2023-08-26_0cf78cfac4b8f16ceda9d1c6fc3459e9_mafia_virut_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2023-08-26_0cf78cfac4b8f16ceda9d1c6fc3459e9_mafia_virut_JC.exe
Size

738KB
MD5

0cf78cfac4b8f16ceda9d1c6fc3459e9
SHA1

ad58bc67883519734e1500b7daebe5c6d95ac86f
SHA256

3ec0cc04c9236ff782cade012948d3cf27bc4fb524671fac3254e2bb7fd4e1d4
SHA512

f6e77791979704c21c0236f6f31730d9f35e447b0266452bab501fd7f6bd5033db036a26fa6f09c5b43a48ea45ee09c38edbbe8f97ff00ebed86406267ffdbf5
SSDEEP

12288:euKogsSPBlzb2WOBk/BaCXwzeKt2CwDseTIhIo:gmaBlzb2WOOYCXwqRCQ3TIOo

Score

1^/10

Malware Config

Signatures

Files

2023-08-26_0cf78cfac4b8f16ceda9d1c6fc3459e9_mafia_virut_JC.exe
.exe windows:5 windows x86

34cf9f36f6eab5737b7bf9ac287cabd3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/01/2016, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/12/2015, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fb:8f:36:26:7e:fa:0b:49:12:5c:d8:b9:c9:7b:a3:86:10:a6:1b:43:e0:69:c4:9d:44:ff:9f:94:1e:be:a5:38
Signer

Actual PE Digest

fb:8f:36:26:7e:fa:0b:49:12:5c:d8:b9:c9:7b:a3:86:10:a6:1b:43:e0:69:c4:9d:44:ff:9f:94:1e:be:a5:38

Digest Algorithm

sha256

PE Digest Matches

false

58:d8:9f:61:29:6e:7a:6f:1f:b0:05:6e:fc:ce:22:a2:36:47:31:98
Signer

Actual PE Digest

58:d8:9f:61:29:6e:7a:6f:1f:b0:05:6e:fc:ce:22:a2:36:47:31:98

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WriteFile
CreateFileW
WaitForSingleObject
CreateProcessW
GetProcessId
TerminateThread
CreateThread
IsBadWritePtr
WritePrivateProfileStringW
GetPrivateProfileIntW
LoadLibraryA
InitializeCriticalSection
DeviceIoControl
GetCurrentProcessId
SetFilePointer
GetFileType
DuplicateHandle
ReadFile
DosDateTimeToFileTime
GetCurrentDirectoryW
SetFileTime
SetFileAttributesW
GlobalFree
GlobalAlloc
DeleteAtom
FindAtomW
ReleaseMutex
AddAtomW
OpenThread
GetAtomNameW
CreateMutexW
GetLocalTime
FormatMessageW
GetFileSizeEx
SetFilePointerEx
LocalFileTimeToFileTime
SetEndOfFile
WriteConsoleW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
InterlockedExchange
SetConsoleCtrlHandler
CreateFileA
FlushFileBuffers
FatalAppExitA
CopyFileW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
LCMapStringW
LocalFree
SetHandleCount
SetStdHandle
GetConsoleMode
GetConsoleCP
HeapSize
HeapReAlloc
GetStdHandle
ExitProcess
HeapDestroy
HeapCreate
GetStringTypeW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
RtlUnwind
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
LoadLibraryW
LockResource
LoadLibraryExW
FindResourceW
MoveFileExW
Sleep
DeleteFileW
WriteProcessMemory
VirtualProtect
WideCharToMultiByte
ExpandEnvironmentStringsW
GetSystemTime
SystemTimeToFileTime
GetVersionExW
GetCommandLineW
GetTickCount
CreateDirectoryW
lstrcmpiW
InterlockedIncrement
GetModuleHandleW
GetProcAddress
lstrlenW
GetCurrentThreadId
MultiByteToWideChar
InterlockedDecrement
GetCurrentProcess
FlushInstructionCache
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
EnterCriticalSection
SizeofResource
LoadResource
FreeLibrary
GetModuleFileNameW
RaiseException
lstrcpyW
lstrcatW
OutputDebugStringW
DebugBreak
lstrlenA
GetLocaleInfoW
SetLastError

user32

IsWindow
MessageBoxW
DefWindowProcW
DispatchMessageW
TranslateMessage
PeekMessageW
SetActiveWindow
SetForegroundWindow
DialogBoxParamW
SetTimer
KillTimer
AdjustWindowRectEx
GetWindow
GetTopWindow
DestroyWindow
GetMonitorInfoW
MonitorFromWindow
GetWindowRect
GetParent
LoadStringW
FindWindowExW
UnregisterClassA
wvsprintfW
SetWindowLongW
FindWindowW
DrawFocusRect
DrawTextW
DrawEdge
BringWindowToTop
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
ReleaseDC
GetDC
PostThreadMessageW
SetWindowPos
GetDlgItem
GetClientRect
EndDialog
SendMessageW
CreateWindowExW
GetWindowLongW
PostMessageW
SetWindowTextW
GetWindowTextW
GetMenu
ScreenToClient
MapWindowPoints
CharNextW
GetMessageW
CharLowerA
SendMessageTimeoutW
CallWindowProcW
ClientToScreen
UpdateWindow
IsWindowEnabled
InvalidateRect
SetCapture
GetDlgCtrlID
SystemParametersInfoW
GetCapture
EnumWindows
wsprintfW
MoveWindow
LoadImageW
EndPaint
BeginPaint
GetSystemMetrics
InflateRect
GetSysColor
OffsetRect
PtInRect
ReleaseCapture
ShowWindow

gdi32

SetBkColor
ExtTextOutW
GetObjectW
CreateFontW
CreateSolidBrush
DeleteDC
SetTextColor
SelectObject
SetBkMode
GetDeviceCaps
DeleteObject
GetDIBits

advapi32

AllocateAndInitializeSid
OpenProcessToken
GetTokenInformation
RegQueryValueExA
EqualSid
FreeSid
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW

shell32

CommandLineToArgvW
ShellExecuteExW

ole32

CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
OleUninitialize
OleInitialize
CreateBindCtx
CreateStreamOnHGlobal
CLSIDFromString
CoTaskMemRealloc

oleaut32

SysFreeString
VarUI4FromStr

shlwapi

PathFileExistsW
PathCombineW
SHGetValueW
PathAppendW
StrStrIW
PathFindFileNameW
SHSetValueW
UrlCreateFromPathW
PathRenameExtensionW
PathMatchSpecW
StrToIntW
StrStrW

comctl32

InitCommonControlsEx
ImageList_GetIconSize
ImageList_SetImageCount
ImageList_Create
ImageList_Add
_TrackMouseEvent
ImageList_Draw
ImageList_Destroy

wininet

HttpQueryInfoW
HttpOpenRequestW
InternetReadFile
InternetCloseHandle
InternetSetOptionW
HttpSendRequestW
InternetQueryOptionW
InternetOpenUrlW
InternetCrackUrlW
InternetOpenW
InternetConnectW

urlmon

CoGetClassObjectFromURL
RegisterBindStatusCallback

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

gdiplus

GdipCloneImage
GdipDrawImageRectRectI
GdipSetSmoothingMode
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree

cryptui

CryptUIWizImport

crypt32

CertCloseStore
CertOpenSystemStoreW
CertGetNameStringW

wintrust

WinVerifyTrust
CryptCATCatalogInfoFromContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
WTHelperProvDataFromStateData
CryptCATAdminReleaseCatalogContext
CryptCATAdminCalcHashFromFileHandle

Sections

.text
Size: 353KB - Virtual size: 353KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 265KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

34cf9f36f6eab5737b7bf9ac287cabd3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18Certificate

Extended Key Usages

Key Usages

Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

fb:8f:36:26:7e:fa:0b:49:12:5c:d8:b9:c9:7b:a3:86:10:a6:1b:43:e0:69:c4:9d:44:ff:9f:94:1e:be:a5:38Signer

58:d8:9f:61:29:6e:7a:6f:1f:b0:05:6e:fc:ce:22:a2:36:47:31:98Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

wininet

urlmon

version

gdiplus

cryptui

crypt32

wintrust

Sections

.text Size: 353KB - Virtual size: 353KB

.rdata Size: 73KB - Virtual size: 73KB

.data Size: 9KB - Virtual size: 22KB

.rsrc Size: 36KB - Virtual size: 35KB

Size: 265KB - Virtual size: 265KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

fb:8f:36:26:7e:fa:0b:49:12:5c:d8:b9:c9:7b:a3:86:10:a6:1b:43:e0:69:c4:9d:44:ff:9f:94:1e:be:a5:38
Signer

58:d8:9f:61:29:6e:7a:6f:1f:b0:05:6e:fc:ce:22:a2:36:47:31:98
Signer

.text
Size: 353KB - Virtual size: 353KB

.rdata
Size: 73KB - Virtual size: 73KB

.data
Size: 9KB - Virtual size: 22KB

.rsrc
Size: 36KB - Virtual size: 35KB