jaffacakes118_Trojan-GameThief[.]Win32[.]Frethoq[.]ficy[.]da7b4660681b011f4abdc67e8b11081b

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-GameThief.Win32.Frethoq.ficy.da7b4660681b011f4abdc67e8b11081b
Size 33KB
Sample261014-lcb3faay61
SHA256 6c8f0c558ba4546fbf0f06b74acf5bdb6e084825d7ef542430835c98f3a57dbf
MD5 da7b4660681b011f4abdc67e8b11081b
SHA1 538fa8d75fb9aeb95cbab4aefc3de7f02bf5918c
SHA512 a4643b3cce6e88d7efa6bc0836d8953b8605579c8b552dc1e16e2a6ade01bba199016bb1ca76d1501d6bd40d0809a05b419ee6c9bd080a244f4c476a03778b5a
SSDEEP 768:JgsyV/wi4E98Pa1kHJpv7grtD6hB7cOIZvR/xBu:CsyV/t8Pxpx7grF6Y3vRju
TLSH
T13AF24B127A4785A2D2E2823176452FB68BFC78304E0752E9DF72DB4B1D754C3EA3A247
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-GameThief.Win32.Frethoq.ficy.da7b4660681b011f4abdc67e8b11081b

File Explorer

jaffacakes118_Trojan-GameThief.Win32.Frethoq.ficy.da7b4660681b011f4abdc67e8b11081b

.dll 33KB

jaffacakes118_Trojan-GameThief.Win32.Frethoq.ficy.da7b4660681b011f4abdc67e8b11081b

IMPHASH b26d289e5cc6568e5beb893d5e7fa3ac
SHA256 6c8f0c558ba4546fbf0f06b74acf5bdb6e084825d7ef542430835c98f3a57dbf
MD5 da7b4660681b011f4abdc67e8b11081b
SHA1 538fa8d75fb9aeb95cbab4aefc3de7f02bf5918c
SHA512 a4643b3cce6e88d7efa6bc0836d8953b8605579c8b552dc1e16e2a6ade01bba199016bb1ca76d1501d6bd40d0809a05b419ee6c9bd080a244f4c476a03778b5a
SSDEEP 768:JgsyV/wi4E98Pa1kHJpv7grtD6hB7cOIZvR/xBu:CsyV/t8Pxpx7grF6Y3vRju
TLSH
T13AF24B127A4785A2D2E2823176452FB68BFC78304E0752E9DF72DB4B1D754C3EA3A247
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateThread WaitForSingleObject ReadFile GetFileSize SetFilePointer GetLastError CreateEventA GetModuleFileNameA GetTempPathA GetWindowsDirectoryA GetSystemDirectoryA SetFileAttributesA GetCommandLineA CreateMutexA MultiByteToWideChar GlobalLock CreateFileA WriteFile GlobalUnlock GlobalFree CloseHandle GlobalAlloc GetCurrentDirectoryA DeleteFileA GetModuleHandleA Sleep ExitProcess IsBadReadPtr LoadLibraryA GetProcAddress VirtualProtect

user32

GetDesktopWindow GetClientRect CallWindowProcA GetClassNameA SetWindowLongA RegisterShellHookWindow RegisterWindowMessageA GetDC wsprintfA ReleaseDC EnumWindows GetKeyboardState MapVirtualKeyA GetWindowTextA ToAscii GetParent GetWindowThreadProcessId GetWindowRect

gdi32

CreateDCA GetDeviceCaps DeleteDC GetObjectA GetStockObject DeleteObject BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC GetDIBits RealizePalette SelectPalette

gdiplus

GdipSaveImageToFile GdipLoadImageFromFile GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipFree GdipAlloc GdipCloneImage GdipDisposeImage GdiplusShutdown

msvcp60

??0_Lockit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ

ws2_32

connect htons closesocket socket recv gethostbyname inet_ntoa send WSAStartup inet_addr WSACleanup

wininet

InternetReadFile InternetOpenUrlA InternetOpenA InternetCloseHandle

msvcrt

strrchr _access strcat strchr atoi strncpy strstr abs malloc free __dllonexit _onexit _initterm _adjust_fdiv _getpid _stricmp _strlwr _strrev wcscmp ??2@YAPAXI@Z __CxxFrameHandler strtok sprintf strlen strcmp memset strcpy memcpy

netapi32

Netbios