Overview
overview
6Static
static
3Plugins/AB...se.exe
windows7-x64
3Plugins/AB...se.exe
windows10-2004-x64
3Plugins/Ab...de.exe
windows7-x64
3Plugins/Ab...de.exe
windows10-2004-x64
3Plugins/Al....x.exe
windows7-x64
3Plugins/Al....x.exe
windows10-2004-x64
6Plugins/Bl...te.exe
windows7-x64
3Plugins/Bl...te.exe
windows10-2004-x64
3Plugins/Em...ys.exe
windows7-x64
6Plugins/Em...ys.exe
windows10-2004-x64
6Plugins/GA...om.exe
windows7-x64
3Plugins/GA...om.exe
windows10-2004-x64
3Plugins/Namo.exe
windows7-x64
3Plugins/Namo.exe
windows10-2004-x64
3Plugins/Reflexive.exe
windows7-x64
3Plugins/Reflexive.exe
windows10-2004-x64
3Plugins/Teklynx.exe
windows7-x64
3Plugins/Teklynx.exe
windows10-2004-x64
3Plugins/Zylom.exe
windows7-x64
3Plugins/Zylom.exe
windows10-2004-x64
3Trial-Reset.chm
windows7-x64
1Trial-Reset.chm
windows10-2004-x64
1Trial-Reset.exe
windows7-x64
6Trial-Reset.exe
windows10-2004-x64
3src/FRMAdd.vbs
windows7-x64
1src/FRMAdd.vbs
windows10-2004-x64
1src/FRMMain.vbs
windows7-x64
1src/FRMMain.vbs
windows10-2004-x64
1src/FRMProtect.vbs
windows7-x64
1src/FRMProtect.vbs
windows10-2004-x64
1src/FRMSTClear.vbs
windows7-x64
1src/FRMSTClear.vbs
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
Plugins/ABBYY License.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Plugins/ABBYY License.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Plugins/Aborange.de.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Plugins/Aborange.de.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Plugins/Alcohol 1.x-2.x.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Plugins/Alcohol 1.x-2.x.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Plugins/BlindWrite.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Plugins/BlindWrite.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Plugins/Empty Keys.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Plugins/Empty Keys.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Plugins/GAlcott.com.exe
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Plugins/GAlcott.com.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Plugins/Namo.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Plugins/Namo.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Plugins/Reflexive.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Plugins/Reflexive.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Plugins/Teklynx.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Plugins/Teklynx.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Plugins/Zylom.exe
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
Plugins/Zylom.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Trial-Reset.chm
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Trial-Reset.chm
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Trial-Reset.exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
Trial-Reset.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
src/FRMAdd.vbs
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
src/FRMAdd.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
src/FRMMain.vbs
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
src/FRMMain.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
src/FRMProtect.vbs
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
src/FRMProtect.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
src/FRMSTClear.vbs
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
src/FRMSTClear.vbs
Resource
win10v2004-20240802-en
General
-
Target
07e8bf848f5abca32d2e06fc184f04b1_JaffaCakes118
-
Size
592KB
-
MD5
07e8bf848f5abca32d2e06fc184f04b1
-
SHA1
29ac62f79775a5078dfe28eb13691c6f38c29a27
-
SHA256
b975b7871b1f0878c3b5d13e374f2ac440fac36200612eeb02722fed477fc75a
-
SHA512
d064b06fccd8b7cc1da8ded2a4036e3450ba7397870179fa383a5f08de61a273c858583a4e05547894d6497304273dc0f268bae7a0c480f6e9682e738a7a6534
-
SSDEEP
12288:fK4araKXb9EwuNIHdJ14ZkqyC4Km/aAzYB5m9T/XoV0ySmrF/H:fGLXbm9IHb5PTiuNALvrFf
Malware Config
Signatures
-
Unsigned PE 11 IoCs
Checks for missing Authenticode signature.
resource unpack001/Plugins/ABBYY License.dll unpack001/Plugins/Aborange.de.dll unpack001/Plugins/Alcohol 1.x-2.x.dll unpack001/Plugins/BlindWrite.dll unpack001/Plugins/Empty Keys.dll unpack001/Plugins/GAlcott.com.dll unpack001/Plugins/Namo.dll unpack001/Plugins/Reflexive.dll unpack001/Plugins/Teklynx.dll unpack001/Plugins/Zylom.dll unpack001/Trial-Reset.exe
Files
-
07e8bf848f5abca32d2e06fc184f04b1_JaffaCakes118.zip
-
Lists/AkaraExeLock320.txt
-
Lists/BlumentalsSoftware.txt
-
Lists/EditPlus.txt
-
Lists/EleFun Games.txt
-
Lists/GoldWave.txt
-
Lists/NetMeter.txt
-
Lists/PECompact.txt
-
Lists/REAL Studio 2010r1.txt
-
Lists/RegHide.txt
-
Lists/Reggie.txt
-
Lists/Trialware Dialog.txt
-
Lists/WinImage.txt
-
Lists/WinRAR.txt
-
Lists/WinRK.txt
-
Lists/WinZip.txt
-
Plugins/ABBYY License.dll.exe windows:4 windows x86 arch:x86
09d0478591d4f788cb3e5ea416c25237
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Sections
.text Size: 9KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Plugins/Aborange.de.dll.exe windows:4 windows x86 arch:x86
09d0478591d4f788cb3e5ea416c25237
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Sections
.text Size: 8KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Plugins/Alcohol 1.x-2.x.dll.exe windows:4 windows x86 arch:x86
09d0478591d4f788cb3e5ea416c25237
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Sections
.text Size: 9KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Plugins/BlindWrite.dll.exe windows:4 windows x86 arch:x86
09d0478591d4f788cb3e5ea416c25237
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Sections
.text Size: 7KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Plugins/Empty Keys.dll.exe windows:4 windows x86 arch:x86
09d0478591d4f788cb3e5ea416c25237
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Sections
.text Size: 8KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Plugins/GAlcott.com.dll.exe windows:4 windows x86 arch:x86
09d0478591d4f788cb3e5ea416c25237
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Sections
.text Size: 7KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Plugins/Namo.dll.exe windows:4 windows x86 arch:x86
09d0478591d4f788cb3e5ea416c25237
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Sections
.text Size: 8KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Plugins/Reflexive.dll.exe windows:4 windows x86 arch:x86
09d0478591d4f788cb3e5ea416c25237
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Sections
.text Size: 8KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Plugins/Teklynx.dll.exe windows:4 windows x86 arch:x86
09d0478591d4f788cb3e5ea416c25237
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Sections
.text Size: 8KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Plugins/Zylom.dll.exe windows:4 windows x86 arch:x86
09d0478591d4f788cb3e5ea416c25237
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Sections
.text Size: 8KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Trial-Reset.chm.chm
-
Trial-Reset.exe.exe windows:4 windows x86 arch:x86
09d0478591d4f788cb3e5ea416c25237
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Sections
.text Size: 245KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
src/Declarations.bas
-
src/FRMAbout.frm
-
src/FRMAbout.frx
-
src/FRMAdd.frm.vbs
-
src/FRMAdd.frx
-
src/FRMMain.frm.vbs
-
src/FRMMain.frx
-
src/FRMProtect.frm.vbs
-
src/FRMProtect.frx
-
src/FRMSTClear.frm.vbs
-
src/FRMSTClear.frx
-
src/FRMToolbar.frm.vbs
-
src/FRMView.frm.vbs
-
src/FRMView.frx
-
src/FRmToolbar.frx
-
src/Functions.bas.vbs
-
src/Help/Trial-Reset.hhc.html
-
src/Help/Trial-Reset.hhk.html
-
src/Help/Trial-Reset.hhp
-
src/Help/commandline.htm.html
-
src/Help/edit.htm.html
-
src/Help/file.htm.html
-
src/Help/history.htm.html
-
src/Help/license.htm.html
-
src/Help/options.htm.html
-
src/Help/requirements.htm.html
-
src/Help/shortcut.htm.html
-
src/Help/supported.htm.html
-
src/Help/welcome.htm.html
-
src/Plugins/ABBYY License/ABBYY License.vbp
-
src/Plugins/ABBYY License/Plugin.bas.vbs
-
src/Plugins/ABBYY License/icon.res
-
src/Plugins/Aborange/Aborange.vbp
-
src/Plugins/Aborange/Plugin.bas.vbs
-
src/Plugins/Aborange/icon.res
-
src/Plugins/Alcohol Soft/Alcohol.vbp
-
src/Plugins/Alcohol Soft/Plugin.bas.vbs
-
src/Plugins/Alcohol Soft/icon.res
-
src/Plugins/BlindWrite/BlindWrite.vbp
-
src/Plugins/BlindWrite/Plugin.bas.vbs
-
src/Plugins/BlindWrite/icon.res
-
src/Plugins/Empty_Keys/Empty_Keys.vbp
-
src/Plugins/Empty_Keys/Plugin.bas.vbs
-
src/Plugins/Empty_Keys/icon.res
-
src/Plugins/Functions.bas.vbs
-
src/Plugins/GAlcott/GAlcott.vbp
-
src/Plugins/GAlcott/Plugin.bas
-
src/Plugins/GAlcott/icon.res
-
src/Plugins/Namo/Namo.vbp
-
src/Plugins/Namo/Plugin.bas
-
src/Plugins/Namo/icon.res
-
src/Plugins/Reflexive/Plugin.bas.vbs
-
src/Plugins/Reflexive/Reflexive.vbp
-
src/Plugins/Reflexive/icon.res
-
src/Plugins/Teklynx/Plugin.bas.vbs
-
src/Plugins/Teklynx/Teklynx.vbp
-
src/Plugins/Teklynx/icon.res
-
src/Plugins/Zylom/Plugin.bas.vbs
-
src/Plugins/Zylom/Zylom.vbp
-
src/Plugins/Zylom/icon.res
-
src/Registry.bas.vbs
-
src/Scanners.bas.vbs
-
src/TrialReset.res
-
src/TrialReset.vbp