jaffacakes118_Trojan-GameThief[.]Win32[.]Frethoq[.]fmnj[.]a0921c4ae04178e0836e319eb44ec798

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-GameThief.Win32.Frethoq.fmnj.a0921c4ae04178e0836e319eb44ec798
Size 34KB
Sample261014-ldsrksfd84
SHA256 8a2e27630b8c8642c6e3f10fc4423718bbeb6805430c1245ebb69e3086eb1b03
MD5 a0921c4ae04178e0836e319eb44ec798
SHA1 4aafedb297aa0b2280bee993855865f621024f59
SHA512 1bf3e4dd9f28db95cf7469536b8b6beeb9492d6f9fa75925893d12456816c8351b2db5319acbbe948f9cd3572db56972454be8d20b4a773fd892d7ba2dbdb97a
SSDEEP 768:NqCM7tWeKCJfaEtOexFjAOll7wzxOSO1m2OMjRGgKr:NqR7OotOe3MOf7wzxoRRN2
TLSH
T113F27D56BA4785A3E1E3823076912BB58FF828341E0755E9DB73CB8B1DB05C7DA39207
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-GameThief.Win32.Frethoq.fmnj.a0921c4ae04178e0836e319eb44ec798

File Explorer

jaffacakes118_Trojan-GameThief.Win32.Frethoq.fmnj.a0921c4ae04178e0836e319eb44ec798

.dll 34KB

jaffacakes118_Trojan-GameThief.Win32.Frethoq.fmnj.a0921c4ae04178e0836e319eb44ec798

IMPHASH d2843db7548636cea3993eec6a3f2acc
SHA256 8a2e27630b8c8642c6e3f10fc4423718bbeb6805430c1245ebb69e3086eb1b03
MD5 a0921c4ae04178e0836e319eb44ec798
SHA1 4aafedb297aa0b2280bee993855865f621024f59
SHA512 1bf3e4dd9f28db95cf7469536b8b6beeb9492d6f9fa75925893d12456816c8351b2db5319acbbe948f9cd3572db56972454be8d20b4a773fd892d7ba2dbdb97a
SSDEEP 768:NqCM7tWeKCJfaEtOexFjAOll7wzxOSO1m2OMjRGgKr:NqR7OotOe3MOf7wzxoRRN2
TLSH
T113F27D56BA4785A3E1E3823076912BB58FF828341E0755E9DB73CB8B1DB05C7DA39207
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25496

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GlobalLock GetSystemDirectoryA CreateThread WaitForSingleObject SetFilePointer GetLastError CreateEventA GetModuleFileNameA GetTempPathA GetWindowsDirectoryA GlobalUnlock SetFileAttributesA ExitProcess GetCommandLineA CreateMutexA GlobalFree LoadLibraryA GetProcAddress GlobalAlloc VirtualProtect Sleep MultiByteToWideChar GetCurrentDirectoryA GetFileAttributesA GetPrivateProfileStringA DeleteFileA CreateFileA GetFileSize ReadFile CloseHandle WideCharToMultiByte WriteFile

user32

GetParent GetWindowThreadProcessId EnumWindows wsprintfA GetWindowTextA ReleaseDC GetWindowRect GetDC GetDesktopWindow GetClientRect CallWindowProcA GetClassNameA SetWindowLongA RegisterShellHookWindow RegisterWindowMessageA

gdi32

CreateDCA GetDeviceCaps DeleteObject BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC GetDIBits RealizePalette SelectPalette GetStockObject GetObjectA DeleteDC

gdiplus

GdipCloneImage GdipAlloc GdipFree GdipGetImageEncodersSize GdipGetImageEncoders GdiplusStartup GdipDisposeImage GdiplusShutdown GdipSaveImageToFile GdipLoadImageFromFile

msvcp60

??0_Lockit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ

ws2_32

inet_ntoa send recv socket inet_addr htons connect closesocket gethostbyname WSACleanup WSAStartup

wininet

InternetOpenUrlA InternetOpenA InternetReadFile InternetCloseHandle

msvcrt

strrchr _access strcat strchr strncpy abs malloc wcscmp __dllonexit _onexit _initterm _adjust_fdiv _getpid _stricmp _strlwr _strrev free memcpy __CxxFrameHandler strcmp atoi wcscpy sprintf strcpy fopen fgets strstr fclose ??2@YAPAXI@Z memset strlen

netapi32

Netbios