jaffacakes118_Trojan-GameThief[.]Win32[.]Magania[.]tzjq[.]08e8287d5dec8920aad34a9dadde55a6

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-GameThief.Win32.Magania.tzjq.08e8287d5dec8920aad34a9dadde55a6
Size 103KB
Sample261014-lfxtbaaz2y
SHA256 bcd35e36a0c11a1cd85611b28fde09cb76f91b71c6eba3e25b30d221770025eb
MD5 08e8287d5dec8920aad34a9dadde55a6
SHA1 09a727da5bbbc00694b93d11aea61b951cb6e10a
SHA512 731a19241861eec73f1572ec8cd51db11dedd0393b018a15b441d8415fb1db2ad277b005feaf31201e9ad254b218ae69a8ac8d5b75f8c50a03d16cbbc2679f4a
SSDEEP 3072:sFCMNR83pyrT0WWU7pKmNNHeRv1fa5cMixxn0ksd+:sFCaz0WplNAnClSdTsY
TLSH
T186A37D11768082FFE6A5153874C52B35DFBAB870A89D99C77707CA952C71889EF2230F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-GameThief.Win32.Magania.tzjq.08e8287d5dec8920aad34a9dadde55a6

File Explorer

jaffacakes118_Trojan-GameThief.Win32.Magania.tzjq.08e8287d5dec8920aad34a9dadde55a6

.dll 103KB

jaffacakes118_Trojan-GameThief.Win32.Magania.tzjq.08e8287d5dec8920aad34a9dadde55a6

IMPHASH 106e0a31c0a06646926f2233a36abcd3
SHA256 bcd35e36a0c11a1cd85611b28fde09cb76f91b71c6eba3e25b30d221770025eb
MD5 08e8287d5dec8920aad34a9dadde55a6
SHA1 09a727da5bbbc00694b93d11aea61b951cb6e10a
SHA512 731a19241861eec73f1572ec8cd51db11dedd0393b018a15b441d8415fb1db2ad277b005feaf31201e9ad254b218ae69a8ac8d5b75f8c50a03d16cbbc2679f4a
SSDEEP 3072:sFCMNR83pyrT0WWU7pKmNNHeRv1fa5cMixxn0ksd+:sFCaz0WplNAnClSdTsY
TLSH
T186A37D11768082FFE6A5153874C52B35DFBAB870A89D99C77707CA952C71889EF2230F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

84911

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

shlwapi

SHDeleteKeyA

msvcrt

strlen _ftol ceil memmove memcpy ??3@YAXPAX@Z __CxxFrameHandler strstr memset ??2@YAPAXI@Z memcmp strchr malloc strcpy strcmp free _except_handler3 _strnset _strrev _strnicmp _strupr _strcmpi _adjust_fdiv _initterm ??1type_info@@UAE@XZ calloc _beginthreadex wcstombs realloc strncat wcscpy _errno strncmp _snprintf atoi strncpy strrchr strcat

kernel32

SetEvent InterlockedExchange CancelIo lstrlenA lstrcatA MultiByteToWideChar GetVersionExA DeleteFileA GetLastError CreateDirectoryA GetDriveTypeA FindClose LocalFree DeleteCriticalSection LocalReAlloc FindFirstFileA LocalAlloc RemoveDirectoryA GetFileSize CreateFileA ReadFile SetFilePointer WriteFile Sleep GetModuleFileNameA SetLastError GetSystemDirectoryA ExitProcess GetCurrentProcess GetVersion DeviceIoControl CreateThread lstrcpyA WriteProcessMemory VirtualAllocEx OpenProcess GetLocalTime Process32Next Process32First CreateToolhelp32Snapshot TerminateThread CreateEventA MoveFileExA MoveFileA GetTickCount GetFileAttributesA WaitForSingleObject GlobalUnlock GlobalLock GlobalSize GlobalFree GlobalAlloc CreateProcessA CreatePipe TerminateProcess PeekNamedPipe OutputDebugStringA GlobalMemoryStatusEx GetSystemInfo OpenEventA SetErrorMode SetUnhandledExceptionFilter FreeConsole LocalSize lstrcmpiA GetCurrentThreadId InitializeCriticalSection CloseHandle LoadLibraryA GetProcAddress FreeLibrary VirtualAlloc EnterCriticalSection LeaveCriticalSection CreateRemoteThread VirtualFree FindNextFileA RaiseException

user32

IsWindow SendMessageA CloseWindow CreateWindowExA OpenDesktopA PostMessageA GetThreadDesktop GetUserObjectInformationA OpenInputDesktop SetThreadDesktop CloseDesktop IsWindowVisible GetWindowThreadProcessId GetProcessWindowStation OpenWindowStationA SetProcessWindowStation GetCursorInfo GetCursorPos ReleaseDC wsprintfA ExitWindowsEx MessageBoxA GetWindowTextA GetForegroundWindow GetAsyncKeyState GetKeyState EnumWindows LoadCursorA DestroyCursor BlockInput SystemParametersInfoA keybd_event MapVirtualKeyA SetCapture WindowFromPoint mouse_event CloseClipboard SetCursorPos GetClipboardData OpenClipboard SetClipboardData GetDesktopWindow GetDC SetRect GetSystemMetrics EmptyClipboard

gdi32

GetDIBits BitBlt DeleteDC DeleteObject CreateCompatibleDC CreateDIBSection SelectObject CreateCompatibleBitmap

advapi32

OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyA RegQueryValueExA RegSetValueExA OpenServiceA QueryServiceStatus ControlService DeleteService RegOpenKeyExA RegCloseKey RegQueryValueA SetServiceStatus RegisterServiceCtrlHandlerA RegDeleteValueA RegDeleteKeyA RegEnumValueA RegEnumKeyExA

shell32

SHGetFileInfoA

ws2_32

WSACleanup recvfrom gethostname getpeername getsockname bind inet_addr recv __WSAFDIsSet ioctlsocket send select ntohs closesocket WSAStartup connect htons socket gethostbyname inet_ntoa

msvcp60

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB

netapi32

NetLocalGroupAddMembers NetUserAdd

wininet

InternetReadFile InternetOpenUrlA InternetCloseHandle InternetOpenA

msvfw32

ICOpen ICSendMessage ICSeqCompressFrameEnd ICCompressorFree ICSeqCompressFrameStart ICSeqCompressFrame ICClose

psapi

GetModuleFileNameExA EnumProcessModules