jaffacakes118_Trojan-GameThief[.]Win32[.]Frethoq[.]ficy[.]4cc6217aac7f2e1cef0afd9f8c9103b3

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-GameThief.Win32.Frethoq.ficy.4cc6217aac7f2e1cef0afd9f8c9103b3
Size 33KB
Sample261012-ylfhfaee55
SHA256 9187102fde054d5456db405f393012287ef3be6e8c31d88cda38d9d15ce662d6
MD5 4cc6217aac7f2e1cef0afd9f8c9103b3
SHA1 6531cfa385d31c96b0d21ff08b6531462d0871a6
SHA512 f6577493f8dbb458500c31454d985562e411a2f2b2caf2d20b2083f8528bd824f0344ffc9a4831c200c789545e40e84065c8ec8e033697768fa5e6aadb29c3ab
SSDEEP 768:KgsyV/wi4E98Pa1kHJpv7grtD6hB7cOIZvR/xBu:dsyV/t8Pxpx7grF6Y3vRju
TLSH
T123F24B127A4785A2D2E2813176452FB68BFC78304E0752E9DF72DB8B1D754C3EA3A247
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-GameThief.Win32.Frethoq.ficy.4cc6217aac7f2e1cef0afd9f8c9103b3

File Explorer

jaffacakes118_Trojan-GameThief.Win32.Frethoq.ficy.4cc6217aac7f2e1cef0afd9f8c9103b3

.dll 33KB

jaffacakes118_Trojan-GameThief.Win32.Frethoq.ficy.4cc6217aac7f2e1cef0afd9f8c9103b3

IMPHASH b26d289e5cc6568e5beb893d5e7fa3ac
SHA256 9187102fde054d5456db405f393012287ef3be6e8c31d88cda38d9d15ce662d6
MD5 4cc6217aac7f2e1cef0afd9f8c9103b3
SHA1 6531cfa385d31c96b0d21ff08b6531462d0871a6
SHA512 f6577493f8dbb458500c31454d985562e411a2f2b2caf2d20b2083f8528bd824f0344ffc9a4831c200c789545e40e84065c8ec8e033697768fa5e6aadb29c3ab
SSDEEP 768:KgsyV/wi4E98Pa1kHJpv7grtD6hB7cOIZvR/xBu:dsyV/t8Pxpx7grF6Y3vRju
TLSH
T123F24B127A4785A2D2E2813176452FB68BFC78304E0752E9DF72DB8B1D754C3EA3A247
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateThread WaitForSingleObject ReadFile GetFileSize SetFilePointer GetLastError CreateEventA GetModuleFileNameA GetTempPathA GetWindowsDirectoryA GetSystemDirectoryA SetFileAttributesA GetCommandLineA CreateMutexA MultiByteToWideChar GlobalLock CreateFileA WriteFile GlobalUnlock GlobalFree CloseHandle GlobalAlloc GetCurrentDirectoryA DeleteFileA GetModuleHandleA Sleep ExitProcess IsBadReadPtr LoadLibraryA GetProcAddress VirtualProtect

user32

GetDesktopWindow GetClientRect CallWindowProcA GetClassNameA SetWindowLongA RegisterShellHookWindow RegisterWindowMessageA GetDC wsprintfA ReleaseDC EnumWindows GetKeyboardState MapVirtualKeyA GetWindowTextA ToAscii GetParent GetWindowThreadProcessId GetWindowRect

gdi32

CreateDCA GetDeviceCaps DeleteDC GetObjectA GetStockObject DeleteObject BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC GetDIBits RealizePalette SelectPalette

gdiplus

GdipSaveImageToFile GdipLoadImageFromFile GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipFree GdipAlloc GdipCloneImage GdipDisposeImage GdiplusShutdown

msvcp60

??0_Lockit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ

ws2_32

connect htons closesocket socket recv gethostbyname inet_ntoa send WSAStartup inet_addr WSACleanup

wininet

InternetReadFile InternetOpenUrlA InternetOpenA InternetCloseHandle

msvcrt

strrchr _access strcat strchr atoi strncpy strstr abs malloc free __dllonexit _onexit _initterm _adjust_fdiv _getpid _stricmp _strlwr _strrev wcscmp ??2@YAPAXI@Z __CxxFrameHandler strtok sprintf strlen strcmp memset strcpy memcpy

netapi32

Netbios