414bfded84c5135d7cf7c5ea56bf8fdf_floxif_mafia_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

414bfded84c5135d7cf7c5ea56bf8fdf_floxif_mafia_JC.exe
Size

428KB
MD5

414bfded84c5135d7cf7c5ea56bf8fdf
SHA1

d43ca12c36fbb498b4ec423a8cf7209980b6b4e6
SHA256

2db9f34bacffce1124a425a329077799652fdc4b654887a66296ede3e3b786cb
SHA512

9407c97a766f348803ab34644e4be61628ef82cbbf480df00f707babf1c8cc891292b87c4f9675c114b52b832f906c4a99d22f2e2bf4090cb02f5998e0db1c74
SSDEEP

12288:vniFgRi5dlTkoCD06hhh2hqEw+Vhr2+lewe50BjvrEH7E:PiFgs5/TkrD06baFhC+lew2+rEH7E

Score

1^/10

Malware Config

Signatures

Files

414bfded84c5135d7cf7c5ea56bf8fdf_floxif_mafia_JC.exe
.exe windows x86

6fb10b64e6c39a0b70e6a782ab7e8363

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:21:5c:86:c4:b0:62:95:ab:34:e7:76:56:64:09:96
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

30/08/2011, 00:00

Not After

23/09/2014, 23:59

Subject

CN=Banco Bradesco S.A.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=4253 / Depto de Desenvolvimento de Sistemas,O=Banco Bradesco S.A.,L=Barueri,ST=Sao Paulo,C=BR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsWow64Process
GetDateFormatA
GetTimeFormatA
WaitForSingleObject
CloseHandle
CreateFileA
GetFileTime
CompareFileTime
LocalFree
GetTickCount
GetLastError
ExpandEnvironmentStringsA
FormatMessageA
GetFileAttributesA
GetFileSize
ReadFile
WriteFile
CreateDirectoryA
FindFirstFileA
FindNextFileA
FindClose
GetVersionExA
GetSystemDirectoryA
GetModuleHandleA
GetModuleFileNameA
OutputDebugStringA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetFilePointer
MoveFileExA
HeapAlloc
HeapFree
GetProcessHeap
CopyFileA
CreateThread
InterlockedDecrement
GetDiskFreeSpaceA
GetCurrentProcess
QueryPerformanceCounter
DeviceIoControl
TerminateProcess
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
SetLastError
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
WideCharToMultiByte
ExitThread
MultiByteToWideChar
GetModuleHandleW
ExitProcess
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
InterlockedIncrement
HeapSize
RaiseException
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetLocaleInfoW
InterlockedExchange
LoadLibraryW
RtlUnwind
LCMapStringW
GetStringTypeW
WriteConsoleW
SetStdHandle
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CreateFileW
SetEndOfFile
InterlockedCompareExchange
lstrlenA
DeleteFileA
LoadLibraryA
SetFileAttributesA
GetProcAddress
Sleep
SystemTimeToFileTime
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
LocalAlloc
FreeLibrary

user32

EnumDisplayDevicesA

advapi32

FreeSid
QueryServiceObjectSecurity
GetSecurityDescriptorDacl
AllocateAndInitializeSid
SetEntriesInAclA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetServiceObjectSecurity
OpenSCManagerA
OpenServiceA
CloseServiceHandle
RegisterEventSourceA
StartServiceCtrlDispatcherA
DeleteService
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
SetServiceStatus
ReportEventA
RegCreateKeyA
DeregisterEventSource
CreateServiceA
RegisterServiceCtrlHandlerA
RegSetValueExA

ole32

CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoTaskMemFree
CoUninitialize

oleaut32

SysAllocString
VariantClear
VariantInit
SysFreeString

Sections

.text
Size: 253KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6fb10b64e6c39a0b70e6a782ab7e8363

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

01:21:5c:86:c4:b0:62:95:ab:34:e7:76:56:64:09:96Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

Sections

.text Size: 253KB - Virtual size: 252KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 12KB - Virtual size: 47KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 25KB - Virtual size: 25KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

01:21:5c:86:c4:b0:62:95:ab:34:e7:76:56:64:09:96
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

.text
Size: 253KB - Virtual size: 252KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 12KB - Virtual size: 47KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 25KB - Virtual size: 25KB