04a69d8ea678929cd229206b098b66b6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

04a69d8ea678929cd229206b098b66b6_JaffaCakes118
Size

65KB
MD5

04a69d8ea678929cd229206b098b66b6
SHA1

292323a5757da5a904e15b57f1196cdb6976613d
SHA256

c0f5c8b808571d8375ca5fd1f1dad9bd5c67e22c8f753e25813e07a6fc14a06f
SHA512

be4f1a820d087ee694809fbc5fd32afd80ded3930698883c2181788003ba8ceabddefdd84c6349654d271fccfa442d28b9a991705149086cea9c80267d942be7
SSDEEP

1536:ukULgjadCHXG3HBCYua770N3Kb68lSHFXXM:uhLSadZR7ua77I3l8YlM

Score

10^/10

Malware Config

Signatures

Nirsoft 1 IoCs

resource	yara_rule
static1/unpack001/ProduKey.exe	Nirsoft

Files

04a69d8ea678929cd229206b098b66b6_JaffaCakes118
.zip
ProduKey.chm
.chm
ProduKey.exe
.exe windows:4 windows x86 arch:x86

db1e107cc62854bf6b319abbe0feb186

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1a:f0:66:0e:83:7a:35:a2:cd:92:ec:61:3f:c1:5d:b8
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/09/2014, 00:00

Not After

12/09/2019, 23:59

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bd:1b:1e:45:0b:bd:d5:df:88:67:8e:7d:da:22:3d:17
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

30/03/2016, 00:00

Not After

30/06/2019, 23:59

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:fd:50:6a:1f:22:77:58:32:10:d9:f0:93:0a:d1:4f:0a:8f:ee:4c:0d:9c:70:62:1d:8d:7a:80:9e:58:ac:c8
Signer

Actual PE Digest

c1:fd:50:6a:1f:22:77:58:32:10:d9:f0:93:0a:d1:4f:0a:8f:ee:4c:0d:9c:70:62:1d:8d:7a:80:9e:58:ac:c8

Digest Algorithm

sha256

PE Digest Matches

true

ef:99:df:3a:91:cc:5d:31:94:5d:1e:86:10:00:bd:58:3f:f6:57:fa
Signer

Actual PE Digest

ef:99:df:3a:91:cc:5d:31:94:5d:1e:86:10:00:bd:58:3f:f6:57:fa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Projects\VS2005\ProduKey\Release\ProduKey.pdb

Imports

mpr

WNetOpenEnumA
WNetEnumResourceA
WNetCloseEnum

msvcrt

_cexit
_XcptFilter
_exit
_c_exit
_onexit
__dllonexit
_purecall
exit
_strlwr
_itoa
strchr
strtoul
_memicmp
__setusermatherr
_initterm
__getmainargs
qsort
_acmdln
malloc
free
??2@YAPAXI@Z
??3@YAXPAX@Z
atof
atoi
_strnicmp
_mbsicmp
_stricmp
_strcmpi
strrchr
strncat
sprintf
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_except_handler3
memset
memcpy

comctl32

ord6
CreateToolbarEx
ImageList_Create
ImageList_ReplaceIcon
ord17
ImageList_SetImageCount
ImageList_AddMasked

ws2_32

gethostbyname
WSAStartup
WSACleanup
htons
WSAGetLastError
connect
WSAAsyncSelect
gethostbyaddr
closesocket
WSASetLastError

kernel32

OpenProcess
CreateThread
ResumeThread
ReadProcessMemory
ExitProcess
CreateFileA
GetStartupInfoA
GetFileSize
GetModuleFileNameA
GetTimeFormatA
GetCurrentProcessId
SetErrorMode
DeleteFileA
GetStdHandle
EnumResourceNamesA
WritePrivateProfileStringA
GetPrivateProfileIntA
MultiByteToWideChar
GetFileAttributesA
LoadLibraryExA
GetLastError
FindNextFileA
FindFirstFileA
GetLogicalDrives
GetComputerNameA
GetDriveTypeA
WideCharToMultiByte
GetPrivateProfileStringA
Sleep
GetCurrentProcess
CompareFileTime
FileTimeToLocalFileTime
FreeLibrary
FileTimeToSystemTime
GetProcAddress
LoadLibraryA
GetModuleHandleA
FormatMessageA
GetTempFileNameA
FindClose
GetWindowsDirectoryA
ReadFile
GetDateFormatA
GetSystemDirectoryA
GetVersionExA
WriteFile
CloseHandle
GetTempPathA
GlobalAlloc
LocalFree
GlobalLock
GlobalUnlock

user32

SetTimer
PostQuitMessage
TrackPopupMenu
EndDeferWindowPos
KillTimer
GetFocus
TranslateMessage
DispatchMessageA
DestroyWindow
ModifyMenuA
CreateDialogParamA
LoadStringA
BeginDeferWindowPos
GetMessageA
IsDialogMessageA
DeferWindowPos
RegisterWindowMessageA
SetCursor
GetSysColorBrush
ChildWindowFromPoint
ShowWindow
LoadCursorA
EndDialog
GetDlgItem
CreateWindowExA
SetDlgItemInt
SendDlgItemMessageA
GetDlgItemInt
SetDlgItemTextA
GetDlgItemTextA
SetWindowTextA
RegisterClassA
UpdateWindow
GetSystemMetrics
PostMessageA
SetMenu
LoadAcceleratorsA
SetWindowPos
DefWindowProcA
TranslateAcceleratorA
MessageBoxA
GetWindowPlacement
SendMessageA
GetWindowRect
LoadImageA
LoadIconA
GetWindowLongA
SetWindowLongA
InvalidateRect
SetFocus
MapWindowPoints
GetSysColor
GetClassNameA
GetMenu
CloseClipboard
GetParent
OpenClipboard
EmptyClipboard
GetDC
GetSubMenu
EnableMenuItem
MoveWindow
ReleaseDC
CheckMenuItem
GetMenuItemCount
GetClientRect
LoadMenuA
GetMenuStringA
SetClipboardData
EnableWindow
GetCursorPos
DialogBoxParamA
GetDlgCtrlID
DestroyMenu
EnumChildWindows
GetMenuItemInfoA
GetWindowTextA

gdi32

GetTextExtentPoint32A
SetBkColor
GetStockObject
GetDeviceCaps
SetTextColor
CreateFontIndirectA
SetBkMode
DeleteObject

comdlg32

GetSaveFileNameA
GetOpenFileNameA
FindTextA

advapi32

RegUnLoadKeyA
RegConnectRegistryA
RegEnumValueA
RegDeleteValueA
RegQueryInfoKeyA
RegOpenKeyExA
RegCloseKey
RegEnumKeyExA
RegQueryValueExA
RegSetValueExA
RegDeleteKeyA
RegLoadKeyA

shell32

ShellExecuteA
SHBrowseForFolderA
SHGetMalloc
SHGetPathFromIDListA
ShellExecuteExA

ole32

CoInitialize
CoUninitialize

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
readme.txt

Sharing

General

Malware Config

Signatures

Files

db1e107cc62854bf6b319abbe0feb186

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

1a:f0:66:0e:83:7a:35:a2:cd:92:ec:61:3f:c1:5d:b8Certificate

Extended Key Usages

Key Usages

bd:1b:1e:45:0b:bd:d5:df:88:67:8e:7d:da:22:3d:17Certificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

c1:fd:50:6a:1f:22:77:58:32:10:d9:f0:93:0a:d1:4f:0a:8f:ee:4c:0d:9c:70:62:1d:8d:7a:80:9e:58:ac:c8Signer

ef:99:df:3a:91:cc:5d:31:94:5d:1e:86:10:00:bd:58:3f:f6:57:faSigner

Headers

File Characteristics

PDB Paths

Imports

mpr

msvcrt

comctl32

ws2_32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

Sections

.text Size: 55KB - Virtual size: 55KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 3KB

.rsrc Size: 14KB - Virtual size: 14KB

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

1a:f0:66:0e:83:7a:35:a2:cd:92:ec:61:3f:c1:5d:b8
Certificate

bd:1b:1e:45:0b:bd:d5:df:88:67:8e:7d:da:22:3d:17
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

c1:fd:50:6a:1f:22:77:58:32:10:d9:f0:93:0a:d1:4f:0a:8f:ee:4c:0d:9c:70:62:1d:8d:7a:80:9e:58:ac:c8
Signer

ef:99:df:3a:91:cc:5d:31:94:5d:1e:86:10:00:bd:58:3f:f6:57:fa
Signer

.text
Size: 55KB - Virtual size: 55KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 14KB - Virtual size: 14KB