jaffacakes118_Trojan-GameThief[.]Win32[.]Magania[.]dsqe[.]a421b876c6e9db66b7365b2a906f395e

General

Target
jaffacakes118_Trojan-GameThief.Win32.Magania.dsqe.a421b876c6e9db66b7365b2a906f395e
Size 236KB
Sample261006-t2dass1zhy
SHA256 54de86a12a4fe4e59798da71f4bdcecdaa68631922fef35148e8a9bb32228a7b
MD5 a421b876c6e9db66b7365b2a906f395e
SHA1 170fb3f56b165130ce62340ff249af960d894600
SHA512 cfe5d56bd9e9ab4b4cd0fd01fd9e8d165f2ba36445e58ed163dfe37ba41731d19e360c7bb12525d1be77fc079e5bae01d406f64939e8411d373f3ac7b71915e1
SSDEEP 6144:7sdHF4XjMLdqMvm+rg1uakUkqjFkyHPEbJ:4FF4zMJqBOg1ANqayvwJ
TLSH
T15434AE03B9C281F6D99B11BD18B86776AB3BE41057744EC367446E8A5D313E0AF3638B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-GameThief.Win32.Magania.dsqe.a421b876c6e9db66b7365b2a906f395e

File Explorer

jaffacakes118_Trojan-GameThief.Win32.Magania.dsqe.a421b876c6e9db66b7365b2a906f395e

.exe 236KB

jaffacakes118_Trojan-GameThief.Win32.Magania.dsqe.a421b876c6e9db66b7365b2a906f395e

IMPHASH 2c7ba34739cb68832aaa29f09ea86a97
SHA256 54de86a12a4fe4e59798da71f4bdcecdaa68631922fef35148e8a9bb32228a7b
MD5 a421b876c6e9db66b7365b2a906f395e
SHA1 170fb3f56b165130ce62340ff249af960d894600
SHA512 cfe5d56bd9e9ab4b4cd0fd01fd9e8d165f2ba36445e58ed163dfe37ba41731d19e360c7bb12525d1be77fc079e5bae01d406f64939e8411d373f3ac7b71915e1
SSDEEP 6144:7sdHF4XjMLdqMvm+rg1uakUkqjFkyHPEbJ:4FF4zMJqBOg1ANqayvwJ
TLSH
T15434AE03B9C281F6D99B11BD18B86776AB3BE41057744EC367446E8A5D313E0AF3638B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14847

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Works\ByShell_1.20_20091109_Release\Server\Install\Release\Install.pdb

kernel32

CreateProcessW lstrcatW GetSystemDirectoryW GetStartupInfoA CreatePipe WaitForSingleObject CreateThread ResetEvent CreateEventA FreeLibrary HeapFree HeapAlloc GetProcessHeap GetProcAddress LoadLibraryA GetModuleHandleA GetLastError lstrcatA ExitProcess WideCharToMultiByte MultiByteToWideChar GetSystemDirectoryA DeleteFileA SetFileAttributesA MoveFileA FreeResource lstrlenA WriteFile CloseHandle SetFileTime LocalFileTimeToFileTime SystemTimeToFileTime CreateFileA LoadResource FindResourceA GetTickCount GetTempPathA lstrcpyA lstrcmpiA SetLastError GetFileAttributesA lstrcmpA SetFilePointer GetModuleFileNameA SetUnhandledExceptionFilter ReleaseMutex CreateMutexA GetCommandLineA GetCurrentThreadId LoadLibraryW GetSystemInfo VirtualProtect ReadFile Sleep lstrlenW SetEvent SizeofResource HeapSize RtlUnwind HeapReAlloc RaiseException GetVersionExA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InterlockedExchange VirtualQuery DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr TlsAlloc TlsFree TlsSetValue TlsGetValue TerminateProcess GetCurrentProcess GetStdHandle UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType InitializeCriticalSection IsBadReadPtr IsBadCodePtr GetACP GetOEMCP GetCPInfo GetLocaleInfoA GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW

user32

PostThreadMessageA GetMessageA wsprintfA GetInputState

netapi32

NetUserGetLocalGroups NetApiBufferFree

Sharing