jaffacakes118_Trojan-GameThief[.]Win32[.]Frethoq[.]feiq[.]532654b499890320d93399bae79989a4

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-GameThief.Win32.Frethoq.feiq.532654b499890320d93399bae79989a4
Size 34KB
Sample261014-lbpbdaay6s
SHA256 33224f8d7d4add1773c5b57f3fb18cd9a11cdcadb34f73ffecaf021d698838d9
MD5 532654b499890320d93399bae79989a4
SHA1 c055f9f6ebb1c85c518a34fc02534fe9351679e0
SHA512 92f2551b16a8b8b7d2fd0484ee4c4b4aa6962d8120329f7c904960c9046f80eade490b80ce2ace0ed03eef8243babdfb7afa959a311e588b575369216ced7a2b
SSDEEP 768:6W+PrTlIqzOpup5HN77LOpbV7uOJzN2R0W:V+PrTlpsup7LOpRvZ2RJ
TLSH
T1DFF23A137A468462D3CB02343A121FEA8BFDBD301D469566F71277CB1DB46C2DA3A607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-GameThief.Win32.Frethoq.feiq.532654b499890320d93399bae79989a4

File Explorer

jaffacakes118_Trojan-GameThief.Win32.Frethoq.feiq.532654b499890320d93399bae79989a4

.dll 34KB

jaffacakes118_Trojan-GameThief.Win32.Frethoq.feiq.532654b499890320d93399bae79989a4

IMPHASH 12851d1a13af5faafb89c0f2d95939df
SHA256 33224f8d7d4add1773c5b57f3fb18cd9a11cdcadb34f73ffecaf021d698838d9
MD5 532654b499890320d93399bae79989a4
SHA1 c055f9f6ebb1c85c518a34fc02534fe9351679e0
SHA512 92f2551b16a8b8b7d2fd0484ee4c4b4aa6962d8120329f7c904960c9046f80eade490b80ce2ace0ed03eef8243babdfb7afa959a311e588b575369216ced7a2b
SSDEEP 768:6W+PrTlIqzOpup5HN77LOpbV7uOJzN2R0W:V+PrTlpsup7LOpRvZ2RJ
TLSH
T1DFF23A137A468462D3CB02343A121FEA8BFDBD301D469566F71277CB1DB46C2DA3A607
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24200

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLastError CreateEventA GetModuleFileNameA GetTempPathA GetWindowsDirectoryA CreateToolhelp32Snapshot SetFilePointer TerminateProcess OpenProcess SetFileAttributesA GetCommandLineA CreateMutexA GetFileSize ReadFile WaitForSingleObject GetSystemDirectoryA MultiByteToWideChar DeleteFileA GlobalLock CreateFileA WriteFile GlobalUnlock GlobalFree CloseHandle LoadLibraryA GetProcAddress GlobalAlloc VirtualProtect ExitProcess CreateThread IsBadReadPtr Sleep

user32

GetParent GetWindowThreadProcessId ReleaseDC wsprintfA GetWindowTextA GetWindowRect GetDC GetDesktopWindow

gdi32

SelectObject CreateCompatibleBitmap DeleteObject GetDIBits RealizePalette SelectPalette GetStockObject GetObjectA DeleteDC GetDeviceCaps CreateDCA CreateCompatibleDC BitBlt

advapi32

CryptHashData CryptGetHashParam CryptCreateHash CryptAcquireContextA

gdiplus

GdipCloneImage GdipAlloc GdipFree GdipGetImageEncodersSize GdipGetImageEncoders GdiplusStartup GdipSaveImageToFile GdiplusShutdown GdipLoadImageFromFile GdipDisposeImage

msvcp60

??0_Lockit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ

ws2_32

inet_ntoa send recv socket inet_addr htons connect closesocket gethostbyname WSACleanup WSAStartup

msvcrt

_access strrchr strcat strchr atoi free __dllonexit _onexit _initterm _adjust_fdiv _getpid _stricmp _strlwr _strrev malloc wcscmp ??2@YAPAXI@Z memcpy __CxxFrameHandler memcmp strstr strncmp memset sprintf strncpy strcmp strcpy strlen

netapi32

Netbios