z:\Projects\VS2005\ProduKey\x64\Release\ProduKey.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bb3c3d56c936b77920f72bd9c4958cfc_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bb3c3d56c936b77920f72bd9c4958cfc_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bb3c3d56c936b77920f72bd9c4958cfc_JaffaCakes118
-
Size
97KB
-
MD5
bb3c3d56c936b77920f72bd9c4958cfc
-
SHA1
de88d3b9166c36e90490d72b05ed9d3ded9850a2
-
SHA256
baa0f9e799a3d46ccb04c9d4520a69e58383b2d88aad8746f9214eaa8d3a06f3
-
SHA512
0506491bccfeea6458b80d60101b259d455423ca39ef6da0187c3df31ba4b3a09cb6ef16989b29fe4263b4249dc8e2313bfc28ad1882ec2f5c68bd3364e4c9aa
-
SSDEEP
3072:RZssBWD0gmTokFJlJB2xWbbr7ttb69qPTGRiJS:RnBWD0gkdlJvr7VTu
Malware Config
Signatures
-
Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule sample Nirsoft -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bb3c3d56c936b77920f72bd9c4958cfc_JaffaCakes118
Files
-
bb3c3d56c936b77920f72bd9c4958cfc_JaffaCakes118.exe windows:4 windows x64 arch:x64
d1acc50267e160b97a3a01ba8efe7945
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mpr
WNetOpenEnumA
WNetCloseEnum
WNetEnumResourceA
msvcrt
_initterm
__getmainargs
_acmdln
exit
_cexit
_exit
_c_exit
_XcptFilter
__C_specific_handler
_onexit
__dllonexit
_mbsicmp
_purecall
qsort
_strlwr
_itoa
strtoul
__setusermatherr
_commode
_fmode
__set_app_type
strcmp
strchr
_memicmp
malloc
free
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
strlen
atoi
_strnicmp
_stricmp
memcpy
strrchr
_strcmpi
atof
memcmp
memset
strcpy
strcat
strncat
sprintf
comctl32
ImageList_SetImageCount
ord6
CreateToolbarEx
ImageList_ReplaceIcon
ord17
ImageList_AddMasked
ImageList_Create
ws2_32
WSAStartup
WSACleanup
gethostbyname
kernel32
DeleteFileA
GetCurrentProcessId
ExitProcess
SetErrorMode
GetStdHandle
EnumResourceNamesA
WritePrivateProfileStringA
GetPrivateProfileIntA
MultiByteToWideChar
ReadProcessMemory
OpenProcess
GetStartupInfoA
GetLogicalDrives
GlobalAlloc
GetLastError
GetCurrentProcess
CompareFileTime
GetComputerNameA
GetDriveTypeA
WideCharToMultiByte
GetPrivateProfileStringA
FileTimeToSystemTime
GetProcAddress
LoadLibraryA
FreeLibrary
GetTempFileNameA
FindClose
GetFileAttributesA
GetVersionExA
GlobalLock
CloseHandle
GetTimeFormatA
ReadFile
GetTempPathA
GetSystemDirectoryA
LocalFree
FormatMessageA
GetModuleFileNameA
CreateFileA
FindNextFileA
GetWindowsDirectoryA
GetFileSize
GlobalUnlock
GetDateFormatA
GetModuleHandleA
WriteFile
LoadLibraryExA
FindFirstFileA
user32
GetMessageA
RegisterWindowMessageA
GetFocus
EndDeferWindowPos
DispatchMessageA
IsDialogMessageA
GetSysColorBrush
ShowWindow
ChildWindowFromPoint
SetCursor
LoadCursorA
GetDlgItemTextA
SetWindowTextA
SendDlgItemMessageA
GetDlgItemInt
EndDialog
GetDlgItem
CreateWindowExA
SetDlgItemInt
SetDlgItemTextA
UpdateWindow
GetSystemMetrics
GetWindowRect
PostMessageA
SetMenu
LoadAcceleratorsA
SetWindowPos
DefWindowProcA
TranslateAcceleratorA
MessageBoxA
GetWindowPlacement
SendMessageA
RegisterClassA
LoadIconA
LoadImageA
GetWindowLongA
SetWindowLongA
SetFocus
OpenClipboard
GetClassNameA
CloseClipboard
GetMenuItemCount
GetSubMenu
GetMenuStringA
GetMenu
GetCursorPos
MoveWindow
GetDC
GetSysColor
CheckMenuItem
SetClipboardData
GetClientRect
EmptyClipboard
EnableWindow
EnableMenuItem
MapWindowPoints
ReleaseDC
EnumChildWindows
DestroyWindow
GetMenuItemInfoA
GetWindowTextA
LoadMenuA
GetParent
ModifyMenuA
LoadStringA
DialogBoxParamA
GetDlgCtrlID
DestroyMenu
CreateDialogParamA
TrackPopupMenu
BeginDeferWindowPos
PostQuitMessage
TranslateMessage
DeferWindowPos
gdi32
SetBkMode
CreateFontIndirectA
DeleteObject
GetStockObject
GetTextExtentPoint32A
SetBkColor
GetDeviceCaps
SetTextColor
comdlg32
FindTextA
GetSaveFileNameA
GetOpenFileNameA
advapi32
RegQueryInfoKeyA
RegConnectRegistryA
RegLoadKeyA
RegCloseKey
RegUnLoadKeyA
RegDeleteKeyA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
shell32
ShellExecuteA
SHGetPathFromIDListA
SHGetMalloc
SHBrowseForFolderA
ole32
CoInitialize
CoUninitialize
Sections
.text Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ