Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
d73d232a9ae0e948c589148b061ccf03_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
d73d232a9ae0e948c589148b061ccf03_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
d73d232a9ae0e948c589148b061ccf03_JaffaCakes118
Size
992KB
MD5
d73d232a9ae0e948c589148b061ccf03
SHA1
476749c900bb43c62f50cb2f448901a589d56aac
SHA256
830d48b2c6de780783e697346a6afe96c6e33654d85b71bb86627b88f09f298c
SHA512
642cce570eee883990ab681e5fb92e5b6a5150051c0d1f1c1856ad948158b424c6d45dfddd9972c462de231319dfa4d3c439c4dd25bdb2fb6ab1e295a2e35bdc
SSDEEP
24576:FJGfIRoTJoi9fYCdRthjQwovc2LvxSZpx:FIfIRUthj7zCWx
resource | yara_rule |
---|---|
sample | upx |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetVersionExA
GetConsoleCP
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
GetProcessWindowStation
SelectObject
RegisterServiceCtrlHandlerA
SHFileOperationA
CoInitialize
closesocket
PathFileExistsA
DnsQuery_A
LsaGetLogonSessionData
GetModuleInformation
NetUserDel
WTSQuerySessionInformationA
DestroyEnvironmentBlock
GetFileVersionInfoSizeA
Install
LoadPerfCounterTextStringsW
PerfectWorld
ProxyDll
ServiceMain
UnloadPerfCounterTextStringsW
nxProxyXll
|SؿO>H��*/��l)�B�J�N�(f4,����|��z�s��]��GH��lZ<$�aD/���\��I%Yh�>�g6��-���j�@'�Ң����:�RאUx3]A��T���ܒ�!9�����(%\ PS��^�9T�+��(�ߒ�c�wF��JIyA��� � �� �<0�X���fL� �P���<�*�F��#%<Eq�M���W���6��D�ڲh�!˴KЬ��g*X�V�:��1?�z�#:�Es�jM�#��)�`L�4�w鿸HS̋Q�0�3mK����X�LX��5B�KCpTϏ�K^o����in�!< ���\��o�ҷ^����|@ ����C����ۇu+���pY��3,�|����-��Mc��f�%�*s<�a���P�� QO���`�o�N䥇���;��~�9��p�Գ->y�h��Ş�� 'SbW�wG�A��oXRS�������@u kj��U�Z���y.8��P�MJw���O�<�Z����q���k~Ml��H��nԬ75�%<|��g>+��U���:�E[A�Z�Lpb�U-�0� @��C�upՐ�o,zl �3����.Xiv[X?`�tc��#K&�}J�w���N,ӚHu)�s.�L5_�����V���frt�����J�7^�u��0>��P+�da��/�̮�~w26�P^���ER<�zh��YD�2�_�K�ԍ�?R�|��u��U����.�v�d�����8M�$��H��3�o��R��h+zB��{|#e���9��ծ��rX �Gg��O�,���V����ߺ��}��4�ͳ��������^���X]}jH�H~�U�阘 �]ʒ|����a6) kE�L�6�tb��7�'7�ӝ]�X죺>�F|/x5E]�[�G���`A5�t��T�.��d���q��G�*�)f�Dp�����%���S^B??I�T] n��1CR�d��A���H ��aV�W0.�g �-��Z! R����f5�$ �;����@�<AzN��+�-��Y�}'�������qyD��]!4#����d�7> ������T�dM��U��g��5�|�O,��h1w�c�A�B&�9���g[��I�?'�J�u�Vܦ���G�<�&�)\ʃ����5�i�Hm./�{�}���%��0��6jq�n�l��5g�Lu ��!��%�����;��`1�N�1�F0��^�[ �N�F� h㶚��fMi�m����o�~9�R0춍��D��V�[˳�m �m����?w�RxE8)�Eg`��fRq�Le�]w�pb:'ǩ)��&�~7]v�c�{gl�c[hj��i���Ϩ&-}(kH~�V�����9u��a����=�o6Ee�M���xZ%�M��{�٭�x1gQg�`�mچ����{ʸ�{J�7�����1Q��������rL��ͻS����3�����G�V��&�c ;��*m��Y���U�`�;F��EUN*�����bE�S���dP<�Oz���Ɖ2u����v�:$5��!�8�Jm�%J����mh�m��� e#�ނ/�J4�/����x���&��D�r �a����0������B�+ �u�����o���x��ѧ[k(��10N�ӯF���B�Wy��˗��Ho�^����)��W�h�g.PG�CR�i�>�����3_]���N,�5��@�[D�L}B����Xgx�X�+�����(fQũyue���"Q���v�QR�\V��CK��̔K>3��m��_�����Q�HT��3����&'�z��*�����H���G딝�+E͔P���� c\Q�Nخ�� �W{� u�V�P�X��T��"�w��IP����9|� �xu G��#Ա�C`����K��?u��3F�@���x%H��������\�>*v#5R7,���Z�m�c�7B\ 5^"Є"�������'u;6DR��۪��e�v��-q����L���L @�Î��sӺ��z����N�!]֣��$Î�����_�`��k����[t����8����i��F���3ƍ��q��B8M�k��;��A��HhjG҃f�}� ��S�?�@�O�.���d'��5=�lp�x�͟`��͈�A�M�Q ��.�q����L�9H�ۅ��8��Z�'�������\p�h��;Q2kt��}V�mcI���r��̣�����`%C1�@'Y�H^���U��,��"�AVy���x����H�̨aF� Z��lf�����.p�<s��pD�g�S`�7�{G�$2�2߳|Np�Opw� �A̗��������P�Lβ2,�(K=0�u�Q8*u�d��R��Kԍ�2�oZ�\bn����-�J%�+���6ӣ���_ v:~X�ή*�����+kV�S�����l�4�}�?`��c�q������Z'llQx,8Ww����0K�t��/��,;'%����di[����d5�2OtD��`��a)��i��0%�wޣ�S�[������y�����%��� ��K�8&]V�Ӭ������7-Nqv�@Y��/i� \��+���<���)'����`�c��SvB�RM;�cq�dk���WK���>�c����u�\t Qǿ���21Ls�e�KȌl�VAڝ��ȇ�BƗ �)ڢ&A�!��{'UUy��#�K����]a���JH��G^� �S�ʲ&��>�� ����G�Q���GXK�˾���eU�=� @�K=���R5� ��#{���w�H�p�ƚO���[>�h�H�i��H$�{��*����q�>���\M� �bW)?���W���Z�쉛P�4�F~B�.�����_�|!�KM�:5X�k�\ G}�P�k�����w��2��6 �d��kkL��Y-{`� �!��C|�_#LN[n,�8%0�aBD���t����S�����5�3o��.���~�[�Ky˳8V���=�\����U��?���|��X�h���$��e��i��B��-PȜ��Cj��t@*}��u�Im�f#�]�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ