jaffacakes118_Trojan-GameThief[.]Win32[.]OnLineGames[.]ywuh[.]deb1c38ad3a592bd087a4340ba030690

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ywuh.deb1c38ad3a592bd087a4340ba030690
Size 36KB
Sample261006-vc4bcsdx2n
SHA256 f44e91017a3043392e410d92c19b70cc7f5b9bc756948a1697a63b3b16189edc
MD5 deb1c38ad3a592bd087a4340ba030690
SHA1 b4ddda239c64e3590b01f45d5491dee1579e55da
SHA512 3b0f985976a8ea7e747c9394679424f6645607962b705e500681c54c464a50157127717b3e7d0214513ac37ac05f7d60a8a8965a11703a81b16dddc674d3ec9a
SSDEEP 768:LldjeazLJ73PSindj9tuVqFqH7Pdvlr5hCD8ROjMV:LjjeUJ73PRtuVq67F9lQgROji
TLSH
T12EF25B137A4B89B2D297423432113B759BFC68701F025276DB72CEEA1DB0AC3DA76643
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ywuh.deb1c38ad3a592bd087a4340ba030690

File Explorer

jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ywuh.deb1c38ad3a592bd087a4340ba030690

.dll 36KB

jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ywuh.deb1c38ad3a592bd087a4340ba030690

IMPHASH b698a4d1a3ea4827f914a0b3d3a31f83
SHA256 f44e91017a3043392e410d92c19b70cc7f5b9bc756948a1697a63b3b16189edc
MD5 deb1c38ad3a592bd087a4340ba030690
SHA1 b4ddda239c64e3590b01f45d5491dee1579e55da
SHA512 3b0f985976a8ea7e747c9394679424f6645607962b705e500681c54c464a50157127717b3e7d0214513ac37ac05f7d60a8a8965a11703a81b16dddc674d3ec9a
SSDEEP 768:LldjeazLJ73PSindj9tuVqFqH7Pdvlr5hCD8ROjMV:LjjeUJ73PRtuVq67F9lQgROji
TLSH
T12EF25B137A4B89B2D297423432113B759BFC68701F025276DB72CEEA1DB0AC3DA76643
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26504

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

WaitForSingleObject ReadFile GetFileSize SetFilePointer GetLastError CreateEventA GetModuleFileNameA GetTempPathA GetWindowsDirectoryA CreateThread SetFileAttributesA GetCommandLineA GetSystemDirectoryA MultiByteToWideChar DeleteFileA GlobalLock CreateFileA WriteFile GlobalUnlock GlobalFree CloseHandle LoadLibraryA GetProcAddress GlobalAlloc VirtualProtect GetModuleHandleA Sleep ExitProcess IsBadReadPtr

user32

GetParent GetWindowThreadProcessId ReleaseDC wsprintfA GetWindowTextA GetWindowRect GetDC GetDesktopWindow GetClientRect CallWindowProcA GetClassNameA SetWindowLongA RegisterShellHookWindow RegisterWindowMessageA

gdi32

CreateDCA GetDeviceCaps DeleteObject BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC GetDIBits RealizePalette SelectPalette GetStockObject GetObjectA DeleteDC

gdiplus

GdipCloneImage GdipAlloc GdipFree GdipGetImageEncodersSize GdipGetImageEncoders GdiplusStartup GdipDisposeImage GdiplusShutdown GdipSaveImageToFile GdipLoadImageFromFile

msvcp60

??0_Lockit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ

ws2_32

inet_ntoa send recv socket inet_addr htons connect closesocket gethostbyname WSACleanup WSAStartup

wininet

InternetOpenUrlA InternetOpenA InternetReadFile InternetCloseHandle

msvcrt

_access strrchr strchr strncpy abs free _onexit _initterm _adjust_fdiv _strupr _strlwr _getpid _stricmp _strrev __dllonexit malloc wcscmp ??2@YAPAXI@Z __CxxFrameHandler strstr memcpy strncmp strcat atoi sprintf strlen strcmp strcpy memset

netapi32

Netbios