Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
fd615733e7bb7ddc1f077582e3ef59ce_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
fd615733e7bb7ddc1f077582e3ef59ce_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
fd615733e7bb7ddc1f077582e3ef59ce_JaffaCakes118
Size
1.7MB
MD5
fd615733e7bb7ddc1f077582e3ef59ce
SHA1
b44bae515242228185a69fbd25a70aa68791bbf9
SHA256
a5bf6e9ee30611f2ad0ea7ad2246b9aa354074796406f9360375df0b4cc10d54
SHA512
c9571d0fce5173cf03b52efd174d1cf2d48c173ca7b73374c3fd5a85be29f1560b13cb042a19abf3bf6b4404974a31c53fd51e7f5776539ae067da48f61df794
SSDEEP
24576:g05LPRciRgaczBTYR3feW5yY0qraXmLLkoWqTaTUJbKCyiSCyiSCyiSCL7rLSOQE:F5Lp2Bw3feW53aXUo1qTakXVhG4
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
F:\branches\5.4.1\Rhino\Safe\Bin\Win32\release\pdb\NetFlow.pdb
GetProcessImageFileNameW
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
WSAStartup
inet_ntoa
WSACleanup
gethostbyname
IcmpSendEcho2
IcmpCreateFile
IcmpCloseHandle
ResumeThread
GetTickCount
GetLastError
WaitForSingleObject
WaitForMultipleObjects
InterlockedIncrement
InterlockedDecrement
HeapFree
GetProcessHeap
GetModuleFileNameW
GetCurrentProcessId
SetFilePointer
WriteFile
CreateFileW
SetEvent
GetCurrentThreadId
CloseHandle
GetUserDefaultLangID
FreeLibrary
HeapAlloc
GetCurrentProcess
GetModuleHandleW
OpenProcess
LoadLibraryW
GetProcAddress
LocalFree
GetEnvironmentVariableW
VirtualQuery
GetLogicalDriveStringsW
QueryDosDeviceW
CreateMutexW
GetModuleHandleExW
ReleaseMutex
Sleep
ResetEvent
CreateEventW
OpenEventW
FindFirstFileW
GetLongPathNameW
GetFileAttributesExW
GetShortPathNameW
GetLocalTime
TerminateProcess
WideCharToMultiByte
GetACP
MultiByteToWideChar
lstrlenW
SystemTimeToFileTime
InterlockedExchange
TryEnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
LoadLibraryExW
SearchPathW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
OpenMutexW
GetDriveTypeW
FindResourceW
LoadResource
GetVersionExW
LockResource
GetSystemInfo
lstrcmpiW
ExpandEnvironmentStringsW
GetDiskFreeSpaceW
GetVolumeInformationW
GlobalAlloc
GlobalFree
GetFullPathNameW
GetTempFileNameW
MoveFileExW
CreateDirectoryW
SetFileTime
GetSystemDirectoryW
CopyFileW
GetFileAttributesW
GetTempPathW
GetCurrentDirectoryW
MoveFileW
SetCurrentDirectoryW
RemoveDirectoryW
GetWindowsDirectoryW
DeleteFileW
SetFileAttributesW
FindClose
FindNextFileW
GetFileSize
SetEndOfFile
ReadFile
GetFileTime
SetLastError
FileTimeToDosDateTime
DosDateTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetSystemTime
LocalFileTimeToFileTime
InitializeCriticalSectionAndSpinCount
InterlockedExchangeAdd
RaiseException
DecodePointer
LoadLibraryA
FormatMessageW
lstrcatW
lstrcpyW
GetFileSizeEx
DeviceIoControl
CreateProcessW
GetExitCodeProcess
EncodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
OutputDebugStringW
FreeSid
SetEntriesInAclW
AllocateAndInitializeSid
LookupPrivilegeValueW
SetNamedSecurityInfoW
GetTokenInformation
OpenProcessToken
LookupPrivilegeNameW
AdjustTokenPrivileges
?rdstate@ios_base@std@@QBEHXZ
??Bios_base@std@@QBE_NXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?_Getname@_Locinfo@std@@QBEPBDXZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@HPBD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
_Inf
_Nan
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?good@ios_base@std@@QBE_NXZ
?fail@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
?_C_str@?$_Yarn@D@std@@QBEPBDXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?setf@ios_base@std@@QAEHHH@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?global@locale@std@@SA?AV12@ABV12@@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z
?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z
?uncaught_exception@std@@YA_NXZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xruntime_error@std@@YAXPBD@Z
?_BADOFF@std@@3_JB
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
??0_Container_base12@std@@QAE@XZ
??1_Container_base12@std@@QAE@XZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
?_Orphan_all@_Container_base0@std@@QAEXXZ
??0id@locale@std@@QAE@I@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??7ios_base@std@@QBE_NXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setf@ios_base@std@@QAEHH@Z
_except_handler4_common
__CxxFrameHandler3
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
__clean_type_info_names_internal
_initterm_e
_initterm
_malloc_crt
_amsg_exit
__CppXcptFilter
??1type_info@@UAE@XZ
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
_wcsicmp
wcsncpy
swscanf_s
sscanf
?terminate@@YAXXZ
toupper
tolower
memchr
strchr
_splitpath_s
_stricmp
calloc
_localtime64
_mktime64
_vswprintf_c_l
_wtoi
_lock_file
setvbuf
fsetpos
fgetc
fflush
_fseeki64
fgetpos
strstr
ungetc
_unlock_file
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
_except1
_errno
_wcsnicmp
_time64
srand
rand
_beginthreadex
towupper
_vsnwprintf
towlower
wcschr
fclose
fseek
ftell
fwrite
fread
rewind
_wfopen_s
realloc
wcsrchr
malloc
free
atoi
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
??_V@YAXPAX@Z
vsprintf_s
localeconv
__iob_func
memcpy_s
??2@YAPAXI@Z
_hypot
??3@YAXPAX@Z
_purecall
memmove
fprintf
sprintf
_dtest
strpbrk
memcpy
memset
_recalloc
memmove_s
_CxxThrowException
__RTDynamicCast
wcsstr
fputc
abort
modf
sprintf_s
UnregisterClassW
RCVBusGetModuleCount
RCVBusQueryModule
RCVBusReleaseModule
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ