2023-08-26_19af09f91341e2ff65ad3eb2c8a33692_mafia_virut_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2023-08-26_19af09f91341e2ff65ad3eb2c8a33692_mafia_virut_JC.exe
Size

857KB
MD5

19af09f91341e2ff65ad3eb2c8a33692
SHA1

8a5c72455612cf4434c44d8b30b4ceed1492b4ab
SHA256

7d54e417a9eadf9bfb3ec805bc2fd62b37e2a406ce2097b58613d197d51e0d5c
SHA512

d99fdd0db0bafb5cfef78ef7934d8670174728417b4ca7496b57d7339a7d61a812fe725f791b68c91c6a0bf804eacb414f60f9d6d2edeb0512aa160c87d495de
SSDEEP

12288:4uKogsSPBlzb2WOBk/BaCXwzeKt2CwDseTIhIo:umaBlzb2WOOYCXwqRCQ3TIOo

Score

1^/10

Malware Config

Signatures

Files

2023-08-26_19af09f91341e2ff65ad3eb2c8a33692_mafia_virut_JC.exe
.exe windows:5 windows x86

34cf9f36f6eab5737b7bf9ac287cabd3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/01/2016, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/12/2015, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7e:5d:e8:7a:9f:59:fa:88:1c:04:87:5e:76:7d:f4:b0:71:5e:22:72:89:3c:65:86:3c:14:ef:f5:96:02:88:b8
Signer

Actual PE Digest

7e:5d:e8:7a:9f:59:fa:88:1c:04:87:5e:76:7d:f4:b0:71:5e:22:72:89:3c:65:86:3c:14:ef:f5:96:02:88:b8

Digest Algorithm

sha256

PE Digest Matches

false

5d:b8:8e:38:09:bb:73:c1:14:25:d2:b2:fa:08:3c:2d:8e:e0:9c:b1
Signer

Actual PE Digest

5d:b8:8e:38:09:bb:73:c1:14:25:d2:b2:fa:08:3c:2d:8e:e0:9c:b1

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WriteFile
CreateFileW
WaitForSingleObject
CreateProcessW
GetProcessId
TerminateThread
CreateThread
IsBadWritePtr
WritePrivateProfileStringW
GetPrivateProfileIntW
LoadLibraryA
InitializeCriticalSection
DeviceIoControl
GetCurrentProcessId
SetFilePointer
GetFileType
DuplicateHandle
ReadFile
DosDateTimeToFileTime
GetCurrentDirectoryW
SetFileTime
SetFileAttributesW
GlobalFree
GlobalAlloc
DeleteAtom
FindAtomW
ReleaseMutex
AddAtomW
OpenThread
GetAtomNameW
CreateMutexW
GetLocalTime
FormatMessageW
GetFileSizeEx
SetFilePointerEx
LocalFileTimeToFileTime
SetEndOfFile
WriteConsoleW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
InterlockedExchange
SetConsoleCtrlHandler
CreateFileA
FlushFileBuffers
FatalAppExitA
CopyFileW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
LCMapStringW
LocalFree
SetHandleCount
SetStdHandle
GetConsoleMode
GetConsoleCP
HeapSize
HeapReAlloc
GetStdHandle
ExitProcess
HeapDestroy
HeapCreate
GetStringTypeW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
RtlUnwind
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
LoadLibraryW
LockResource
LoadLibraryExW
FindResourceW
MoveFileExW
Sleep
DeleteFileW
WriteProcessMemory
VirtualProtect
WideCharToMultiByte
ExpandEnvironmentStringsW
GetSystemTime
SystemTimeToFileTime
GetVersionExW
GetCommandLineW
GetTickCount
CreateDirectoryW
lstrcmpiW
InterlockedIncrement
GetModuleHandleW
GetProcAddress
lstrlenW
GetCurrentThreadId
MultiByteToWideChar
InterlockedDecrement
GetCurrentProcess
FlushInstructionCache
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
EnterCriticalSection
SizeofResource
LoadResource
FreeLibrary
GetModuleFileNameW
RaiseException
lstrcpyW
lstrcatW
OutputDebugStringW
DebugBreak
lstrlenA
GetLocaleInfoW
SetLastError

user32

IsWindow
MessageBoxW
DefWindowProcW
DispatchMessageW
TranslateMessage
PeekMessageW
SetActiveWindow
SetForegroundWindow
DialogBoxParamW
SetTimer
KillTimer
AdjustWindowRectEx
GetWindow
GetTopWindow
DestroyWindow
GetMonitorInfoW
MonitorFromWindow
GetWindowRect
GetParent
LoadStringW
FindWindowExW
UnregisterClassA
wvsprintfW
SetWindowLongW
FindWindowW
DrawFocusRect
DrawTextW
DrawEdge
BringWindowToTop
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
ReleaseDC
GetDC
PostThreadMessageW
SetWindowPos
GetDlgItem
GetClientRect
EndDialog
SendMessageW
CreateWindowExW
GetWindowLongW
PostMessageW
SetWindowTextW
GetWindowTextW
GetMenu
ScreenToClient
MapWindowPoints
CharNextW
GetMessageW
CharLowerA
SendMessageTimeoutW
CallWindowProcW
ClientToScreen
UpdateWindow
IsWindowEnabled
InvalidateRect
SetCapture
GetDlgCtrlID
SystemParametersInfoW
GetCapture
EnumWindows
wsprintfW
MoveWindow
LoadImageW
EndPaint
BeginPaint
GetSystemMetrics
InflateRect
GetSysColor
OffsetRect
PtInRect
ReleaseCapture
ShowWindow

gdi32

SetBkColor
ExtTextOutW
GetObjectW
CreateFontW
CreateSolidBrush
DeleteDC
SetTextColor
SelectObject
SetBkMode
GetDeviceCaps
DeleteObject
GetDIBits

advapi32

AllocateAndInitializeSid
OpenProcessToken
GetTokenInformation
RegQueryValueExA
EqualSid
FreeSid
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW

shell32

CommandLineToArgvW
ShellExecuteExW

ole32

CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
OleUninitialize
OleInitialize
CreateBindCtx
CreateStreamOnHGlobal
CLSIDFromString
CoTaskMemRealloc

oleaut32

SysFreeString
VarUI4FromStr

shlwapi

PathFileExistsW
PathCombineW
SHGetValueW
PathAppendW
StrStrIW
PathFindFileNameW
SHSetValueW
UrlCreateFromPathW
PathRenameExtensionW
PathMatchSpecW
StrToIntW
StrStrW

comctl32

InitCommonControlsEx
ImageList_GetIconSize
ImageList_SetImageCount
ImageList_Create
ImageList_Add
_TrackMouseEvent
ImageList_Draw
ImageList_Destroy

wininet

HttpQueryInfoW
HttpOpenRequestW
InternetReadFile
InternetCloseHandle
InternetSetOptionW
HttpSendRequestW
InternetQueryOptionW
InternetOpenUrlW
InternetCrackUrlW
InternetOpenW
InternetConnectW

urlmon

CoGetClassObjectFromURL
RegisterBindStatusCallback

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

gdiplus

GdipCloneImage
GdipDrawImageRectRectI
GdipSetSmoothingMode
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree

cryptui

CryptUIWizImport

crypt32

CertCloseStore
CertOpenSystemStoreW
CertGetNameStringW

wintrust

WinVerifyTrust
CryptCATCatalogInfoFromContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
WTHelperProvDataFromStateData
CryptCATAdminReleaseCatalogContext
CryptCATAdminCalcHashFromFileHandle

Sections

.text
Size: 353KB - Virtual size: 353KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 383KB - Virtual size: 383KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

34cf9f36f6eab5737b7bf9ac287cabd3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18Certificate

Extended Key Usages

Key Usages

Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

7e:5d:e8:7a:9f:59:fa:88:1c:04:87:5e:76:7d:f4:b0:71:5e:22:72:89:3c:65:86:3c:14:ef:f5:96:02:88:b8Signer

5d:b8:8e:38:09:bb:73:c1:14:25:d2:b2:fa:08:3c:2d:8e:e0:9c:b1Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

wininet

urlmon

version

gdiplus

cryptui

crypt32

wintrust

Sections

.text Size: 353KB - Virtual size: 353KB

.rdata Size: 73KB - Virtual size: 73KB

.data Size: 9KB - Virtual size: 22KB

.rsrc Size: 36KB - Virtual size: 35KB

Size: 383KB - Virtual size: 383KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

7e:5d:e8:7a:9f:59:fa:88:1c:04:87:5e:76:7d:f4:b0:71:5e:22:72:89:3c:65:86:3c:14:ef:f5:96:02:88:b8
Signer

5d:b8:8e:38:09:bb:73:c1:14:25:d2:b2:fa:08:3c:2d:8e:e0:9c:b1
Signer

.text
Size: 353KB - Virtual size: 353KB

.rdata
Size: 73KB - Virtual size: 73KB

.data
Size: 9KB - Virtual size: 22KB

.rsrc
Size: 36KB - Virtual size: 35KB