy_s
??_V@YAXPAX@Z
memmove_s
_purecall
_invalid_parameter_noinfo
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
_byteswap_ulong
_time64
_except_handler4_common
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ