Extended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
program files (x86)/Mozilla Firefox/gkmedias.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
program files (x86)/Mozilla Firefox/gkmedias.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
program files (x86)/Mozilla Firefox/mozglue.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
program files (x86)/Mozilla Firefox/mozglue.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
programdata/Microsoft/Windows/DRM/A3A0.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
programdata/Microsoft/Windows/DRM/A3A0.exe
Resource
win10v2004-20240802-en
Target
bb22ff267213c3f2b465e6830519a6de_JaffaCakes118
Size
359KB
MD5
bb22ff267213c3f2b465e6830519a6de
SHA1
eab4d9d865bc4465840ed5b33dccba6447805eae
SHA256
d23586553af089bf3b75d015d1bce8d7d21cd07d3e9e590b54ab032e28ba0cd1
SHA512
fe7e8d4e8a2d7b7cd953d2fa02a277c1533255b2016d6f0ed82dddfbaa3fecd1ce06e666b0bdf2c002c74a30d57346a67d6b97ab71129e01fa8cd66f38ab93d7
SSDEEP
6144:DO92yDxBiEDdKL/Ejehxl6zq/YJjdHagXaq1hKz5Hzp4jKwr7SnMUkKUBuw5:a922xvQLMihxl6zWejdHagfOz4KZnMUQ
Checks for missing Authenticode signature.
resource |
---|
unpack001/programdata/Microsoft/Windows/DRM/A3A0.tmp |
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
e:\builds\moz2_slave\rel-m-rel-w32-bld\build\obj-firefox\layout\media\gkmedias.pdb
moz_xrealloc
moz_free
moz_xmalloc
?mozilla_Throw@std@@YAXABVexception@stdext@@@Z
PR_SetThreadPrivate
PR_NewThreadPrivateIndex
PR_GetThreadPrivate
CloseHandle
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
GetProcAddress
GetSystemInfo
GetModuleHandleA
WaitForSingleObject
Sleep
CreateSemaphoreA
ReleaseSemaphore
InterlockedExchange
EnterCriticalSection
DeleteCriticalSection
HeapAlloc
HeapFree
SetEvent
GetProcessHeap
InitializeCriticalSection
CreateEventA
LeaveCriticalSection
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
waveOutClose
waveOutGetPosition
waveOutPause
waveOutWrite
waveOutPrepareHeader
waveOutOpen
waveOutUnprepareHeader
waveOutReset
waveOutRestart
ntohl
htonl
htons
ntohs
_purecall
_setjmp3
__iob_func
strncpy
isalnum
atoi
sprintf
printf
strtol
getenv
_beginthreadex
longjmp
rand
fprintf
abort
strcmp
ldexp
pow
exit
atan
fabs
exp
qsort
sqrt
toupper
strcpy
strlen
memmove
_initterm
_initterm_e
sin
floor
memset
log
_amsg_exit
_adjust_fdiv
cos
abs
memchr
memcmp
strchr
memmove_s
_invalid_parameter_noinfo
memcpy
__CppXcptFilter
?terminate@@YAXXZ
modf
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_atof_l
_create_locale
_free_locale
fwrite
_errno
_vsnprintf
_encode_pointer
_malloc_crt
_decode_pointer
_encoded_null
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADH@Z
?_Xsgetn_s@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADIH@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPBDH@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PADH@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_BADOFF@std@@3JB
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?_Copy_s@?$char_traits@D@std@@SAPADPADIPBDI@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?_Xlen@_String_base@std@@SAXXZ
?length@?$char_traits@D@std@@SAIPBD@Z
?compare@?$char_traits@D@std@@SAHPBD0I@Z
?_Xran@_String_base@std@@SAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
realloc
calloc
malloc
free
frex
?Process@ots@@YA_NPAVOTSStream@1@PBEI_N@Z
ShCompile
ShConstructCompiler
ShDestruct
ShFinalize
ShGetInfo
ShGetInfoLog
ShGetObjectCode
ShInitialize
nestegg_destroy
nestegg_duration
nestegg_free_packet
nestegg_init
nestegg_packet_count
nestegg_packet_data
nestegg_packet_track
nestegg_packet_tstamp
nestegg_read_packet
nestegg_track_audio_params
nestegg_track_codec_data
nestegg_track_codec_data_count
nestegg_track_codec_id
nestegg_track_count
nestegg_track_seek
nestegg_track_type
nestegg_track_video_params
nestegg_tstamp_scale
ogg_page_bos
ogg_page_granulepos
ogg_page_serialno
ogg_stream_check
ogg_stream_clear
ogg_stream_init
ogg_stream_packetout
ogg_stream_pagein
ogg_stream_reset
ogg_sync_buffer
ogg_sync_clear
ogg_sync_init
ogg_sync_pageseek
ogg_sync_reset
ogg_sync_wrote
sa_stream_create_pcm
sa_stream_destroy
sa_stream_drain
sa_stream_get_min_write
sa_stream_get_position
sa_stream_get_write_size
sa_stream_open
sa_stream_pause
sa_stream_resume
sa_stream_write
th_comment_clear
th_comment_init
th_decode_alloc
th_decode_free
th_decode_headerin
th_decode_packetin
th_decode_ycbcr_out
th_granule_frame
th_info_clear
th_info_init
th_packet_isheader
th_packet_iskeyframe
th_setup_free
vorbis_block_clear
vorbis_block_init
vorbis_comment_clear
vorbis_comment_init
vorbis_dsp_clear
vorbis_info_clear
vorbis_info_init
vorbis_packet_blocksize
vorbis_synthesis
vorbis_synthesis_blockin
vorbis_synthesis_headerin
vorbis_synthesis_init
vorbis_synthesis_pcmout
vorbis_synthesis_read
vorbis_synthesis_restart
vpx_codec_dec_init_ver
vpx_codec_decode
vpx_codec_destroy
vpx_codec_get_frame
vpx_codec_peek_stream_info
vpx_codec_vp8_dx
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
e:\builds\moz2_slave\rel-m-rel-w32-bld\build\obj-firefox\mozglue\build\mozglue.pdb
GetEnvironmentVariableA
VirtualAlloc
EnterCriticalSection
DisableThreadLibraryCalls
TlsGetValue
GetSystemInfo
TlsAlloc
VirtualFree
TlsSetValue
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
_encoded_null
free
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_malloc_crt
_encode_pointer
wcslen
_errno
wcsncpy
_write
strlen
memcpy
abort
memset
strncpy
_decode_pointer
_recalloc
_strdup
_wcsdup
calloc
free
frex
je_malloc_usable_size_in_advance
jemalloc_stats
malloc
malloc_usable_size
memalign
posix_memalign
realloc
strdup
strndup
valloc
wcsdup
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
GetModuleHandleA
GetProcAddress
memset
StrStrIA
ShellExecuteExW
CoGetObject
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE