jaffacakes118_Trojan-GameThief[.]Win32[.]OnLineGames[.]ajyst[.]752e2f37816ae5f11d32a4220287c698

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ajyst.752e2f37816ae5f11d32a4220287c698
Size 36KB
Sample261006-vb1h3sff43
SHA256 88c554d38587a751fd2c0e1e04f7f0ba44ee4c983ab301858243057b819a8d54
MD5 752e2f37816ae5f11d32a4220287c698
SHA1 959b6e046abff1694d4366f2fe8a609e4f51a372
SHA512 3b0a5971de0c3de001ee536a26167b1589cfac528abbe7e1940b12b0965459b51fbecd5732db83802b8605d6a0694cc685e76ef60a0b346168f5b81fe5cee7be
SSDEEP 768:OldjeazLJ73PSindj9tuVqFqH7Pdvlr5hCD8ROjMV:OjjeUJ73PRtuVq67F9lQgROji
TLSH
T187F25B137A4B89B2D297423432513B759BFC68701F025276DB72CEEA1DB0AC3DA76643
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ajyst.752e2f37816ae5f11d32a4220287c698

File Explorer

jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ajyst.752e2f37816ae5f11d32a4220287c698

.dll 36KB

jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ajyst.752e2f37816ae5f11d32a4220287c698

IMPHASH b698a4d1a3ea4827f914a0b3d3a31f83
SHA256 88c554d38587a751fd2c0e1e04f7f0ba44ee4c983ab301858243057b819a8d54
MD5 752e2f37816ae5f11d32a4220287c698
SHA1 959b6e046abff1694d4366f2fe8a609e4f51a372
SHA512 3b0a5971de0c3de001ee536a26167b1589cfac528abbe7e1940b12b0965459b51fbecd5732db83802b8605d6a0694cc685e76ef60a0b346168f5b81fe5cee7be
SSDEEP 768:OldjeazLJ73PSindj9tuVqFqH7Pdvlr5hCD8ROjMV:OjjeUJ73PRtuVq67F9lQgROji
TLSH
T187F25B137A4B89B2D297423432513B759BFC68701F025276DB72CEEA1DB0AC3DA76643
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26504

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

WaitForSingleObject ReadFile GetFileSize SetFilePointer GetLastError CreateEventA GetModuleFileNameA GetTempPathA GetWindowsDirectoryA CreateThread SetFileAttributesA GetCommandLineA GetSystemDirectoryA MultiByteToWideChar DeleteFileA GlobalLock CreateFileA WriteFile GlobalUnlock GlobalFree CloseHandle LoadLibraryA GetProcAddress GlobalAlloc VirtualProtect GetModuleHandleA Sleep ExitProcess IsBadReadPtr

user32

GetParent GetWindowThreadProcessId ReleaseDC wsprintfA GetWindowTextA GetWindowRect GetDC GetDesktopWindow GetClientRect CallWindowProcA GetClassNameA SetWindowLongA RegisterShellHookWindow RegisterWindowMessageA

gdi32

CreateDCA GetDeviceCaps DeleteObject BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC GetDIBits RealizePalette SelectPalette GetStockObject GetObjectA DeleteDC

gdiplus

GdipCloneImage GdipAlloc GdipFree GdipGetImageEncodersSize GdipGetImageEncoders GdiplusStartup GdipDisposeImage GdiplusShutdown GdipSaveImageToFile GdipLoadImageFromFile

msvcp60

??0_Lockit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ

ws2_32

inet_ntoa send recv socket inet_addr htons connect closesocket gethostbyname WSACleanup WSAStartup

wininet

InternetOpenUrlA InternetOpenA InternetReadFile InternetCloseHandle

msvcrt

_access strrchr strchr strncpy abs free _onexit _initterm _adjust_fdiv _strupr _strlwr _getpid _stricmp _strrev __dllonexit malloc wcscmp ??2@YAPAXI@Z __CxxFrameHandler strstr memcpy strncmp strcat atoi sprintf strlen strcmp strcpy memset

netapi32

Netbios