Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
a445d0bfafe5947492e4044cb49eda13_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a445d0bfafe5947492e4044cb49eda13_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
a445d0bfafe5947492e4044cb49eda13_JaffaCakes118
Size
1017KB
MD5
a445d0bfafe5947492e4044cb49eda13
SHA1
5d5ea7ea215944a8fef0f717dece637cf44e6bad
SHA256
fb6e4912fca91d99a9747ad2c68ee82da60f787984fadf77aaab40dac7bed3eb
SHA512
b5cd533a14d708d02facfc3dd592ad3b0234b27b4826a2a50f668ee6ab9cb5c1228ffbc4dbe924b4f666d536fe92527e48a1c3c9d3863ec51ac9843f2d74a544
SSDEEP
24576:HVscxqnLKQzS7WF20PGhbPhrz5TioyApZ4SOWr:H9lQzQ7lppThyAphOWr
resource | yara_rule |
---|---|
sample | upx |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetVersionExA
Thread32Next
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
PostMessageA
GetSystemPaletteEntries
RegQueryValueExA
CommandLineToArgvW
CoCreateInstance
WSAGetLastError
PathMatchSpecA
DnsFlushResolverCache
LsaGetLogonSessionData
GetModuleBaseNameA
NetUserDel
capGetDriverDescriptionA
WTSFreeMemory
CreateEnvironmentBlock
VerQueryValueA
Install
LoadPerfCounterTextStringsW
PerfectWorld
ProxyDll
ServiceMain
UnloadPerfCounterTextStringsW
ncProxyXll
yS��8c����ӂ�>rli�g��L`��d�|�_,�Z���=Ϳx8�3�'�5_�;�o_�!����/f��nT�IN�B&����={*�����ú91j�Y�c`��m�;e��ʏ��-�w({.�Mu�>$�#Eј��)��0��J��Ӑ~�XW�*|�f�s�v�\�2���p���X3E���x3� ����8є��nh���j �I�`�(���Ʉѥr�tw��K_���"z�����9��+5�*�I�j�N�Ou�?t��]S���L!�iQu]k���t\�\�e�k.^*����ni|I`��X���]@^ߙ�#�Xծ �9�%����Q�:?��U��G��ݐ�/L�1]�������K�!8���*uI�i�����C G�'A�GZ��-KP,^;��>ʄxq�J�[���g�:��Pd�O����}�ߨ��K���.Ԝ+ś���!�gu��FL9�q��o�s~�qj�7����Κdl�Fؼ��#O��:E���bA��mdg�=ƄDd#�,/S���"أʌ�����-d���4�ֻ�|,�d��/�>TV1ST�kv����%�"�AB��n+E���W�Lz��B��Q�T�G �-#�ZzF���oj+p؋����O�O�~�� ��^�~����\�-��D�>;%���DES�`m��Z7z)��3w��)l�8�jX��{K���Y����]�S�5�\n����^un�T�<�c� ��{����h����Y�7� i��`�a�M�� S'�ޏt,=[K1�8`�?C�V�_�U:F�ϑ�~6`�M�����H�L�����MA"����p)��_��sv�YM���L5<8������E�Д�Y4�J���G��*�B_����)`E��-c���UrM�2-o��2m͏�����%������`݊����-�a�p&?�tJ ��3d�=*B��|�/v��R��;�4�2�Ge��'^|:�m�H�t�͍6�.��A���e#��"E���8�q�����A���Y�x���we�A=1[0 h5m�Ak�_���e�ye�T�_��,����K��<t��.ț}���W��H�����}�k�JmCLt*��M ��r+k�k���Rg�n{�U�I�Y�8.�]�N;���؉�P1s�ҕv���@��h��29|#�T���y����a�JA�z>M rp�X�0�J|;���,�E[�|����S�Uw�����gӡ͙�'���k�\��}_���7��j�T�������(����u���*�'��na�����$��>Xz�r�.5�W�*�$��?�V�����J�&k��NN�`�ܣ�1�� �2� ��Hà�P������N���[������� �XTY����ܰ(y�L�<�X�B��A�q����ށ�#�_���_ǔ0�����$YϺ�q�&,��3o�&�4#-r��L}�7������iU�Z<�ӹo��-r�yt'6������Fa�o��EH�����p�}X�*�{)�������K܌�+`\r���;��+�h���N@e���Ms}�#,��#�5��a�9����I�T��a�QI9�\(��1JԶ���<`�-@�wi8����F��3@,ɗ��G �(}4��g��f���3�}�Hr�7�:!z�忮�~�%-�{��� ޥK�hY����_͍���Q���SY.$'���,������uX��go�-�,�i��we�k�9�=֢���!�5��d� y�G۩7��ӷ���)��V^9(ɡ��r���b.���4����l�u�����M�˳�w�a&Zf�����P�ZJ;յ��;d�5�w���\Tj�U���x��qX�����&�d8��O(���&����/�{A3�egr�����R�>���[0Q�T��`Z( y£'@8��^r�GiB.Px69���0��v����Q/������_o����zD� ��zV��41�����F$�2q�9�ċ&���4��������ɜ�脬̲+�����}Qg��d�|V+]��3x<�l���^��'��6����掮�C�XWD�!c�7rA�3�g9<��\]hꥊL1�/����t��m���'��b�L/v`��-�6������W�p�i���*������_��Q�/?��Xl��mc� #K��Ĩ���~�_�Cf̵���D~�]�_^ݙ�X=|��ƅ�8��� ��3mbƮ��O*�C�@BGYWQ�ܜ�w���c��f�����_c�b{�5���2 � ��k[hw�� n��}5�?��@1�|��UN��e$-[م�,Q�}P�Iz���_{2��eit�Wo�����|H�gW8��O����2�����*K�?��]l ��F�z�s����f9?��T�K���(E���6� ����Ŝ�@q�G�@^N?-���g'�[z�%�#��]1#7���R�c���~�z�`���Փ2��gb�2����介�4���D�� ��6���Sh�����'��J�[�4C� A>x]z���Bl��a�gkt3��0��A�'��/�o�_�����Gn�B0�f�d��� �d���zBk�BG+��(x���xIH�r�.{H�\o��'ل����� ���K� ? ʹ��Id:z��w�yguu�h���q��Op� ��?�gB]}���|����\��yR�x i���@]dr7�����]�ϭ���%;�&�a�)��>�sP�?��E��;�l���&��l` X���eo"B��3.�l��Kgp���6���e>Z4��������g�Mf�v��noql���pOx�>�@.0�Z�U�oD�$��Ӵ@i�1K1w��?�~0��Ԍ���j��: }KL�D<�� @Uz����۽sz&"��g���[��+�9bW7�y��$Sz��c�z7�ڏ��g��U\���<��$ �5� �%��"B=0�����I��t�VT�E���EH���F�c�TGU"��#T? ���@�d��-�UP����s(G�K��a��5��p�ׅ��J�����k��U /���g
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ