jaffacakes118_Trojan-GameThief[.]Win32[.]Nilage[.]rg[.]2524f15d4c5afd934c54fdd739dbf5ff

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-GameThief.Win32.Nilage.rg.2524f15d4c5afd934c54fdd739dbf5ff
Size 41KB
Sample261011-2c4epa115j
SHA256 a3fdc6eeb503be28d11e2f8a5f565fd9b9fda277018a9e1cc51b226132ebdd27
MD5 2524f15d4c5afd934c54fdd739dbf5ff
SHA1 e06373becf5cc05decdfb454ec8060009f816cd8
SHA512 b42d48f87ce3027ea51ede306e157b61338442cde2c75beb9433f56387c318ddb131d5142c7b1688a3ce07d96e0ac6562b92ef4086aa5c964a6e1365b3388104
SSDEEP 768:myfESwtShjqMJw8Je78JuACzWj7MhRX+c:my6SsMK8Je78Juzu7MhROc
TLSH
T122131AD1A90604F3D72D267034AF6B3BC66C59AF1FE05B878F48ED6E2C231926532217
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-GameThief.Win32.Nilage.rg.2524f15d4c5afd934c54fdd739dbf5ff

File Explorer

jaffacakes118_Trojan-GameThief.Win32.Nilage.rg.2524f15d4c5afd934c54fdd739dbf5ff

.dll 41KB

jaffacakes118_Trojan-GameThief.Win32.Nilage.rg.2524f15d4c5afd934c54fdd739dbf5ff

IMPHASH 925ec7ff0b8c320ad2c89127ffda7592
SHA256 a3fdc6eeb503be28d11e2f8a5f565fd9b9fda277018a9e1cc51b226132ebdd27
MD5 2524f15d4c5afd934c54fdd739dbf5ff
SHA1 e06373becf5cc05decdfb454ec8060009f816cd8
SHA512 b42d48f87ce3027ea51ede306e157b61338442cde2c75beb9433f56387c318ddb131d5142c7b1688a3ce07d96e0ac6562b92ef4086aa5c964a6e1365b3388104
SSDEEP 768:myfESwtShjqMJw8Je78JuACzWj7MhRX+c:my6SsMK8Je78Juzu7MhROc
TLSH
T122131AD1A90604F3D72D267034AF6B3BC66C59AF1FE05B878F48ED6E2C231926532217
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17525

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

ord2985 ord3081 ord2976 ord3830 ord3831 ord3262 ord3825 ord3079 ord4080 ord4622 ord4465 ord3136 ord817 ord924 ord565 ord4226 ord4274 ord6375 ord4486 ord2554 ord2512 ord5731 ord3922 ord4424 ord2726 ord5302 ord4698 ord5714 ord3738 ord815 ord567 ord3147 ord3259 ord665 ord1979 ord6385 ord5186 ord354 ord690 ord2393 ord2919 ord5808 ord1074 ord1075 ord5204 ord3229 ord389 ord1247 ord2725 ord825 ord5572 ord5683 ord5710 ord858 ord4202 ord2763 ord4129 ord926 ord941 ord2915 ord823 ord537 ord2764 ord800 ord2982 ord5715 ord5289 ord5307 ord4699 ord4079 ord5303 ord5300 ord3346 ord2396 ord1948 ord2077 ord2029 ord940 ord2256 ord791 ord523 ord3717 ord967 ord1995 ord5479 ord5797 ord4919 ord4975 ord4863 ord4335 ord4447 ord4411 ord2032 ord5482 ord5811 ord4779 ord5308 ord2614 ord2818 ord939 ord6877 ord535 ord860 ord1168 ord6467 ord561 ord540 ord1089 ord5199 ord818 ord1116 ord1176 ord1575 ord1577 ord1182 ord342 ord1243 ord1197 ord1570 ord1253 ord1255 ord1578 ord600 ord826 ord269 ord5356

msvcrt

__dllonexit _adjust_fdiv malloc _initterm free ??1type_info@@UAE@XZ _onexit _EH_prolog atol strncpy wcstombs _mbscmp __CxxFrameHandler

kernel32

LocalAlloc CreateThread GlobalAlloc GlobalFree TerminateProcess FreeConsole CreateProcessA DeleteFileA GetFileSize GetCurrentThreadId SetFilePointer GetModuleFileNameA GetCommandLineA WriteFile GetTempPathA CreateFileA ReadFile LoadLibraryA FreeLibrary GetCurrentProcess Sleep OpenProcess GetVersionExA WriteProcessMemory GetModuleHandleA GetProcAddress LocalFree CloseHandle

user32

SetWindowsHookExA CallNextHookEx UnhookWindowsHookEx GetWindowThreadProcessId LoadIconA LoadCursorA RegisterClassA DispatchMessageA TranslateMessage DefWindowProcA CreateWindowExA GetWindowTextA wsprintfA FindWindowA PostMessageA GetMessageA

gdi32

GetStockObject

advapi32

RegSetValueExA RegCloseKey RegisterServiceCtrlHandlerA SetServiceStatus RegOpenKeyExA