Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
ff7611be7e3137708a68ea8523093419_JaffaCakes118.dll
Resource
win7-20240708-en
Target
ff7611be7e3137708a68ea8523093419_JaffaCakes118
Size
635KB
MD5
ff7611be7e3137708a68ea8523093419
SHA1
f40ac53550177ce7e81ceea2292ddee0b814e0f6
SHA256
96377dbd06a57e63e8b3c6b18c92beb2b2e87c9aa155ec11bc7f24ec1e5d7699
SHA512
5650045518efe91f64c5aa929074af144a4fc6584aae5495faaf8a965c60a78eb372b1c27411726ff7b268e636087e2aa58c2df085d9d105fe38cca55b34fffa
SSDEEP
12288:p1lSuSZhePyIJVPWn2/LwV0XwXWJqukyj+ZAT8koghgVKCqvVbJFfM67p0VkoIer:pm9GfjJ6ySZAT8koghgVKlVbJlVC+oIg
resource | yara_rule |
---|---|
sample | upx |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetVersionExA
SetEndOfFile
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
PostMessageA
GdiFlush
LookupAccountSidA
CommandLineToArgvW
CoCreateInstance
listen
WTSFreeMemory
PathMatchSpecA
DnsFree
GetAdaptersInfo
LsaGetLogonSessionData
EnumProcessModules
DestroyEnvironmentBlock
GetFileVersionInfoA
�>o��_�E[���h��V ��j��n�h�%���8?�Â�k���XQCVc%�Y~v~<�4�\@܍���ӷ��ƭ������B�Ό�I&��o�LJE�URK�A��Fa��)�Ar�o��$�_��l%i�s�Z��R�@�n��e�й�ϰ����~��]���[��q��B�uin|�gäVM~�m�v���ԐC�q.jk�^�\"��ݣs�-,{���g���ov��d G��>���e]���J={y ����Uy���ε1�&���*��Y�;`6�� �)��{ֹ����1@�s�m�!_��R^I�����h�QQB��N"8�����,��E+���9�)�� @n�D���W�,��֥����ݎr�F�Z_mz���I� �� ��'t���>^ ����-m�yE�i������H�~Y��M�D»�c� �b�)G��4��gyܓ�*#�UnD�@�VV>X,g X�}�����'������x������b�D�l�j0����}������aRP�+�����ߣ�j��������̇֏[�?l��v �_/��o�WkG��ތ=)�&;��8�-m")�N|�iC!��2�N�x�@Kq�!�y�+ϡ��-d����<� ��?���.<�|͎�q�@��$�]7��Z��`�\ܝ������>˴�l�B�C|4-���Wj�zw�`m�߮����4��M�tW-&_ZM�����SD������I�j�Z4���S;�����˄�@�R ����6�� �{d��[�t��m�m�#.(���̊�P��)��k�h�]9�.D2?���,Su@bs�\D�y������>3&3f�)�ܗN�>ʊ��DߢH�U� w�-�Pl��94���CNG��|@�g�4�T���8���l�Į��*T��DHE���k�+b�p�������Jv\���%�?:�3ͼ_�Q���V�$�d�������:��dO��O}96A*��a)?`��^������cJ����#�cAxo� �He�B�m�3�"�e�nj�r�&W@w�L�0�<(Z1k�����)'TB�|��E���e������#�9hk��Di���`���d#�IeGfkr��k�<y�,��C��L�8������r3��� "�f7,�������GU��Է.b϶G��S5Ŗ�1Z��n��&� _�4����~Č.D���oj+�j�3�4�)#���9����J��> C}W�JF�]�Y#N���g,����i��)^��!�/m� �K�������Gm�w0^�^�$�b����C�&S��tP�2*]��6b, ��u}U��M!�,�D5�RZ�ɭ�3)$���&�,A�(&���C�· �F�b#� U��!��J��RF�la���� �z�작Z��`-l���GG��oJ1b��0Ѡ�' �6����rjP9o��<�@�����n����8���4%&��6�����sܻ*sv#��vC���������0�_��XF��cME�����ٿeIu��GsW~lDj5�@����NO�4iq�$c`�����,��b��Ug�L�c�����A�X@�P�����yF�y�o�L���(3���W^���O����P-H��b�A�܍?/�s�P ���c���$ǿ���#�o�� c��.�8U`k$I�f���P�0���5�pq�U`��v�kF �`�����̝Z2�0��`��&���C�oq�Կz��́����j����٧~!�sx��u ]Lb��4��~{|���pTn�<i,9g�uc�� �����:|+�x�E��bG�� ̿�m����|Y����r����p��LH� ��j�ʹ�!x��#���� G�~�쥈pL�~�^���0�'r�V�qV(y8�q`�XJ~n���aN���vHkV�g��F�p/T&IΞ��4s�̾oɇ�V����BҲ�nd5Ru���b6�X�z+������\FVͿ����^�@��Y�ƾ Q��T|����:!���BT��>4��x��z%zO��Q9@��8�A�R`�|T���*S8t�����?k��u-��ڂ�:�c'����H�Mn��P���{�m�a���O�A�'�L�PG����q��BL(+.�Ig+����:i�}P_��� F�e�bM�<�'��=:|gs4�*6=_��O�?0xIt8v��QM��}re��GJ!Yћ��8�s {�P��ظ�1g�YT��5d�����Z�i��#|�^J�FK�d1tn��z%���xZ�SeU����0MO���a�����f�o� �(#5�u�V��_��-e]5�J^�Tg��c�;��5���\ɢ���_ ٞ�Lk�i�ۓ����,a0�b^�x�(6���|I����B�O<�\��Z�8�]�b�xevj˪h�/�R�61���d�\� Ƶ��({f>2N� �Hn �1[�q��U��C��t��H�?�NoG���1)�YupK�� Jt++/�1�`B �6�o����0%��mi�H^.P��o�����Y�Q��6�_�H���Y1|N��C���b֬��b�o�s�<d����������Z%,�bPH1gLf1���nA_�Z�$v���W��\b�Vr�ĥ�������2}�2��$��:J����NJ��n�����"�5��Ѱ�R��^�p�U��/|� ((AVd��C������BxX�F2J�$:#JҷHK=E�CL�r �b��|��1A�K���Uᴥ:��s.���V7R��h�Z���*�������E-�/M��5�4Q�����Ϥ���ro����%*��4~�-�_���ϲeU���\[�_S8PL���"5� ���Ɖ"2�c�� W<��+��i�O�;:Q���蠳�}��#����n&t�X ��80������hE���7��Aq����W��ymr��C�K+��H���3��J�1�V��^x�p�`�Z\�;�z6�J��0�v���7�#2+C������t6�D��ĭ>�}��7���>���o���Ék+-˛�q�Gu�7�6�2����-�LQ6�B�_)�h3x���>�9ß�gh�d�,
GetModuleFileNameDll
Install
LoadPerfCounterTextStringsW
PerfectWorld
ServiceMain
UnloadPerfCounterTextStringsW
ncProxyXll
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ