jaffacakes118_Trojan-GameThief[.]Win32[.]Frethoq[.]fmul[.]106083e2aec32443a90f02f65995f6d3

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-GameThief.Win32.Frethoq.fmul.106083e2aec32443a90f02f65995f6d3
Size 32KB
Sample261012-ylvmcsas6l
SHA256 2e17fdab936f8ff4e62516595d1917a1cf6aa36aa9a6bce8921baf2f4ae4133c
MD5 106083e2aec32443a90f02f65995f6d3
SHA1 adc02b4de329c6fb9031c1ed26ad465e62ecafb7
SHA512 262a71204aab872fb82d5daf5be9aa3b855749a701e9e0342b2c5ea087f9d5a8c44424e39573f9b2ee7d82a3878c8cbea3b50a8730c2770ff408fa2a74c958eb
SSDEEP 768:vZ2I7fc/zqbCP7yvVeiEZlhCDilRbBWbte:v0Iw/zqA7QVeiEr8OlRbBWbte
TLSH
T16FE26C137B4A89B2E2A3423036412BB98BFC78300E0755A9DF72875B1DB56C7DA76307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-GameThief.Win32.Frethoq.fmul.106083e2aec32443a90f02f65995f6d3

File Explorer

jaffacakes118_Trojan-GameThief.Win32.Frethoq.fmul.106083e2aec32443a90f02f65995f6d3

.dll 32KB

jaffacakes118_Trojan-GameThief.Win32.Frethoq.fmul.106083e2aec32443a90f02f65995f6d3

IMPHASH 51e974c6217ce1dedd46527fcbcec6d1
SHA256 2e17fdab936f8ff4e62516595d1917a1cf6aa36aa9a6bce8921baf2f4ae4133c
MD5 106083e2aec32443a90f02f65995f6d3
SHA1 adc02b4de329c6fb9031c1ed26ad465e62ecafb7
SHA512 262a71204aab872fb82d5daf5be9aa3b855749a701e9e0342b2c5ea087f9d5a8c44424e39573f9b2ee7d82a3878c8cbea3b50a8730c2770ff408fa2a74c958eb
SSDEEP 768:vZ2I7fc/zqbCP7yvVeiEZlhCDilRbBWbte:v0Iw/zqA7QVeiEr8OlRbBWbte
TLSH
T16FE26C137B4A89B2E2A3423036412BB98BFC78300E0755A9DF72875B1DB56C7DA76307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateThread WaitForSingleObject ReadFile GetFileSize SetFilePointer GetLastError CreateEventA GetModuleFileNameA GetTempPathA GetWindowsDirectoryA GetSystemDirectoryA SetFileAttributesA GetCommandLineA MultiByteToWideChar GlobalLock CreateFileA WriteFile GlobalUnlock GlobalFree CloseHandle GlobalAlloc GetCurrentDirectoryA DeleteFileA GetModuleHandleA Sleep ExitProcess IsBadReadPtr LoadLibraryA GetProcAddress VirtualProtect

user32

GetDesktopWindow GetClientRect CallWindowProcA GetClassNameA SetWindowLongA RegisterShellHookWindow RegisterWindowMessageA GetDC wsprintfA ReleaseDC EnumWindows GetKeyboardState MapVirtualKeyA GetWindowTextA ToAscii GetParent GetWindowThreadProcessId GetWindowRect

gdi32

CreateDCA GetDeviceCaps DeleteDC GetObjectA GetStockObject DeleteObject BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC GetDIBits RealizePalette SelectPalette

gdiplus

GdipSaveImageToFile GdipLoadImageFromFile GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipFree GdipAlloc GdipCloneImage GdiplusShutdown GdipDisposeImage

msvcp60

??0_Lockit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ

ws2_32

connect htons gethostbyname socket recv inet_ntoa WSAStartup send WSACleanup inet_addr closesocket

wininet

InternetReadFile InternetOpenUrlA InternetOpenA InternetCloseHandle

msvcrt

strrchr _access strcat strchr atoi strncpy strstr abs malloc free __dllonexit _onexit _initterm _adjust_fdiv _getpid _stricmp _strlwr _strrev wcscmp ??2@YAPAXI@Z __CxxFrameHandler strtok sprintf strlen strcmp memset strcpy memcpy

netapi32

Netbios