jaffacakes118_Trojan-GameThief[.]Win32[.]OnLineGames[.]ajyss[.]2fdcdec8a557b4e72ac8c5fefd183d25

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ajyss.2fdcdec8a557b4e72ac8c5fefd183d25
Size 35KB
Sample261006-vbw6nassdw
SHA256 442023270ee8f0c1c11e35e292e1570290d512c6479e48f28731b37a14903bfb
MD5 2fdcdec8a557b4e72ac8c5fefd183d25
SHA1 12fe526a763f26436d7921e0e6f4723c57082f19
SHA512 16c157b40eb8db901590ed6fbffad8362ace993caec345c2ace6f437e5532a107ffe9662f678e4b5b31cac507d6f64a50a39b4adc21f181e8b8f6f3eca17fac7
SSDEEP 768:hnWy0L5TXpVQcqxieaSrM/W4uGes7UOFTcJ5hlD8oR3YGXdk:8LtXvQqSrMe/s7UOdcrXlRIGXS
TLSH
T1F6F26D22BA4745A2D1E2923036503B76DBF868345E06549EDF73D79B1D30AC7EE3A207
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ajyss.2fdcdec8a557b4e72ac8c5fefd183d25

File Explorer

jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ajyss.2fdcdec8a557b4e72ac8c5fefd183d25

.dll 35KB

jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ajyss.2fdcdec8a557b4e72ac8c5fefd183d25

IMPHASH b6faaa79c18d79ea638c8c589b50df00
SHA256 442023270ee8f0c1c11e35e292e1570290d512c6479e48f28731b37a14903bfb
MD5 2fdcdec8a557b4e72ac8c5fefd183d25
SHA1 12fe526a763f26436d7921e0e6f4723c57082f19
SHA512 16c157b40eb8db901590ed6fbffad8362ace993caec345c2ace6f437e5532a107ffe9662f678e4b5b31cac507d6f64a50a39b4adc21f181e8b8f6f3eca17fac7
SSDEEP 768:hnWy0L5TXpVQcqxieaSrM/W4uGes7UOFTcJ5hlD8oR3YGXdk:8LtXvQqSrMe/s7UOdcrXlRIGXS
TLSH
T1F6F26D22BA4745A2D1E2923036503B76DBF868345E06549EDF73D79B1D30AC7EE3A207
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26207

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetSystemDirectoryA CreateThread WaitForSingleObject ReadFile GetFileSize SetFilePointer GetLastError CreateEventA GetModuleFileNameA GetTempPathA MultiByteToWideChar SetFileAttributesA GetTimeZoneInformation DeleteFileA GlobalLock CreateFileA WriteFile GlobalUnlock GlobalFree CloseHandle LoadLibraryA GetProcAddress GlobalAlloc VirtualProtect GetCommandLineA Sleep GetModuleHandleA ExitProcess IsBadReadPtr GetWindowsDirectoryA WideCharToMultiByte

user32

ReleaseDC wsprintfA GetWindowTextA GetWindowRect GetDC GetDesktopWindow GetClientRect CallWindowProcA GetClassNameA SetWindowLongA RegisterShellHookWindow RegisterWindowMessageA

gdi32

CreateDCA DeleteObject BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC GetDIBits RealizePalette SelectPalette GetStockObject GetObjectA DeleteDC GetDeviceCaps

gdiplus

GdipCloneImage GdipAlloc GdipFree GdipGetImageEncodersSize GdipGetImageEncoders GdipLoadImageFromFile GdipDisposeImage GdiplusShutdown GdipSaveImageToFile GdiplusStartup

msvcp60

??0_Lockit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ

ws2_32

WSAStartup send recv socket inet_addr htons connect gethostbyname inet_ntoa closesocket WSACleanup

wininet

InternetOpenA InternetOpenUrlA InternetReadFile InternetCloseHandle

msvcrt

mktime sscanf fmod strrchr _access strcat memset strchr free __dllonexit _onexit _initterm _adjust_fdiv _stricmp _strlwr _strrev _getpid strncpy abs malloc wcscmp ??2@YAPAXI@Z memcpy __CxxFrameHandler strcmp strtok strstr atoi sprintf strlen strcpy

netapi32

Netbios