jaffacakes118_Trojan-GameThief[.]Win32[.]Frethoq[.]fnkd[.]17fa98aca38b558f335a0afad9ca810e

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-GameThief.Win32.Frethoq.fnkd.17fa98aca38b558f335a0afad9ca810e
Size 34KB
Sample261012-ymc4psas7p
SHA256 4e7acb64f05afaa7db294457f40e020c4502414d9d0e0b97f1923c1c1cb62791
MD5 17fa98aca38b558f335a0afad9ca810e
SHA1 8198367d208c11edaa2fc34d728c05cbdc9124a4
SHA512 eeae4f054ff8589361cfb3bd9dece108e3d3d6e81dfb6271bc10387b10c5c7206f8fb6e7adbd95841fea2dd4ce6dd799ad622f3376d047b294c871390e1ecdcf
SSDEEP 768:XJOcSsphT92HPYXzNj75ZMfC5Chw09FRst5:XJOHeT8Hm75ZM6U6yFRc5
TLSH
T1E3F24B023A4A8463D3CB42347A515FA9CBFCBD301E459526F76277CA1DB02C7EA3A607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-GameThief.Win32.Frethoq.fnkd.17fa98aca38b558f335a0afad9ca810e

File Explorer

jaffacakes118_Trojan-GameThief.Win32.Frethoq.fnkd.17fa98aca38b558f335a0afad9ca810e

.dll 34KB

jaffacakes118_Trojan-GameThief.Win32.Frethoq.fnkd.17fa98aca38b558f335a0afad9ca810e

IMPHASH d37de8da9ca1f1532af971d9b8b99b9e
SHA256 4e7acb64f05afaa7db294457f40e020c4502414d9d0e0b97f1923c1c1cb62791
MD5 17fa98aca38b558f335a0afad9ca810e
SHA1 8198367d208c11edaa2fc34d728c05cbdc9124a4
SHA512 eeae4f054ff8589361cfb3bd9dece108e3d3d6e81dfb6271bc10387b10c5c7206f8fb6e7adbd95841fea2dd4ce6dd799ad622f3376d047b294c871390e1ecdcf
SSDEEP 768:XJOcSsphT92HPYXzNj75ZMfC5Chw09FRst5:XJOHeT8Hm75ZM6U6yFRc5
TLSH
T1E3F24B023A4A8463D3CB42347A515FA9CBFCBD301E459526F76277CA1DB02C7EA3A607
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetFileSize SetFilePointer GetLastError CreateEventA GetModuleFileNameA GetTempPathA GetWindowsDirectoryA ReadFile TerminateProcess OpenProcess SetFileAttributesA GetCommandLineA WaitForSingleObject GetSystemDirectoryA MultiByteToWideChar DeleteFileA GlobalLock CreateFileA WriteFile GlobalUnlock GlobalFree CloseHandle LoadLibraryA GetProcAddress GlobalAlloc VirtualProtect GetCurrentDirectoryA GetPrivateProfileStringA ExitProcess CreateThread IsBadReadPtr CreateToolhelp32Snapshot Sleep

user32

GetParent GetWindowThreadProcessId ReleaseDC wsprintfA GetWindowTextA GetWindowRect GetDC GetDesktopWindow

gdi32

SelectObject CreateCompatibleBitmap DeleteObject GetDIBits RealizePalette SelectPalette GetStockObject GetObjectA DeleteDC GetDeviceCaps CreateDCA CreateCompatibleDC BitBlt

advapi32

CryptHashData CryptGetHashParam CryptCreateHash CryptAcquireContextA

gdiplus

GdipCloneImage GdipAlloc GdipFree GdipGetImageEncodersSize GdipGetImageEncoders GdiplusStartup GdipDisposeImage GdiplusShutdown GdipLoadImageFromFile GdipSaveImageToFile

msvcp60

??0_Lockit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ

ws2_32

WSAStartup send recv socket inet_addr htons connect gethostbyname inet_ntoa closesocket WSACleanup

msvcrt

_access strrchr strchr atoi free __dllonexit _onexit _initterm _adjust_fdiv _getpid _stricmp _strlwr _strrev malloc wcscmp ??2@YAPAXI@Z memcpy __CxxFrameHandler strcat strncmp strstr memset sprintf strncpy strcmp strcpy strlen

netapi32

Netbios