f6c0ab86bc9d5bfb797eb645e9ad2d33_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f6c0ab86bc9d5bfb797eb645e9ad2d33_JaffaCakes118
Size

51KB
MD5

f6c0ab86bc9d5bfb797eb645e9ad2d33
SHA1

92d17973208f8be2ba677e2ae4de2e8fe408dd5e
SHA256

887b25da1695a219a7dc8ef6e2375d9b5b2209b8d23818ff969d2cd2e13423f4
SHA512

d406ea8f37ce1824592155b37ae79adef07bcd25c9d1e0cae4dbdb18f1b990397b9840af2d19a34fbaccd9b3d8ef5970793b37f8b6d5cb9a5fd7b11af7f0cea6
SSDEEP

1536:/OgZ89Z5ahmkFbb656DhvSVuTZ++hlkx9UH:/OgZ89WG56DhvSVuVlqUH

Score

10^/10

Malware Config

Signatures

Nirsoft 1 IoCs

resource	yara_rule
static1/unpack001/bulletspassview/BulletsPassView.exe	Nirsoft

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/bulletspassview/BulletsPassView.exe

Files

f6c0ab86bc9d5bfb797eb645e9ad2d33_JaffaCakes118
.rar
bulletspassview/BulletsPassView.chm
.chm
bulletspassview/BulletsPassView.exe
.exe windows:4 windows x86 arch:x86

a1a5ab184e67c34c4d2e52c32b547901

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

z:\Projects\VS2005\BulletsPassView\Release\BulletsPassView.pdb

Imports

msvcrt

__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
_onexit
__dllonexit
strcpy
qsort
_purecall
_wcslwr
strlen
_itow
_wcsicmp
__p__fmode
__set_app_type
_controlfp
_except_handler3
malloc
wcschr
free
modf
_memicmp
_wtoi
memcmp
wcstoul
wcsrchr
??2@YAPAXI@Z
??3@YAXPAX@Z
wcslen
memcpy
wcscmp
wcscpy
memset
_snwprintf
wcscat
wcsncat

comctl32

ImageList_SetImageCount
ImageList_AddMasked
ImageList_Create
CreateStatusWindowW
CreateToolbarEx
ord17

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

CreateRemoteThread
EnumResourceTypesW
WriteProcessMemory
OpenProcess
GetCurrentProcess
ExitProcess
GetCurrentProcessId
ResumeThread
WaitForSingleObject
VirtualFreeEx
Sleep
VirtualAllocEx
GetModuleHandleA
GetStartupInfoW
FileTimeToSystemTime
ReadProcessMemory
DeleteFileW
SetErrorMode
GetStdHandle
CompareFileTime
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
GetProcAddress
FreeLibrary
LoadLibraryW
GetTempFileNameW
GetFileSize
GetTimeFormatW
GetModuleHandleW
CloseHandle
GetFileAttributesW
GetWindowsDirectoryW
ReadFile
GetModuleFileNameW
WriteFile
LocalFree
CreateFileW
LockResource
lstrcpyW
FindResourceW
lstrlenW
LoadResource
GlobalAlloc
LoadLibraryExW
GlobalUnlock
WideCharToMultiByte
GetTempPathW
GetLastError
SizeofResource
GlobalLock
FormatMessageW
GetDateFormatW
GetVersionExW
EnumResourceNamesW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW

user32

EnumWindows
SendMessageTimeoutW
EndDeferWindowPos
DispatchMessageW
DrawTextExW
SetCursor
LoadCursorW
GetSysColorBrush
ShowWindow
ChildWindowFromPoint
EndDialog
GetDlgItem
InvalidateRect
SetDlgItemInt
SetWindowTextW
GetClientRect
UpdateWindow
SetDlgItemTextW
GetSystemMetrics
DeferWindowPos
CreateWindowExW
GetWindowRect
GetDlgItemInt
SendDlgItemMessageW
SetMenu
GetWindowPlacement
LoadAcceleratorsW
PostMessageW
DefWindowProcW
TranslateAcceleratorW
SendMessageW
SetWindowPlacement
RegisterClassW
MessageBoxW
GetWindowThreadProcessId
LoadImageW
SetWindowLongW
GetWindowLongW
SetFocus
GetMenuItemCount
CheckMenuItem
CloseClipboard
GetCursorPos
GetParent
GetSysColor
SetClipboardData
EnableWindow
MapWindowPoints
GetMenu
GetSubMenu
GetDC
EmptyClipboard
EnableMenuItem
ReleaseDC
GetClassNameW
OpenClipboard
MoveWindow
GetMenuStringW
GetWindowTextW
DialogBoxParamW
GetDlgCtrlID
DestroyMenu
CreateDialogParamW
DestroyWindow
EnumChildWindows
LoadStringW
SetWindowPos
LoadMenuW
ModifyMenuW
GetMenuItemInfoW
LoadIconW
DestroyIcon
KillTimer
BeginDeferWindowPos
RegisterWindowMessageW
TrackPopupMenu
PostQuitMessage
GetMessageW
SetTimer
IsDialogMessageW
TranslateMessage

gdi32

SetBkMode
DeleteObject
SetTextColor
CreateFontIndirectW
GetTextExtentPoint32W
SetBkColor
GetStockObject
SelectObject
GetDeviceCaps

comdlg32

FindTextW
GetSaveFileNameW

shell32

SHGetFileInfoW
ShellExecuteW

ole32

CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

SysFreeString

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
bulletspassview/readme.txt

Sharing

General

Malware Config

Signatures

Files

a1a5ab184e67c34c4d2e52c32b547901

Headers

File Characteristics

PDB Paths

Imports

msvcrt

comctl32

version

kernel32

user32

gdi32

comdlg32

shell32

ole32

oleaut32

Sections

.text Size: 39KB - Virtual size: 38KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 1024B - Virtual size: 5KB

.rsrc Size: 9KB - Virtual size: 9KB

.text
Size: 39KB - Virtual size: 38KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 1024B - Virtual size: 5KB

.rsrc
Size: 9KB - Virtual size: 9KB