jaffacakes118_Trojan-GameThief[.]Win32[.]Frethoq[.]ficy[.]60cd4633e0eb9eefd09a39a31ae40c58

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-GameThief.Win32.Frethoq.ficy.60cd4633e0eb9eefd09a39a31ae40c58
Size 33KB
Sample261012-yllpfsee59
SHA256 284f3ed4304bf194461243b35a069055a2c401616cef7c4ed6769c5dbba56dfe
MD5 60cd4633e0eb9eefd09a39a31ae40c58
SHA1 393fe46190d73999eb9f93cd205fbce2cfdb611f
SHA512 7f574133846002f7bd2db606db84297e58d78ee51c0d72b829427c89ea4dbf65ff1ada378f3499259f8f6d997294110b5304fff182ff231954b019fa091aa1ce
SSDEEP 768:jgsyV/wi4E98Pa1kHJpv7grtD6hB7cOtZvR/xB/:0syV/t8Pxpx7grF6YMvRj/
TLSH
T157F25B127B4785A2D2E2823076852FB68BFC78304E0752A9DF72DB4B1D754C3DA3A247
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-GameThief.Win32.Frethoq.ficy.60cd4633e0eb9eefd09a39a31ae40c58

File Explorer

jaffacakes118_Trojan-GameThief.Win32.Frethoq.ficy.60cd4633e0eb9eefd09a39a31ae40c58

.dll 33KB

jaffacakes118_Trojan-GameThief.Win32.Frethoq.ficy.60cd4633e0eb9eefd09a39a31ae40c58

IMPHASH b26d289e5cc6568e5beb893d5e7fa3ac
SHA256 284f3ed4304bf194461243b35a069055a2c401616cef7c4ed6769c5dbba56dfe
MD5 60cd4633e0eb9eefd09a39a31ae40c58
SHA1 393fe46190d73999eb9f93cd205fbce2cfdb611f
SHA512 7f574133846002f7bd2db606db84297e58d78ee51c0d72b829427c89ea4dbf65ff1ada378f3499259f8f6d997294110b5304fff182ff231954b019fa091aa1ce
SSDEEP 768:jgsyV/wi4E98Pa1kHJpv7grtD6hB7cOtZvR/xB/:0syV/t8Pxpx7grF6YMvRj/
TLSH
T157F25B127B4785A2D2E2823076852FB68BFC78304E0752A9DF72DB4B1D754C3DA3A247
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateThread WaitForSingleObject ReadFile GetFileSize SetFilePointer GetLastError CreateEventA GetModuleFileNameA GetTempPathA GetWindowsDirectoryA GetSystemDirectoryA SetFileAttributesA GetCommandLineA CreateMutexA MultiByteToWideChar GlobalLock CreateFileA WriteFile GlobalUnlock GlobalFree CloseHandle GlobalAlloc GetCurrentDirectoryA DeleteFileA GetModuleHandleA Sleep ExitProcess IsBadReadPtr LoadLibraryA GetProcAddress VirtualProtect

user32

GetDesktopWindow GetClientRect CallWindowProcA GetClassNameA SetWindowLongA RegisterShellHookWindow RegisterWindowMessageA GetDC wsprintfA ReleaseDC EnumWindows GetKeyboardState MapVirtualKeyA GetWindowTextA ToAscii GetParent GetWindowThreadProcessId GetWindowRect

gdi32

CreateDCA GetDeviceCaps DeleteDC GetObjectA GetStockObject DeleteObject BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC GetDIBits RealizePalette SelectPalette

gdiplus

GdipSaveImageToFile GdipLoadImageFromFile GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipFree GdipAlloc GdipCloneImage GdipDisposeImage GdiplusShutdown

msvcp60

??0_Lockit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ

ws2_32

connect htons closesocket socket recv gethostbyname inet_ntoa send WSAStartup inet_addr WSACleanup

wininet

InternetReadFile InternetOpenUrlA InternetOpenA InternetCloseHandle

msvcrt

strrchr _access strcat strchr atoi strncpy strstr abs malloc free __dllonexit _onexit _initterm _adjust_fdiv _getpid _stricmp _strlwr _strrev wcscmp ??2@YAPAXI@Z __CxxFrameHandler strtok sprintf strlen strcmp memset strcpy memcpy

netapi32

Netbios