Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
8cb10b202c47c41e1a2c11a721851654_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
8cb10b202c47c41e1a2c11a721851654_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
8cb10b202c47c41e1a2c11a721851654_JaffaCakes118
Size
1.3MB
MD5
8cb10b202c47c41e1a2c11a721851654
SHA1
d6bb45c5fe27ecb84da12819fc4ee798200df442
SHA256
77a15c0e45c1dfa42d135321576c725c40f890d95e9ad44bdabeae9eb5d71a9f
SHA512
bcf1c334a88ff98aa196d4189efefd19cb86242e03b6b2edb84d66a26040f335e784d558edad16ead095c27c2b5cf45b772910f8a30b72f2c841c921f5a82b12
SSDEEP
24576:GsRn7+4PnhlKA2ZPmal79CWZyXFiN6CPKybSSEdOqC3C08la87:G8ndPt8Rd8w6TybSSEdbCx8l7
resource | yara_rule |
---|---|
sample | upx |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
GetVersionExA
GetVersion
lstrcmpiA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
MapVirtualKeyA
GdiFlush
LookupPrivilegeValueA
CommandLineToArgvW
CoCreateInstance
WSADuplicateSocketA
PathMatchSpecA
DnsFree
LsaFreeReturnBuffer
GetModuleFileNameExA
NetApiBufferFree
WTSQuerySessionInformationA
CreateEnvironmentBlock
GetFileVersionInfoSizeA
Install
LoadPerfCounterTextStringsW
PerfectWorld
ProxyDll
ServiceMain
UnloadPerfCounterTextStringsW
nxProxyXll
z�Lc'T܍������4 {mۦ��WZ��k�z��V8�\0�f���� �����qL)������6^� jn���s�3h�@It�hB����g��Ő�rn�ҋ_��*ϴ��x��A����� o����H1��C��C��@����)]HL�����s�\1#�x�%k=�ʃ�_�d��n�������\��06 Q��F;`T9�y,�x�j���P��S�l��,���]X��]R�yKи�W�qv�V���ŷ/Դ��GL�����0��5h�8QR��N��x��1�P���>����ן��6��|�kU��O^����̙M·�X�M��5H�5��`]� 0����"K�\X��� �N�K�B�:�)!mO'3E0 ��+��CN�V�%�!���; �ɷ�X���Gf]̈�%�ʭJ�gc��I�lC� )r��y{߃p�j� �EM��#!�tn��S�:r}����v�X�1�����L��eq�D�Q�KZ ��VEY��y������R��'h�,y� �"�B����lzJWW �����H�H_wI(��c㮊f�D(g4��h���MZ/N����ȟ���6'KU(]�@Xf����If�trr���K�Y��&�[�F��b��\�2d��6���"�֤*m�BCzu�6�\��k� �V�gP�#$��P~YB�� �6H���/�}����K��98H�6fS�-+�����.���6v�G@3̦A�<�_/�M�qtj���Bm�+���i=E;$�!F�} +�k˷JCwu��-'|�=����%��dE+I�H����mJ��Ϳ��@Xg�r���7q���������Ҷ<.0y�|�����h}���I���K�b�Q��9�:�6�_���M�U�m�2 <Ǐ�G�e���O`]<��4م9�(�N��Ui��Jq���L�O�^(�l�<9h2Y���ڱk�}w?ћfb�=X��g�wc�����IS��$����|�����_��f�6lF�A!�W��.��y�6����> ���$ϕ)A�ES��S��$x���5%�_d����9�Rٯ{Q�u6�����e�.�<`�����W(ચ,�2;>��.A��e�FJ)��-v0����~R�c|�ٓ�KΊ<�V��D��2wh�=�]�%�"����w���D�H����$��5�Cz�o\>ERi�X�Tx���LT���C$J���^�D[T$/^?;�9�G��E�;�fA�U�kϥ"+��qI;rGlP�pA�n 2��dv���p�7�=}�"�2�2��!x,��T��'7i~}��%J���� ���|=Ǎ�! ٚj"����W�� 7 ���e������߆��t����<'�}I�7��;�u�B�Vu �)_g�χ��*0�4� .S��^��lÑ��jw?2�ɗ����ή��P�t��.�Ә_�=�c`�BQX}�@�1�h�n��;##�slʁ��0�鸢�[봽����d4� ��g�Ⱦu6Y<�U��EE�'�Z���ș�(�|��g5l����Ês���_�8��R�gCI�3ݾ~�?d^�����]1�(�6;Dg'��_a�q���Ne��sl�_}���R��)aW���$�{�`@¾[���@�@�)�3d���Z�[�>��a����ݡ�/"��)Ϲq��M_���ߍ�k�wh�G�וww��Ҕv:h�s���'4U��})11�/�xj���b���a]�sa���/��߬c����0�"���w_~I�ѹ=}CC:Q���7T��V'�� ~���s�����Y�ˉt�z� A�����������#m�!�G� ��7�|�G����� ��y�E�S�̟�Lj���)A�>�h�rd� ��S��_���HΙbc�A��ae�i˕B�{�����>g�je��|C���������Lc�`4�*����D���$��]��_�8�d7����p�1�����B2�Qgs*� QMRZ2�t.�<{� {����y����*{7p��V�d}�4�� :�G{���)w�cr�pm�7�m#n���"��eFN]�m�1ӡ�����u�Cz�����$�W����U 载ܺ%P�@=�z��dy!A���;r�R� ��w�~� �'�n�a��?�dd�9@Ⱦ�ҋp���o>����^ӄ�-2�z�z5��ɭk��a!Q����&��Cv }ǜ����* WFu��%��˛l���w���� �E ������E"���>Wa^���F������7;(n���J�j�-�^�e�������.p�**sF�G�GSs�?\ @��ש������6}G�u�5n�>���t��cI�л������{1�� �o�o���J�=�������@ �l��Z,��N������]�X��~𤃥df�QWq���=�r�ZP� �b8�0CvB,U� ���Wf3&�<�n�`If<E�q�?\��]���ǽ�f'5[I��P7e�V��Ca��t���g���h�^�}���#|��a'pﺡ�"�.�kܑ�d��Q?S��A�`R$M�Lp� �(ظ���3?������5��C&�d6GA"��_5,��h.�B���E �` ����{n�Ae�ANE�Nx��%jB�*z+��e�9[vt��KI�MQ=Q������S���"~z�)�\�?���ȑ��<�R�2�����6��~Ն^�:.�2&���z�l f�l�GQ�vw�4�ƴ���|�ղr->���4 ���u���[{\!���z�u��J�Ǝ,`��[\7w:2p��F��u�6'��%��;���j�� ��oA�X��w��h�b���Rp�؆�m��? E���C�vRrR�;���B|��g�ġ`<#�� ���Į�J���z����e��M=�����w�]kW4�r��J���o�[s��� �(����!A������eR�ɲ��yO�i�K^d�3�C�P��7� OVqUd��� �0�oX��`P�E� �Ƭ!^� %�[�\Q���D-��݈�8�� �f_�B��1��%�q4��" h�WruBOLX�&�s�r6��<�P�*���n�:%~�+f�̐��$u%J�Z��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ