Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
c17428e3bc98178cf9beb3dca30286cf_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c17428e3bc98178cf9beb3dca30286cf_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
c17428e3bc98178cf9beb3dca30286cf_JaffaCakes118
Size
1.0MB
MD5
c17428e3bc98178cf9beb3dca30286cf
SHA1
46b3a4a6e1e1f1c3c239a47fc1b1a2a0920ddc3b
SHA256
c474a334ee138bcf2be862bca05f0a704701a3a37daa7b4be501d3f1d642f6e5
SHA512
f0cb1da2c74ad672ce7e08e60a8f72068575a4efb32dcb16f7d1432a9f2b6e0e01609653592c0aa3d4c3fa4061fec7c73b4f3d65b01a03f2aee53fca882e28d2
SSDEEP
24576:nN32OV4yMMhSOkCeeaAwsbFnFN2xgG9LDfVsaPnv8lhQKkGuZ:444sSOkCAKLN2aG9L2aHckr
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
EnumProcesses
GetModuleFileNameExA
EnumProcessModules
GetModuleBaseNameA
PathFindFileNameA
ImageRvaToVa
HeapDestroy
SetEndOfFile
GetTickCount
IsBadReadPtr
WideCharToMultiByte
MultiByteToWideChar
CloseHandle
GetCurrentProcess
OutputDebugStringA
OpenProcess
GetProcAddress
GetModuleHandleA
FreeLibrary
LoadLibraryA
ReadFile
WaitForSingleObject
CreateProcessA
GetStartupInfoA
CreatePipe
GetComputerNameA
SystemTimeToFileTime
GetSystemTime
GetProcessTimes
GetCurrentProcessId
GetVersion
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
Module32NextW
Module32FirstW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
CreateFileA
GetSystemDirectoryA
ReleaseMutex
GetLastError
CreateMutexW
QueryPerformanceCounter
Sleep
GetSystemInfo
GlobalMemoryStatus
GlobalMemoryStatusEx
GetVersionExW
VirtualAlloc
HeapSize
VirtualFree
GetTempFileNameW
GetTempPathW
DeleteFileW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
WriteProcessMemory
IsBadStringPtrA
DeviceIoControl
VirtualQuery
TerminateProcess
HeapFree
LocalFree
LocalAlloc
HeapAlloc
GetProcessHeap
ReadProcessMemory
IsBadCodePtr
VirtualProtectEx
VirtualAllocEx
VirtualFreeEx
CopyFileA
HeapReAlloc
SetLastError
GlobalAlloc
GlobalFree
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
CreateFileW
HeapCreate
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
WriteFile
GetCPInfo
VirtualProtect
SetFilePointer
GetConsoleMode
GetConsoleCP
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetCurrentThreadId
GetCommandLineA
RtlUnwind
RaiseException
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetACP
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
GetClassNameA
SetPropA
DefWindowProcW
CallWindowProcW
GetClientRect
IsCharAlphaNumericW
FindWindowW
GetClassNameW
EnumChildWindows
GetPropA
GetWindowThreadProcessId
GetParent
SetWindowLongW
EnumWindows
IsWindowVisible
IsWindowEnabled
GetWindowTextA
GetWindowLongW
PtInRect
MessageBoxW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
gethostname
WSAStartup
FunA
FunB
FunC
FunD
���!����OW��h��JAL�Nv�����:d]��[��+G(�*��t(��ٓ�S���s \ ��ʪ��bˠ�J�π�����Ί�d���r*c&��r�� �uzQ�^_����uV�@�N}an8(m)\�d�&��Y�cZ�S��!���h�����),[�Nd^$Ԗ��{*�G�Y+��aʉ�oN�-�q��s�{(�+R?�"��/Ŏ�vz�/���܌E���0�wyk7�F��@C.��%`�qc����r��{\��o*ˎ�]d8b]C�����IQ��|�Z��Kw��5�͘��������0�x�Ii����]����U+�<#���4h a'e��8�X����<��Y������ߎ&�A�x�,��M�H���g8��n�_V�#��~3]o�20m%es��q�Vz:��j�.MP�Xq��B9��Lv�d^���j�d��i"�%pN0B��D����5��q����?u�#��P�,Cù+�B�kK�Ya��J��ӛ'A��J�~���v����#�7Σ%���F�UI��A�<�FL�4θ:]��l��H�,/~�-��iЎkg~���M3���X�E&��\��~���b �돥�)�ԯ���^Lg�4�ͩ.�����h�$Q9���^�7�ˮ=2��hk����7�@ѱ ��r���|�!1U�j��y6��HHXT�u�*2�~j��R?���@�zJ���[1z4OV��'l� ���Q���j�� ���tjjèXpI��\�����c6C4f�42m���6 k,�Q�?�!����wv=� ��1;�a�����e��[Ѓ�=QՓ��`b_��uzʝ��k�0�6�� 9�5�������T�9�] o�V�H��ʅ��2CBf��d�4zKf�ˏ��7>�JE/��/&zl�[} fu����j͚ ���� �e4���K��/�m�X#�6��� ��d���д����)��&ɱ����u�"ᄰ��jTD|f�I]��gcE{A��1.��c�*�Dd���g��V��@���^糐���e�uZ�D�vU�F_�e}=���@���q�`���c����8�j$<��=L����� /��_���$���c������ǰ��� ���ŗ�j��ʧ�%�V�/=u���7����~˭�`�}S8b���\�=��/`|pz��#�$���A@���d��*���v@�r��T)���S������!A1XL�ꞵ�aM���oʖ�e�҄Ez����dG�ޠKV�Y��c9���%,�&��.�Nm�NgX�_�暔�������;���,��:�������zI���S�(�5����6�(��>��4�*���vs:ď���}�Qy�㔝�+`S G���>��vrV@�"��w�o�lj�W���P��\W��/�J���8/����8�P{9 ���NC��o��z>~,dM�3E=� �$��M��Ѻ���#���J��5`�����yAO�&b<�{� ���V�`��}d���� Y'x�!"� ��Rq=�_�9Aa� �/ ���0�ZRiCT3^5����C��ji=�z �������7���t,�Dq?�UT�������qW��ۈ��XQw�g2��� z�{'����y|��+iK��H"s�\cY�*�7��K#t�u�F?�����t����hX�&nkq�Q�n4�D�B)�u|�(N"*3r�v�E O%�I�,�n�hC���clZ*�H7�w+E���a�[Pxm�\������(5?Ǿ̒��y;Jm�6�@:'�*ǵ8&nZ�]����i���W 'Q�J�Eet�z��;R������v�JXv�$ݻ����lv}5�Ia�.�Ij�㙥+4����7�H�|�<�j}�����]�}��Ew����+q�^�]��DP7ȫ�����D�A ��L��������B#}X����C�J�? 2Rt���xDy@X�E� �"�.s )>d3;�L�������H�k�5l7�fN��L._�g�c�R��Oٞ�~\�A��m*T�\�(�}��]�i/�����#�ξ���}�ڧ�ˢ���������%0^U_���l��d!�N%����T���y1_?�$E%�M�����emRg�6]T�~tj�[�z�S�W�p��#<����v�/�w�.7��/��y;NԊ��M��Y]����s5z�~q��?��!S�MSGV�ʙg�咡��`���-[�kW��S���g�ad��z'xB;���-�<2,w�1D�~[E]s���F��S�F�m��-Ӯ�s�/�l�lf�b���=� i8����3�i����߾z���j��i%����ũ�E�oʎ?F��6�����VK�9��|Rţ%���q�D����s8<d�7���j�مv��-��~�AE&�]N�����[�j%��F�9" ��Ɵ�AӃG[l����$O,���~�l���/_�-�jm4K�:���u�ׇ��%��VuV~�a��= (^]Bڟx� A�vk��/���7 ���؛� c���w7�/��w��pӂ-ۆLj2������?�p�/vOJ��85Ɛ�,�Crŝ��*��T��?�c����#?�����b���<�s����wz�Ntl�$PY0 ���~4*a�� Wf�jH�ϣϩ�bq��#����$ �~ԹU�Xؔw�����۵�u��O�@��pL&I���~k%v'��t¬oU�*�!�N�+��Q���}A���.f)��a��:'&���Q~;���P[T���v���g1��u���2F��i/�Pr�%����]��A��Af�J��3S�w�t�����Ң��Dt|\@�������-�-��+�Ϝ'Xs���A ��u�$���ӱuiK���#t��K�F���fPˋ��dg?�М�A0^����+���B(���B��y@�K�ٰ#�Gp��4DZ� ��;hH���8�����E�J�<,=k���7@��0%�S�P�m)n�/@7�.n�JhDIUKl���ytp�7ti%|5����k�Rhq!��wq��j����9��18�fZ(7S�>1뀑z�ȞT�N����{�@�N`L�kp�w���!J��*�3Ȕjpr��h.?ۮ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ