jaffacakes118_Trojan-GameThief[.]Win32[.]Frethoq[.]figm[.]62d81e9a02b2d2726f355975fef05c01

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-GameThief.Win32.Frethoq.figm.62d81e9a02b2d2726f355975fef05c01
Size 35KB
Sample261014-lcd7ssfd79
SHA256 2f4e9e38e9aac05ddb35283539310b7ec460345508e498c8b76a54a47b20d883
MD5 62d81e9a02b2d2726f355975fef05c01
SHA1 beceaf10d8e7fdbfd27ee1276b93e3feea5a51df
SHA512 a7217e580ffaee3d4975a2014b3054ca2344e893436a4bd76648cc8ae19aebb7e14b2d038f47f93394386e09eb3443d48aacca9ba81d5d1448f896f8a7275cb3
SSDEEP 768:F81qTcYVr4QjSYqv/OlU7QMh5rPKChwT9kRIH3j:W1qTn+5v57Vh5/6BkROT
TLSH
T1C7F24A133A1B80A2E1D641303A515BF2CFF8BD700E06A156FB72A39A2DF45C3DA79607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-GameThief.Win32.Frethoq.figm.62d81e9a02b2d2726f355975fef05c01

File Explorer

jaffacakes118_Trojan-GameThief.Win32.Frethoq.figm.62d81e9a02b2d2726f355975fef05c01

.dll 35KB

jaffacakes118_Trojan-GameThief.Win32.Frethoq.figm.62d81e9a02b2d2726f355975fef05c01

IMPHASH 790e168cd9faf22077f08d77382947dd
SHA256 2f4e9e38e9aac05ddb35283539310b7ec460345508e498c8b76a54a47b20d883
MD5 62d81e9a02b2d2726f355975fef05c01
SHA1 beceaf10d8e7fdbfd27ee1276b93e3feea5a51df
SHA512 a7217e580ffaee3d4975a2014b3054ca2344e893436a4bd76648cc8ae19aebb7e14b2d038f47f93394386e09eb3443d48aacca9ba81d5d1448f896f8a7275cb3
SSDEEP 768:F81qTcYVr4QjSYqv/OlU7QMh5rPKChwT9kRIH3j:W1qTn+5v57Vh5/6BkROT
TLSH
T1C7F24A133A1B80A2E1D641303A515BF2CFF8BD700E06A156FB72A39A2DF45C3DA79607
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24264

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetFileSize SetFilePointer GetLastError CreateEventA GetModuleFileNameA GetTempPathA GetWindowsDirectoryA CreateToolhelp32Snapshot ReadFile TerminateProcess OpenProcess SetFileAttributesA GetCommandLineA WaitForSingleObject GetSystemDirectoryA MultiByteToWideChar DeleteFileA GlobalLock CreateFileA WriteFile GlobalUnlock GlobalFree CloseHandle LoadLibraryA GetProcAddress GlobalAlloc VirtualProtect GetCurrentDirectoryA GetPrivateProfileStringA ExitProcess CreateThread IsBadReadPtr Sleep

user32

GetParent GetWindowThreadProcessId ReleaseDC wsprintfA GetWindowTextA GetWindowRect GetDC GetDesktopWindow

gdi32

SelectObject CreateCompatibleBitmap DeleteObject GetDIBits RealizePalette SelectPalette GetStockObject GetObjectA DeleteDC GetDeviceCaps CreateDCA CreateCompatibleDC BitBlt

advapi32

CryptHashData CryptGetHashParam CryptCreateHash CryptAcquireContextA

gdiplus

GdipCloneImage GdipAlloc GdipFree GdipGetImageEncodersSize GdipGetImageEncoders GdiplusStartup GdipSaveImageToFile GdiplusShutdown GdipLoadImageFromFile GdipDisposeImage

msvcp60

??0_Lockit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ

ws2_32

inet_ntoa send recv socket inet_addr htons connect closesocket gethostbyname WSACleanup WSAStartup

msvcrt

_access strrchr strchr atoi free __dllonexit _onexit _initterm _adjust_fdiv _getpid _stricmp _strlwr _strrev malloc wcscmp ??2@YAPAXI@Z memcpy __CxxFrameHandler strcat strncmp strstr memset sprintf strncpy strcmp strcpy strlen

netapi32

Netbios