pk_assert_dll_version
Overview
overview
3Static
static
3Passware/ariskkey.dll
windows7-x64
3Passware/ariskkey.dll
windows10-2004-x64
3Passware/ariskkey.exe
windows7-x64
1Passware/ariskkey.exe
windows10-2004-x64
1Passware/pk.chm
windows7-x64
1Passware/pk.chm
windows10-2004-x64
1Passware/�...��.url
windows7-x64
1Passware/�...��.url
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
Passware/ariskkey.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Passware/ariskkey.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
Passware/ariskkey.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
Passware/ariskkey.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Passware/pk.chm
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Passware/pk.chm
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Passware/新云软件.url
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
Passware/新云软件.url
Resource
win10v2004-20240709-en
General
-
Target
5dd91560fd708916979b245ffca7b00c_JaffaCakes118
-
Size
280KB
-
MD5
5dd91560fd708916979b245ffca7b00c
-
SHA1
5cef51611aeed236b5c113aa7962f101652d479c
-
SHA256
4d88e0a04c9b718e414178555ee5f5beefdc201476adfaf735257d69f1624e39
-
SHA512
b0aaff25ce176f49c8725de33a3d9599c981497e4d9ddf5dd84fda157be79644139abed6f32af326e9f15149e78ddd028c80ce8a6d6bbe38b10456da9aaf726e
-
SSDEEP
6144:pFnqBKcQWk3nMXMzMi3EVs1lO1zxNZPMmxdIM74CJg/CYQ51A9G3mFxdPCNIawgH:pJqBDQWvcv3EVH5MUxxgaYI3mFx5kVXv
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Passware/ariskkey.dll unpack001/Passware/ariskkey.exe
Files
-
5dd91560fd708916979b245ffca7b00c_JaffaCakes118.rar
-
Passware/ariskkey.dll.dll windows:4 windows x86 arch:x86
b52d799c44c87a199ae8aec934147fc4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetVersionExA
CloseHandle
MapViewOfFile
UnmapViewOfFile
OpenFileMappingA
MultiByteToWideChar
WaitForSingleObject
OpenEventA
SetEvent
CreateEventA
CreateFileMappingA
GetModuleHandleA
GetSystemInfo
VirtualProtect
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetCurrentThreadId
GetCommandLineA
ExitProcess
GetProcAddress
TerminateProcess
GetCurrentProcess
TlsAlloc
SetLastError
GetLastError
TlsFree
TlsSetValue
TlsGetValue
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
WriteFile
LeaveCriticalSection
EnterCriticalSection
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
RtlUnwind
InterlockedExchange
VirtualQuery
LoadLibraryA
HeapSize
GetLocaleInfoA
user32
SetWindowsHookExA
CallNextHookEx
EnumChildWindows
PostMessageA
UnhookWindowsHookEx
RegisterWindowMessageA
GetClassNameW
GetWindowTextLengthW
GetWindowLongA
IsWindowVisible
GetClassNameA
GetWindowTextW
GetWindowTextA
GetWindow
GetParent
Exports
Exports
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CONST Size: 1024B - Virtual size: 543B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_DATA Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Passware/ariskkey.exe.exe windows:4 windows x86 arch:x86
98725a1e4e54a69ca25defcd27af2eb3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentThreadId
InterlockedIncrement
GetCurrentProcessId
FreeLibrary
GetProcAddress
LoadLibraryA
SetFileAttributesA
GetFileAttributesA
WriteFile
CloseHandle
ConnectNamedPipe
CreateNamedPipeA
GetModuleHandleA
GetLastError
FindResourceA
LockResource
SizeofResource
LoadResource
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualQuery
GetModuleFileNameA
WideCharToMultiByte
MultiByteToWideChar
MulDiv
Sleep
GlobalUnlock
GlobalLock
GlobalAlloc
LocalFree
FormatMessageA
GlobalMemoryStatus
GetVersionExA
GetFullPathNameA
SetUnhandledExceptionFilter
SetEndOfFile
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateThread
SuspendThread
GetCurrentThread
SetThreadPriority
CreateThread
GlobalFree
GetWindowsDirectoryA
GetCurrentDirectoryA
InterlockedExchange
RtlUnwind
RaiseException
GetStartupInfoA
GetCommandLineA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
ExitProcess
TerminateProcess
GetCurrentProcess
GetSystemTimeAsFileTime
DeleteFileA
FlushFileBuffers
SetFilePointer
SetStdHandle
GetFileType
MoveFileA
HeapAlloc
HeapFree
SetLastError
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapDestroy
HeapCreate
VirtualFree
GetTimeZoneInformation
ReadFile
LCMapStringA
LCMapStringW
HeapReAlloc
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
CompareStringA
CompareStringW
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr
GetACP
GetOEMCP
GetCPInfo
CreateFileA
QueryPerformanceCounter
GetTickCount
SetEnvironmentVariableA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
lstrlenA
InterlockedDecrement
user32
GetMessageA
DestroyWindow
InvalidateRect
SetRect
GetClientRect
DefWindowProcA
SetWindowLongA
PostQuitMessage
GetWindowLongA
RegisterClassA
GetClassInfoA
SendDlgItemMessageA
EndDialog
GetSysColor
SetCursor
ScreenToClient
GetDlgItem
ReleaseDC
GetDC
SetDlgItemTextA
SendMessageA
DialogBoxParamA
LoadStringA
GetMenuItemInfoA
InsertMenuItemA
GetMenuItemCount
GetSystemMetrics
DrawTextA
DrawEdge
CopyRect
InflateRect
GetSysColorBrush
TrackPopupMenuEx
TranslateAcceleratorA
FillRect
RemoveMenu
DestroyMenu
CreateMenu
CreatePopupMenu
CloseClipboard
EmptyClipboard
OpenClipboard
SetClipboardData
UnregisterClassA
CreateCursor
SetWindowPos
SetFocus
GetDlgItemTextA
EnableMenuItem
GetSystemMenu
DialogBoxIndirectParamA
MoveWindow
GetClassNameA
TranslateMessage
DispatchMessageA
RegisterWindowMessageA
SetWindowTextA
SetForegroundWindow
SetMenu
GetWindowRect
GetDesktopWindow
ClientToScreen
BeginPaint
EndPaint
LoadBitmapA
IsWindow
GetWindowThreadProcessId
CreateWindowExA
ShowWindow
UpdateWindow
AttachThreadInput
SetActiveWindow
PostMessageA
EnumWindows
IsWindowVisible
EnumChildWindows
GetParent
GetKeyState
GetWindowTextLengthW
GetWindowTextW
GetWindowTextLengthA
GetWindowTextA
LoadCursorA
RegisterClassExA
MessageBoxA
LoadAcceleratorsA
LoadIconA
FindWindowA
SetRectEmpty
OffsetRect
SystemParametersInfoA
ole32
OleRun
OleInitialize
CoCreateInstance
ReleaseStgMedium
CoUninitialize
CoInitialize
OleUninitialize
oleaut32
GetErrorInfo
SafeArrayCreateVector
VariantClear
SafeArrayDestroyDescriptor
SysFreeString
SysAllocStringByteLen
SysStringByteLen
VariantInit
SysAllocString
SafeArrayPutElement
SafeArrayCreate
ariskkey
ord11
ord19
ord32
ord25
ord40
comctl32
InitCommonControlsEx
ImageList_Draw
ImageList_GetIconSize
ImageList_Create
ImageList_ReplaceIcon
ImageList_Destroy
gdi32
CreateBitmap
PatBlt
SetBkColor
GetTextExtentPoint32A
SetTextColor
SetBkMode
CreateSolidBrush
GetStockObject
CreateFontIndirectA
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
GetObjectA
GetDeviceCaps
DeleteObject
comdlg32
GetSaveFileNameA
GetOpenFileNameA
advapi32
RegDeleteValueA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegEnumKeyExA
RegEnumValueA
RegFlushKey
RegDeleteKeyA
RegQueryInfoKeyA
RegQueryValueExA
shell32
SHGetSpecialFolderLocation
DragAcceptFiles
DragFinish
DragQueryFileA
SHGetMalloc
SHGetPathFromIDListA
ShellExecuteA
Sections
.text Size: 512KB - Virtual size: 508KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 156KB - Virtual size: 154KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Passware/pk.chm.chm
-
Passware/新云软件.url.url