jaffacakes118_Trojan-GameThief[.]Win32[.]OnLineGames[.]ajqgh[.]9a339429631963574d7d52d9af73a550

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ajqgh.9a339429631963574d7d52d9af73a550
Size 32KB
Sample261006-vbvb3assdv
SHA256 31a3c8f59578d865d7fad544a25483cd8d1ef269ff3b1c59c53d1adc89d64a16
MD5 9a339429631963574d7d52d9af73a550
SHA1 dc4d5f7eb25e9fe2b9f3a555130881e31bcd0cea
SHA512 cc669a29fc5d73e5083336e759b910156daebe6af2bc2b085d8b0c616fb5b736275b63ed53346d95c5bf0123cd77b0870c6b1f4713fe2d27400fa92a2ee966c4
SSDEEP 768:8MhqpHLSlNb31pbNG7v6fbZOVOQKTRqMuBkK:lqpA1pQ7ifbK2RqMuBd
TLSH
T1E6E25B237A4785B2E192813076412BB5DFFC28301E1A65A9DF72CB5F1E759C6DB3A203
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ajqgh.9a339429631963574d7d52d9af73a550

File Explorer

jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ajqgh.9a339429631963574d7d52d9af73a550

.dll 32KB

jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ajqgh.9a339429631963574d7d52d9af73a550

IMPHASH b58f7d363109a5ce97294e40b01efa9f
SHA256 31a3c8f59578d865d7fad544a25483cd8d1ef269ff3b1c59c53d1adc89d64a16
MD5 9a339429631963574d7d52d9af73a550
SHA1 dc4d5f7eb25e9fe2b9f3a555130881e31bcd0cea
SHA512 cc669a29fc5d73e5083336e759b910156daebe6af2bc2b085d8b0c616fb5b736275b63ed53346d95c5bf0123cd77b0870c6b1f4713fe2d27400fa92a2ee966c4
SSDEEP 768:8MhqpHLSlNb31pbNG7v6fbZOVOQKTRqMuBkK:lqpA1pQ7ifbK2RqMuBd
TLSH
T1E6E25B237A4785B2E192813076412BB5DFFC28301E1A65A9DF72CB5F1E759C6DB3A203
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

WaitForSingleObject ReadFile GetFileSize SetFilePointer GetLastError CreateEventA GetModuleFileNameA GetTempPathA GetWindowsDirectoryA GetSystemDirectoryA SetFileAttributesA CreateMutexA MultiByteToWideChar DeleteFileA GlobalLock CreateFileA WriteFile GlobalUnlock GlobalFree LoadLibraryA GetProcAddress GlobalAlloc VirtualProtect GetCommandLineA ExitProcess Sleep IsBadReadPtr CreateThread CloseHandle

user32

GetParent GetWindowThreadProcessId EnumWindows wsprintfA GetWindowTextA ReleaseDC GetWindowRect GetDC GetDesktopWindow GetClientRect CallWindowProcA GetClassNameA SetWindowLongA RegisterShellHookWindow RegisterWindowMessageA

gdi32

CreateDCA GetDeviceCaps DeleteObject BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC GetDIBits RealizePalette SelectPalette GetStockObject GetObjectA DeleteDC

gdiplus

GdipCloneImage GdipAlloc GdipFree GdipGetImageEncodersSize GdipGetImageEncoders GdiplusStartup GdipDisposeImage GdiplusShutdown GdipLoadImageFromFile GdipSaveImageToFile

msvcp60

??0_Lockit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ

ws2_32

inet_ntoa send recv socket inet_addr htons connect closesocket gethostbyname WSACleanup WSAStartup

wininet

InternetOpenUrlA InternetCloseHandle InternetReadFile InternetOpenA

msvcrt

_access strrchr strcat memset strchr strncpy __dllonexit _onexit _initterm _adjust_fdiv _getpid _stricmp _strlwr _strrev free strstr abs malloc wcscmp ??2@YAPAXI@Z memcpy __CxxFrameHandler strcmp atoi sprintf strlen strcpy

netapi32

Netbios