jaffacakes118_Trojan-GameThief[.]Win32[.]Frethoq[.]fnjp[.]076c906becbbd7797d1d44735dd7bc3e

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-GameThief.Win32.Frethoq.fnjp.076c906becbbd7797d1d44735dd7bc3e
Size 33KB
Sample261014-leamdsswa1
SHA256 2b5d8e8411514373fe739e854debd31adbbd7ceb59a881fb19b128f4a40318ed
MD5 076c906becbbd7797d1d44735dd7bc3e
SHA1 ce0e513a3fbe9c85c752391540d18161b10f3267
SHA512 55e33677dd6f9b438e8ce7bd20b698077f0911a9f5f11bf6119529819709eb4396684b978b1de96d8804661c6dbeb35ca113cc93981e9d4cc2c7fa1fe2549f9b
SSDEEP 768:dtM1jYg7ijQdytMpnBS07HQAWphqDoRVyeUuF:dWjJS1Mpd7HzgkMRVnU8
TLSH
T1D8E24C1676478AB3E2A2423136913BB98FFC28341E075196DB32D6DB1DB45C3DB7A207
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-GameThief.Win32.Frethoq.fnjp.076c906becbbd7797d1d44735dd7bc3e

File Explorer

jaffacakes118_Trojan-GameThief.Win32.Frethoq.fnjp.076c906becbbd7797d1d44735dd7bc3e

.dll 33KB

jaffacakes118_Trojan-GameThief.Win32.Frethoq.fnjp.076c906becbbd7797d1d44735dd7bc3e

IMPHASH 73a411ad8c659fc072cc1b6730d4eb7f
SHA256 2b5d8e8411514373fe739e854debd31adbbd7ceb59a881fb19b128f4a40318ed
MD5 076c906becbbd7797d1d44735dd7bc3e
SHA1 ce0e513a3fbe9c85c752391540d18161b10f3267
SHA512 55e33677dd6f9b438e8ce7bd20b698077f0911a9f5f11bf6119529819709eb4396684b978b1de96d8804661c6dbeb35ca113cc93981e9d4cc2c7fa1fe2549f9b
SSDEEP 768:dtM1jYg7ijQdytMpnBS07HQAWphqDoRVyeUuF:dWjJS1Mpd7HzgkMRVnU8
TLSH
T1D8E24C1676478AB3E2A2423136913BB98FFC28341E075196DB32D6DB1DB45C3DB7A207
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24664

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GlobalUnlock GlobalLock GetSystemDirectoryA CreateThread WaitForSingleObject SetFilePointer GetLastError CreateEventA GetModuleFileNameA GetTempPathA GlobalFree SetFileAttributesA GetCommandLineA LoadLibraryA GetProcAddress GlobalAlloc VirtualProtect Sleep ExitProcess MultiByteToWideChar GetCurrentDirectoryA GetFileAttributesA GetPrivateProfileStringA DeleteFileA CreateFileA GetFileSize ReadFile CloseHandle WideCharToMultiByte GetWindowsDirectoryA WriteFile

user32

GetParent GetWindowThreadProcessId EnumWindows wsprintfA GetWindowTextA ReleaseDC GetWindowRect GetDC GetDesktopWindow GetClientRect CallWindowProcA GetClassNameA SetWindowLongA RegisterShellHookWindow RegisterWindowMessageA

gdi32

CreateDCA GetDeviceCaps DeleteObject BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC GetDIBits RealizePalette SelectPalette GetStockObject GetObjectA DeleteDC

gdiplus

GdipCloneImage GdipAlloc GdipFree GdipGetImageEncodersSize GdipGetImageEncoders GdipLoadImageFromFile GdipDisposeImage GdiplusShutdown GdipSaveImageToFile GdiplusStartup

msvcp60

??0_Lockit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ

ws2_32

WSAStartup send recv socket inet_addr htons connect gethostbyname inet_ntoa closesocket WSACleanup

wininet

InternetOpenUrlA InternetCloseHandle InternetReadFile InternetOpenA

msvcrt

strrchr strcat strchr _access strncpy abs malloc memcpy __CxxFrameHandler strcmp free __dllonexit _onexit _initterm _adjust_fdiv _getpid _stricmp _strlwr _strrev atoi wcscmp wcscpy sprintf strcpy fopen fgets strstr fclose ??2@YAPAXI@Z memset strlen

netapi32

Netbios