Extended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
e0ecdc89d0571a8611271d9d0496a24d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e0ecdc89d0571a8611271d9d0496a24d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
iSupdate.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
iSupdate.exe
Resource
win10v2004-20240802-en
Target
e0ecdc89d0571a8611271d9d0496a24d_JaffaCakes118
Size
302KB
MD5
e0ecdc89d0571a8611271d9d0496a24d
SHA1
ce7da48f5d9862650b936dac8d3bd86d58c0bbc1
SHA256
231e64aec4f124d397366f4d3b4c2ed06d0919639eac2beef768e4b4db6f18aa
SHA512
2e9caa834292bf65a3d64ebcd4527dce3eb38a5bb718a233f7f71be55ffada5937d27ef0bec4c0f9893136f493bddd391ed89f8aa0a478b98b1ce00c7bcaae12
SSDEEP
6144:xsmPvmtOkhU5mCu25kdiWDjmvCDuQgI9F8NgJmndiOM7W7g3BaYh:7mPrCuNjOmhmNgAnMJyg3BR
Checks for missing Authenticode signature.
resource |
---|
unpack001/$PLUGINSDIR/InstallOptions.dll |
resource | yara_rule |
---|---|
sample | nsis_installer_1 |
sample | nsis_installer_2 |
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc
MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect
SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject
SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA
GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError
CoTaskMemFree
dialog
initDialog
show
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
getservbyport
gethostbyaddr
getservbyname
inet_ntoa
select
__WSAFDIsSet
getsockopt
ntohs
getsockname
ioctlsocket
accept
inet_addr
send
setsockopt
htonl
bind
listen
socket
gethostbyname
htons
connect
closesocket
WSASetLastError
WSAStartup
WSAGetLastError
recv
WSACleanup
TransparentBlt
ord567
ord324
ord2302
ord6199
ord6877
ord939
ord4160
ord2863
ord4710
ord2379
ord755
ord470
ord4376
ord4224
ord4202
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord815
ord561
ord2086
ord4277
ord926
ord1134
ord609
ord795
ord2725
ord6215
ord2642
ord4123
ord2575
ord4396
ord3574
ord3721
ord1146
ord1168
ord641
ord6378
ord4287
ord4299
ord1768
ord6880
ord5981
ord2860
ord3571
ord3626
ord2414
ord640
ord1641
ord5785
ord1640
ord323
ord2859
ord2652
ord3092
ord1669
ord6876
ord3874
ord940
ord3619
ord3742
ord4275
ord6379
ord2754
ord3693
ord4133
ord4297
ord5788
ord472
ord5789
ord5875
ord6172
ord2864
ord1233
ord703
ord404
ord665
ord1979
ord5186
ord354
ord603
ord273
ord275
ord2556
ord816
ord3908
ord562
ord5450
ord6394
ord5440
ord6383
ord3698
ord765
ord3706
ord5781
ord2971
ord5759
ord6192
ord5756
ord6186
ord4330
ord6189
ord6021
ord5873
ord5794
ord5678
ord5736
ord5579
ord5571
ord6061
ord5864
ord3596
ord6194
ord818
ord656
ord3610
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord3402
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord4078
ord6055
ord3597
ord4425
ord5280
ord1775
ord6052
ord2514
ord4998
ord4853
ord5265
ord4234
ord1085
ord268
ord2915
ord1567
ord5572
ord3790
ord3663
ord6663
ord823
ord859
ord1105
ord860
ord6282
ord6283
ord2764
ord6648
ord2763
ord4129
ord858
ord4278
ord5683
ord5710
ord924
ord922
ord537
ord540
ord2614
ord941
ord2818
ord535
ord800
ord825
ord1576
ord6197
strtok
printf
_strnicmp
malloc
free
_snprintf
_mbsrchr
strncmp
strerror
getenv
gmtime
_beginthreadex
_errno
fputs
fgets
memchr
_isctype
__mb_cur_max
_pctype
tolower
sscanf
strtoul
_stati64
_iob
fread
calloc
_ftol
atol
realloc
_controlfp
abs
rand
srand
time
memmove
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
strncpy
strstr
strtol
sprintf
memset
_stat
_mbsicmp
atof
memcmp
strlen
??0exception@@QAE@ABV0@@Z
_CxxThrowException
fwrite
fseek
fgetc
fputc
fopen
strcpy
strrchr
strcat
atoi
vsprintf
mbstowcs
memcpy
__CxxFrameHandler
fflush
fclose
strchr
_sys_nerr
wcslen
_setmbcp
_strdup
_stricmp
_mbscmp
WritePrivateProfileSectionA
GetLastError
DeleteFileA
Sleep
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnterCriticalSection
OutputDebugStringW
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
CopyFileA
GetCurrentProcessId
WaitForSingleObject
WritePrivateProfileStringA
MapViewOfFile
CreateFileMappingA
GetTickCount
TerminateThread
CreateThread
GetTempPathA
GetVersionExA
WinExec
GetSystemDirectoryA
IsDBCSLeadByte
InterlockedIncrement
InterlockedDecrement
LocalFree
SetThreadPriority
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
LoadResource
SizeofResource
FindResourceA
OpenProcess
OpenEventA
SetEvent
GetModuleHandleA
GetStartupInfoA
WritePrivateProfileStructA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetPrivateProfileStructA
GetPrivateProfileSectionNamesA
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
GetFileAttributesA
SleepEx
SetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
ReleaseMutex
GetExitCodeThread
WaitForMultipleObjects
CreateEventA
CreateMutexA
DuplicateHandle
ExpandEnvironmentStringsA
FormatMessageA
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
CreateDirectoryA
CreateProcessA
lstrlenA
DrawTextA
TabbedTextOutA
GetSysColor
WindowFromDC
FillRect
LoadCursorA
SetCursor
wsprintfA
BringWindowToTop
KillTimer
LoadBitmapA
GetDC
ReleaseDC
SetTimer
SetWindowPos
LoadIconA
PostMessageA
PeekMessageA
TranslateMessage
DispatchMessageA
UpdateWindow
RegisterWindowMessageA
GetTopWindow
IsWindowVisible
IsWindow
RedrawWindow
GrayStringA
MessageBoxA
EnableWindow
SendMessageA
AppendMenuA
InvalidateRect
GetWindow
RemovePropA
GetPropA
SetPropA
ScreenToClient
GetWindowRect
GetWindowLongA
GetParent
IsIconic
GetSystemMetrics
GetClientRect
DrawIcon
GetSystemMenu
CreateRectRgn
SelectObject
SetBkColor
SetTextColor
CreateSolidBrush
TextOutA
MoveToEx
LineTo
DeleteDC
GetDeviceCaps
SelectPalette
RealizePalette
GetDIBits
CreateFontIndirectA
CreateFontA
GetStockObject
GetMapMode
DPtoLP
Escape
ExtTextOutA
RectVisible
GetTextExtentPoint32A
CreateCompatibleDC
CreateCompatibleBitmap
StretchBlt
GetObjectA
BitBlt
LPtoDP
DeleteObject
PtVisible
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
ShellExecuteA
SHFileOperationA
OleInitialize
CoCreateInstance
OleUninitialize
ord251
SysAllocString
SafeArrayGetUBound
SafeArrayGetLBound
VariantCopy
SafeArrayGetDim
CreateErrorInfo
VariantChangeType
SetErrorInfo
GetErrorInfo
VariantInit
SysStringByteLen
SafeArrayUnaccessData
SafeArrayAccessData
VariantClear
SysStringLen
SysFreeString
SysAllocStringByteLen
SafeArrayGetElemsize
PathFileExistsA
??0logic_error@std@@QAE@ABV01@@Z
??0out_of_range@std@@QAE@ABV01@@Z
??1out_of_range@std@@UAE@XZ
??1logic_error@std@@UAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??_7out_of_range@std@@6B@
??0logic_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@JW4seekdir@ios_base@2@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
EnumProcessModules
GetModuleFileNameExA
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ