produkey197-x64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
produkey197-x64.zip
Size 106KB
Sample260708-pepyvsgs9p
SHA256 e4604e0ee680370448c6a832856dff4a0255ca763672825a7a67a2a4662b9909
MD5 2ae1a33e4f431bd4e8c36e514f0e522f
SHA1 f3bba258e4ac425eb018a177dd8b4bcb072014e6
SHA512 a7ab753293791063cd43e520c7bc6f89003a25b78318a68f03b2f01d2d3f38dc28fe960cea61cb3ca2eb4798ba7f4b2579a552a5fdb035a3c8c78f68ebf77813
SSDEEP 3072:mUNFLItAccJERja7rrK6VD1K1o1wNhNzFnYNceA0Q:mUNFLItA/E87HDjUmw
TLSH
T174B31281B3BAD660AF5FED7AB1C6C479512DC63A7113F31A262D6EE049B94CC6003CE4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
static1/unpack001/ProduKey.exe	Nirsoft

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ProduKey.exe

File Explorer

produkey197-x64.zip

.zip 106KB
ProduKey.chm

.chm 17KB
ProduKey.exe

.exe 208KB
readme.txt

18KB

produkey197-x64.zip

SHA256 e4604e0ee680370448c6a832856dff4a0255ca763672825a7a67a2a4662b9909
MD5 2ae1a33e4f431bd4e8c36e514f0e522f
SHA1 f3bba258e4ac425eb018a177dd8b4bcb072014e6
SHA512 a7ab753293791063cd43e520c7bc6f89003a25b78318a68f03b2f01d2d3f38dc28fe960cea61cb3ca2eb4798ba7f4b2579a552a5fdb035a3c8c78f68ebf77813
SSDEEP 3072:mUNFLItAccJERja7rrK6VD1K1o1wNhNzFnYNceA0Q:mUNFLItA/E87HDjUmw
TLSH
T174B31281B3BAD660AF5FED7AB1C6C479512DC63A7113F31A262D6EE049B94CC6003CE4
MD5 SHA1 SHA512 SSDEEP TLSH

ProduKey.exe

IMPHASH cf53492bcb397873ae360a6a4ccff10a
SHA256 6cf9dbed273e35c0719ef691074ec6d84e6a89e5f9674120eec757a501e8564c
MD5 a5660d680fcd5cdf351132685a0e5f14
SHA1 740d45572660c5c54b19a55e44ca0ff038a6d82e
SHA512 ac442f0d72ef17ed11c4ff3c3462ac85a50adccbe226243b53e295854ab3114745a9ad9985e4977641bb0cf9c117a418209d32f5d52e4d475573ad4330911df4
SSDEEP 6144:CNQFpS3n65DynQtQr6dvYzQCbXAGOPzD7CAVvTWG:CNQ3cn6hyQtQr6dvYEUXAXPHO2vTWG
TLSH
T1A8244B4672A45088E07BD17DCE928737E672746413256BCF0A64CBB91F23BE8B93E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detected Nirsoft tools

Free utilities often used by attackers which can steal passwords, product keys, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

ImageList_Add ord6 CreateToolbarEx ImageList_Create ImageList_ReplaceIcon ord17 ImageList_AddMasked ImageList_SetImageCount

ws2_32

WSAGetLastError htons WSAStartup WSACleanup connect WSAAsyncSelect gethostbyname gethostbyaddr closesocket WSASetLastError

mpr

WNetOpenEnumA WNetCloseEnum WNetEnumResourceA

msvcrt

_mbsicmp _purecall qsort _itoa _strnicmp _wcsicmp _memicmp malloc strrchr _stricmp _strlwr free _mbschr _snprintf _snwprintf wcschr atoi strtoul strchr _strcmpi ??2@YAPEAX_K@Z ??3@YAXPEAX@Z strncat sprintf atof __dllonexit _onexit __C_specific_handler _XcptFilter _c_exit _exit _cexit exit _acmdln __getmainargs _initterm memcpy memset __setusermatherr _commode _fmode __set_app_type memcmp

kernel32

ExitProcess GetCurrentProcess ReadProcessMemory GetCurrentProcessId ResumeThread CreateThread OpenProcess Sleep GetTickCount GetComputerNameA CompareFileTime GetStartupInfoA SetErrorMode GetCurrentDirectoryA ExpandEnvironmentStringsA DeleteFileA GetStdHandle WritePrivateProfileStringA GetPrivateProfileStringA GetPrivateProfileIntA EnumResourceNamesA MultiByteToWideChar WideCharToMultiByte GetFileAttributesA LocalFree GetTimeFormatA GetProcAddress GetModuleHandleA FileTimeToSystemTime LoadLibraryA FreeLibrary GetLogicalDrives GetDriveTypeA GetLastError GetModuleFileNameA FindNextFileA LoadLibraryExA GetTempFileNameA FormatMessageA ReadFile FindClose GetSystemDirectoryA GetWindowsDirectoryA GetDateFormatA WriteFile GetVersionExA GlobalAlloc GlobalUnlock GlobalLock CloseHandle CreateFileA FileTimeToLocalFileTime GetFileSize FindFirstFileA GetTempPathA

user32

PostQuitMessage SetTimer GetMessageA PostThreadMessageA MonitorFromWindow EndDeferWindowPos GetMonitorInfoA RegisterWindowMessageA GetSysColorBrush ChildWindowFromPoint ShowWindow SetCursor GetDC ReleaseDC LoadCursorA InvalidateRect GetWindowPlacement SetDlgItemInt BeginPaint GetWindow SetDlgItemTextA GetClientRect DrawFrameControl GetDlgItemTextA SetWindowTextA GetSystemMetrics DeferWindowPos SendDlgItemMessageA SetWindowPos GetWindowRect GetDlgItemInt EndDialog GetDlgItem CreateWindowExA EndPaint RegisterClassA UpdateWindow PostMessageA SetMenu LoadAcceleratorsA DefWindowProcA TranslateAcceleratorA MessageBoxA SendMessageA SetWindowLongA LoadImageA GetSysColor GetWindowLongA SetFocus CheckMenuRadioItem GetMenuStringA GetCursorPos SetClipboardData EnableWindow MapWindowPoints GetMenu GetParent OpenClipboard MoveWindow GetClassNameA EmptyClipboard CloseClipboard EnableMenuItem GetSubMenu CheckMenuItem GetMenuItemCount CreateDialogParamA EnumChildWindows DestroyWindow GetMenuItemInfoA GetWindowTextA LoadMenuA ModifyMenuA LoadStringA DialogBoxParamA GetDlgCtrlID DestroyMenu LoadIconA BeginDeferWindowPos DispatchMessageA GetFocus KillTimer TranslateMessage IsDialogMessageA TrackPopupMenu

gdi32

SetStretchBltMode GetPixel GetObjectA DeleteDC CreateCompatibleBitmap StretchBlt SetBkColor SetTextColor SetPixel SelectObject CreateCompatibleDC GetDeviceCaps CreateFontIndirectA SetBkMode DeleteObject GetTextExtentPoint32A GetStockObject

comdlg32

FindTextA GetOpenFileNameA GetSaveFileNameA

advapi32

RegDeleteKeyA RegUnLoadKeyA RegConnectRegistryA RegDeleteValueA RegQueryInfoKeyA RegOpenKeyExA RegEnumKeyExA RegEnumValueA RegCloseKey RegSetValueExA RegQueryValueExA RegLoadKeyA

shell32

ShellExecuteExA SHGetPathFromIDListA SHGetMalloc SHBrowseForFolderA SHGetFileInfoA ShellExecuteA

ole32

CoSetProxyBlanket CoUninitialize CoInitialize CoCreateInstance

oleaut32

SafeArrayDestroy SysFreeString VariantClear