jaffacakes118_Trojan-GameThief[.]Win32[.]Frethoq[.]fmul[.]3af08aed2e091e83504ce9983ca1692b

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-GameThief.Win32.Frethoq.fmul.3af08aed2e091e83504ce9983ca1692b
Size 32KB
Sample261012-yl3mzaev6v
SHA256 ed034035a893292523a06f875dd921e8185d42ec3d0d7dd15fd2467c59366356
MD5 3af08aed2e091e83504ce9983ca1692b
SHA1 24bf041a18320cdac1b57135fb90a56a8b7f8ccb
SHA512 f9c5c4e755e46bbcd5c49d599f47b83410b5f9146a50b0aa45ac9bad32ee5af6a84a20bbea65d090f8827a9d2b4e87cef1e4db66632c430f483302842efc5f08
SSDEEP 768:XZ2I7fc/zqbCP7yvVeiEZlhCDilRbBWbte:X0Iw/zqA7QVeiEr8OlRbBWbte
TLSH
T1FFE26C137B4A89B2E2A3423036412BB98BFC78300E0755A9DF72875B1DB55C7DA76307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-GameThief.Win32.Frethoq.fmul.3af08aed2e091e83504ce9983ca1692b

File Explorer

jaffacakes118_Trojan-GameThief.Win32.Frethoq.fmul.3af08aed2e091e83504ce9983ca1692b

.dll 32KB

jaffacakes118_Trojan-GameThief.Win32.Frethoq.fmul.3af08aed2e091e83504ce9983ca1692b

IMPHASH 51e974c6217ce1dedd46527fcbcec6d1
SHA256 ed034035a893292523a06f875dd921e8185d42ec3d0d7dd15fd2467c59366356
MD5 3af08aed2e091e83504ce9983ca1692b
SHA1 24bf041a18320cdac1b57135fb90a56a8b7f8ccb
SHA512 f9c5c4e755e46bbcd5c49d599f47b83410b5f9146a50b0aa45ac9bad32ee5af6a84a20bbea65d090f8827a9d2b4e87cef1e4db66632c430f483302842efc5f08
SSDEEP 768:XZ2I7fc/zqbCP7yvVeiEZlhCDilRbBWbte:X0Iw/zqA7QVeiEr8OlRbBWbte
TLSH
T1FFE26C137B4A89B2E2A3423036412BB98BFC78300E0755A9DF72875B1DB55C7DA76307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateThread WaitForSingleObject ReadFile GetFileSize SetFilePointer GetLastError CreateEventA GetModuleFileNameA GetTempPathA GetWindowsDirectoryA GetSystemDirectoryA SetFileAttributesA GetCommandLineA MultiByteToWideChar GlobalLock CreateFileA WriteFile GlobalUnlock GlobalFree CloseHandle GlobalAlloc GetCurrentDirectoryA DeleteFileA GetModuleHandleA Sleep ExitProcess IsBadReadPtr LoadLibraryA GetProcAddress VirtualProtect

user32

GetDesktopWindow GetClientRect CallWindowProcA GetClassNameA SetWindowLongA RegisterShellHookWindow RegisterWindowMessageA GetDC wsprintfA ReleaseDC EnumWindows GetKeyboardState MapVirtualKeyA GetWindowTextA ToAscii GetParent GetWindowThreadProcessId GetWindowRect

gdi32

CreateDCA GetDeviceCaps DeleteDC GetObjectA GetStockObject DeleteObject BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC GetDIBits RealizePalette SelectPalette

gdiplus

GdipSaveImageToFile GdipLoadImageFromFile GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipFree GdipAlloc GdipCloneImage GdiplusShutdown GdipDisposeImage

msvcp60

??0_Lockit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ

ws2_32

connect htons gethostbyname socket recv inet_ntoa WSAStartup send WSACleanup inet_addr closesocket

wininet

InternetReadFile InternetOpenUrlA InternetOpenA InternetCloseHandle

msvcrt

strrchr _access strcat strchr atoi strncpy strstr abs malloc free __dllonexit _onexit _initterm _adjust_fdiv _getpid _stricmp _strlwr _strrev wcscmp ??2@YAPAXI@Z __CxxFrameHandler strtok sprintf strlen strcmp memset strcpy memcpy

netapi32

Netbios