Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
Static task
static1
Behavioral task
behavioral1
Sample
ba8861e8c02a218c7a16b229ced4508c_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ba8861e8c02a218c7a16b229ced4508c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Target
ba8861e8c02a218c7a16b229ced4508c_JaffaCakes118
Size
337KB
MD5
ba8861e8c02a218c7a16b229ced4508c
SHA1
01128bd9c97fadc954b0310047dfd68a8615b576
SHA256
bfb1d3de3a074c944a128582c42609df3d0854e8d8b4a48f6aa4fa922f89e507
SHA512
3a3362c234bb981a7a31f6bc3788210bb19111a519f80470307d82c8535af201ef32424f529ed763ba05aa56f8e30d7836230f7b695e33ca1318e51115b9add5
SSDEEP
6144:LVH6VJ9uki228oCkO+3hkfo22W4sNe6lvjTBA6WKwN3iOtkb33hL:LA5Urj3hv22Wfe6lvjTe6Wz3sb3RL
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
f:\qqpcmgr_proj\QQPCMgr_Trojan\qqpcmgr_proj\Basic\Output\BinFinal\QQPCUpdateAVLib.pdb
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
ntohl
htonl
ntohs
htons
?ValidateBugReport@TXBugReport@@YAXXZ
?InitBugReport@TXBugReport@@YAXPB_W000GGKHHKKP6GHPAUtagBugReportInfo@1@PBD200PAPAXPAKPAX@Z@Z
??0Big@@QAE@XZ
??4Big@@QAEAAV0@ABV0@@Z
??1Big@@QAE@XZ
?from_binary@@YA?AVBig@@HPAD@Z
??1CEcdsa@@QAE@XZ
??0CEcdsa@@QAE@W4ECCBIT@eccparam@@@Z
?Verify@CEcdsa@@QAE_NABUCPublicKey@@ABVBig@@ABUCSignature@@@Z
?SetBugReportUin@TXBugReport@@YAXKPB_W@Z
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetFileAttributesW
MoveFileExW
OpenProcess
GetModuleFileNameW
GetProcAddress
GetLastError
GetLocalTime
ScrollConsoleScreenBufferW
FillConsoleOutputCharacterW
WriteConsoleW
WriteConsoleInputW
WaitForSingleObject
FreeConsole
FlushConsoleInputBuffer
ReadConsoleInputW
UnhandledExceptionFilter
SetThreadPriority
AllocConsole
WideCharToMultiByte
SetConsoleCtrlHandler
MultiByteToWideChar
SetConsoleTitleW
ResumeThread
Sleep
GetStdHandle
SetConsoleCursorPosition
GetConsoleScreenBufferInfo
FreeLibrary
CreateProcessW
CreateFileW
ReadFile
CreateMutexW
GetFileSize
SetFilePointer
CreateEventW
ResetEvent
SetEvent
ReleaseMutex
FindClose
GetTempPathW
GetWindowsDirectoryW
GetFullPathNameW
FindFirstFileW
lstrlenW
SetLastError
OpenFileMappingW
UnmapViewOfFile
CloseHandle
CreateFileA
WriteFile
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
CreateDirectoryW
SetEndOfFile
GetProcessHeap
HeapAlloc
IsBadReadPtr
HeapFree
GetTickCount
TerminateThread
WaitForMultipleObjects
DeleteFileW
GetExitCodeProcess
InterlockedCompareExchange
SwitchToThread
VirtualQuery
InterlockedExchange
lstrcmpiW
GetModuleHandleW
lstrcpynW
GetCurrentProcessId
ProcessIdToSessionId
InterlockedExchangeAdd
lstrlenA
GetCurrentThreadId
QueueUserAPC
WaitNamedPipeW
SetNamedPipeHandleState
CreateNamedPipeW
ConnectNamedPipe
GetOverlappedResult
GetSystemInfo
FormatMessageW
GetVersionExW
GetCurrentDirectoryW
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLocaleInfoW
GetNumberFormatW
GetCurrencyFormatW
GetDateFormatW
GetTimeFormatW
GetLocaleInfoA
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
MapViewOfFile
OpenEventW
GetSystemDefaultLangID
LoadLibraryA
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
GetThreadLocale
GetACP
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
RaiseException
LoadLibraryW
GetCurrentProcess
SizeofResource
FindResourceW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
FindResourceExW
InterlockedDecrement
GetCommandLineW
LoadResource
InterlockedIncrement
LockResource
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
CreateDirectoryA
SendMessageTimeoutW
FindWindowA
RedrawWindow
RemoveMenu
MoveWindow
SendMessageW
DefWindowProcW
UpdateWindow
PostQuitMessage
ShowWindow
DestroyWindow
GetMessageW
PostMessageW
IsWindow
UnregisterClassA
GetSystemMenu
TranslateMessage
DispatchMessageW
FindWindowW
KillTimer
SetTimer
RegisterClassExW
CreateWindowExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegOpenKeyExW
ChangeServiceConfigW
QueryServiceConfigW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegQueryValueExW
RegCloseKey
ShellExecuteExW
SHCreateDirectoryExW
CommandLineToArgvW
SHGetSpecialFolderPathW
PathFileExistsW
StrFromTimeIntervalW
StrFormatKBSizeW
PathAppendW
PathRemoveFileSpecW
StrFormatByteSizeW
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@_W@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?find_first_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?length@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?data@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?freeze@strstreambuf@std@@QAEX_N@Z
??1strstreambuf@std@@UAE@XZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
??0strstreambuf@std@@QAE@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
?ends@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
ImmDisableIME
_CxxThrowException
wcstol
strchr
putchar
putwchar
strncpy_s
_snprintf_s
strrchr
_memicmp
setlocale
_wsplitpath_s
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
_controlfp_s
_invoke_watson
__CxxFrameHandler3
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_set_invalid_parameter_handler
??3@YAXPAX@Z
memmove_s
wcslen
memcpy_s
_wtol
wcscmp
??2@YAPAXI@Z
??_V@YAXPAX@Z
_vscwprintf
wcsstr
memcpy
vswprintf_s
wcsrchr
_wtoi64
??0exception@std@@QAE@ABQBD@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
?what@exception@std@@UBEPBDXZ
memset
??0exception@std@@QAE@ABV01@@Z
_localtime64_s
??1exception@std@@UAE@XZ
vsprintf_s
_wfopen
_beginthreadex
fwrite
fflush
fclose
_snwprintf
_vsnwprintf_s
printf
_vscprintf
_time64
_purecall
strlen
memcmp
wcscpy_s
malloc
free
_vsnprintf
_ftelli64
_fseeki64
fopen
fread
ferror
_wsplitpath
_wcsupr_s
memmove
realloc
wcsncpy_s
wcschr
_wcsicmp
swscanf_s
_wcsupr
wcsncpy
ldiv
EnumProcessModules
GetModuleBaseNameW
EnumProcesses
GetModuleFileNameExW
InternetConnectW
InternetCrackUrlW
InternetQueryOptionW
HttpAddRequestHeadersW
HttpSendRequestW
InternetReadFileExA
InternetCloseHandle
HttpOpenRequestW
InternetSetStatusCallbackW
InternetOpenW
HttpQueryInfoW
InternetSetOptionW
??4_Init_locks@std@@QAEAAV01@ABV01@@Z
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ