jaffacakes118_Trojan-GameThief[.]Win32[.]OnLineGames[.]ajyuf[.]f5cf764f8adb27615d9b41cac677a510

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ajyuf.f5cf764f8adb27615d9b41cac677a510
Size 36KB
Sample261014-ljerxaswfv
SHA256 25e8fe107e697010a2461e417ecf4094f62e04c238f119a08c9efff61adf4f98
MD5 f5cf764f8adb27615d9b41cac677a510
SHA1 a59df567addb8178796696bd65227ef045a0adb0
SHA512 2eeb978965646f6e2097fc059f7494826a64a454f806b61e5ec2d7666407f166060b60e59798865be003d2bfc7bd6c01be8b8f0d8c543f0270969c9e7ba8b73f
SSDEEP 768:oWtf1lkAzsDbNNO+Ba0Z/7MQiSyCLvH/CODbhTR+6D:v1lkwK3O4aW7MzSzLvKOhTR+6D
TLSH
T1AFF23B137A57C0B2D1A6813077516BB44BB87C705E0691A6FF73B76A0DB11C2EA3AB07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ajyuf.f5cf764f8adb27615d9b41cac677a510

File Explorer

jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ajyuf.f5cf764f8adb27615d9b41cac677a510

.dll 36KB

jaffacakes118_Trojan-GameThief.Win32.OnLineGames.ajyuf.f5cf764f8adb27615d9b41cac677a510

IMPHASH b38f61c08feb2027cf7e88bb89ab54dd
SHA256 25e8fe107e697010a2461e417ecf4094f62e04c238f119a08c9efff61adf4f98
MD5 f5cf764f8adb27615d9b41cac677a510
SHA1 a59df567addb8178796696bd65227ef045a0adb0
SHA512 2eeb978965646f6e2097fc059f7494826a64a454f806b61e5ec2d7666407f166060b60e59798865be003d2bfc7bd6c01be8b8f0d8c543f0270969c9e7ba8b73f
SSDEEP 768:oWtf1lkAzsDbNNO+Ba0Z/7MQiSyCLvH/CODbhTR+6D:v1lkwK3O4aW7MzSzLvKOhTR+6D
TLSH
T1AFF23B137A57C0B2D1A6813077516BB44BB87C705E0691A6FF73B76A0DB11C2EA3AB07
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25640

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DeleteFileA MultiByteToWideChar GetSystemDirectoryA WaitForSingleObject ReadFile GetFileSize SetFilePointer GetLastError CreateEventA GetTempPathA GetWindowsDirectoryA GlobalLock SetFileAttributesA GetCommandLineA CreateFileA WriteFile GlobalUnlock GlobalFree LoadLibraryA GetProcAddress GlobalAlloc VirtualProtect CreateThread CloseHandle IsBadReadPtr GetCurrentDirectoryA GetPrivateProfileStringA Sleep GetModuleFileNameA WinExec ExitProcess

user32

GetParent GetWindowThreadProcessId ReleaseDC EnumWindows wsprintfA GetWindowTextA GetWindowRect GetDC GetDesktopWindow GetClientRect CallWindowProcA GetClassNameA SetWindowLongA RegisterShellHookWindow RegisterWindowMessageA

gdi32

CreateDCA GetDeviceCaps DeleteObject BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC GetDIBits RealizePalette SelectPalette GetStockObject GetObjectA DeleteDC

gdiplus

GdipCloneImage GdipAlloc GdipFree GdipGetImageEncodersSize GdipGetImageEncoders GdiplusStartup GdipDisposeImage GdiplusShutdown GdipLoadImageFromFile GdipSaveImageToFile

msvcp60

??0_Lockit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ

ws2_32

inet_ntoa send recv socket inet_addr htons connect closesocket gethostbyname WSACleanup WSAStartup

wininet

InternetOpenA InternetReadFile InternetOpenUrlA InternetCloseHandle

msvcrt

_access strrchr strncpy abs malloc wcscmp free __dllonexit _initterm _adjust_fdiv _getpid _itoa _stricmp _strlwr _strrev _onexit ??2@YAPAXI@Z memcpy __CxxFrameHandler strcmp memcmp memset strchr atoi sprintf strlen strstr strcpy strcat

netapi32

Netbios