avast_decryptor_mafiaware666[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

avast_decryptor_mafiaware666.exe
Size

2.8MB
MD5

9d3d1937ca41c2e12b54eb478998e1c5
SHA1

400fd47d059287b59d5a2fd4bb576ce11820578a
SHA256

7ed79eb83be288e05ece943317d2c8e5122d25771ffe4cd7771403776c848941
SHA512

58364c0822f1501fc1a8ea32cf6eb65cbfa32f1d284f476935d94d2d81ef20a1b7a6f1355245864173347ab2a926fab62939c0792625cc2c8cad97649bb76648
SSDEEP

49152:hARKp949+kK8iEg8lCFbVsngUUvVshnkhUvCJnUF242vrHdefVUM7:uy6oZ8iEgZFB4gUUvqhsUuUQv4VD7

Score

1^/10

Malware Config

Signatures

Files

avast_decryptor_mafiaware666.exe
.exe windows:6 windows x86 arch:x86

44ec16a65a77f4e128cf09a244508c5a

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ff
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

16/09/2022, 00:00

Not After

17/09/2025, 23:59

Subject

CN=Avast Software s.r.o.,O=Avast Software s.r.o.,L=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ff
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

16/09/2022, 00:00

Not After

17/09/2025, 23:59

Subject

CN=Avast Software s.r.o.,O=Avast Software s.r.o.,L=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cf:50:e5:c0:3a:3c:df:1d:a8:fc:78:07:3b:f9:52:23:e4:bf:fa:a3:01:9a:86:2e:f3:7d:7a:0b:68:cc:d5:36
Signer

Actual PE Digest

cf:50:e5:c0:3a:3c:df:1d:a8:fc:78:07:3b:f9:52:23:e4:bf:fa:a3:01:9a:86:2e:f3:7d:7a:0b:68:cc:d5:36

Digest Algorithm

sha256

PE Digest Matches

true

3d:54:37:1a:e9:94:e0:14:15:95:2d:76:b7:d7:ee:e6:b7:73:97:f7
Signer

Actual PE Digest

3d:54:37:1a:e9:94:e0:14:15:95:2d:76:b7:d7:ee:e6:b7:73:97:f7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualQueryEx
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetSystemTimeAsFileTime
CreateProcessW
CopyFileW
SetEndOfFile
GetLogicalDrives
GetDateFormatW
GetModuleHandleW
CreateThread
SetEvent
Sleep
CreateEventW
GetExitCodeProcess
WaitForSingleObject
GetCurrentProcess
GetCurrentThread
GetVersionExW
GetProcessHeap
MapViewOfFile
DecodePointer
WriteConsoleW
HeapSize
GetTimeZoneInformation
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
CreateFileMappingW
ReadProcessMemory
SetStdHandle
GetConsoleOutputCP
FlushFileBuffers
LCMapStringW
CompareStringW
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
SetConsoleCtrlHandler
GetCommandLineW
GetCommandLineA
LoadLibraryExW
EncodePointer
RaiseException
FindResourceW
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryA
FreeLibrary
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
VirtualAlloc
TerminateProcess
K32GetProcessImageFileNameW
GetVersionExA
ExpandEnvironmentStringsA
GetComputerNameA
GetCurrentThreadId
ExitProcess
IsDebuggerPresent
GetSystemTime
GetFullPathNameW
GetCurrentProcessId
DuplicateHandle
OpenProcess
OpenFileMappingW
GetLongPathNameW
SizeofResource
LockResource
GetCurrentDirectoryW
HeapReAlloc
GetSystemInfo
GetFileSizeEx
SystemTimeToFileTime
GetFileSize
InitializeCriticalSection
GetFileInformationByHandle
SetFilePointer
GetTickCount
GetProcAddress
LoadLibraryW
SetFilePointerEx
CompareFileTime
FindClose
FindNextFileW
FindFirstFileW
ExpandEnvironmentStringsW
GetFileAttributesW
DeleteFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
SetLastError
HeapFree
WriteFile
HeapAlloc
CloseHandle
UnmapViewOfFile
ReadFile
WideCharToMultiByte
GetLocalTime
OutputDebugStringW
GetLastError
MultiByteToWideChar
CreateFileW
GetModuleFileNameW
LeaveCriticalSection
DeleteFiber
SwitchToFiber
GetModuleHandleExW
QueryPerformanceCounter
GetFileType
GetEnvironmentVariableW
GetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
LoadResource
MoveFileExW
SetFileAttributesW
FormatMessageW
GetSystemDirectoryW
GetTempPathW
GetComputerNameW
RtlUnwind
GetDriveTypeW
EnterCriticalSection
DeleteCriticalSection
FindFirstFileExW

user32

ReleaseDC
SetWindowPos
LoadIconW
SetWindowTextW
GetClientRect
LoadImageW
ClientToScreen
GetParent
SetWindowLongW
SetClassLongW
GetWindowLongW
GetFocus
GetWindowThreadProcessId
PostMessageW
DrawTextExW
KillTimer
ShowWindow
GetProcessWindowStation
GetUserObjectInformationW
DialogBoxParamW
EndDialog
EnumWindows
CharUpperA
GetDC
GetDlgItem
GetWindowTextW
GetClassNameW
CharLowerBuffW
MessageBoxW
IsCharAlphaNumericW
SetFocus
GetWindowRect
CharUpperBuffW
SystemParametersInfoW
IsCharAlphaW
SetDlgItemTextW
GetDlgCtrlID
MoveWindow
FindWindowW
CheckDlgButton
CreateCursor
LoadCursorW
FillRect
GetWindow
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
IsWindow
GetDesktopWindow
GetAsyncKeyState
EnableWindow
GetSystemMetrics
GetWindowTextLengthW
SetTimer
IsDlgButtonChecked
InvalidateRect
CallWindowProcW
DestroyIcon
SetCursor
LoadStringW
IsWindowVisible
GetDlgItemTextW
SendMessageW

gdi32

SetBkMode
TextOutW
SetTextColor
GetStockObject
GetTextExtentPoint32W
DeleteObject
GetObjectW
SelectObject
CreateFontIndirectW
GetDeviceCaps

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

GetUserNameW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CloseEventLog
ReadEventLogW
OpenEventLogW
CryptAcquireContextW
RegQueryValueExA
GetUserNameA
GetCurrentHwProfileW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegSetValueExW
RegDeleteValueW
GetTokenInformation
FreeSid
AccessCheck
IsValidSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
AllocateAndInitializeSid
DuplicateToken
OpenProcessToken
OpenThreadToken
RegQueryValueExW
RegQueryInfoKeyW
RegCloseKey
RegOpenKeyExW
CryptDecrypt
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptEnumProvidersW

shell32

SHBrowseForFolderW
DragAcceptFiles
DragQueryFileW
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetFolderPathA
SHGetPathFromIDListW
SHGetFileInfoW
SHGetMalloc
SHGetFolderPathW
ShellExecuteW

ole32

CoCreateInstance
CLSIDFromProgID
CoGetClassObject
CoInitialize

oleaut32

SysFreeString
SysAllocString

ntdll

NtEnumerateValueKey
NtSetInformationFile

comctl32

PropertySheetW
ord17
CreatePropertySheetPageW

shlwapi

PathFindFileNameW

crypt32

CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CertOpenStore

ws2_32

socket
setsockopt
connect
closesocket
WSASetLastError
send
recv
getnameinfo
freeaddrinfo
getaddrinfo
WSAGetLastError
WSACleanup
WSAStartup
ntohs
getsockopt
ioctlsocket
shutdown

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

mpr

WNetOpenEnumW
WNetCloseEnum
WNetEnumResourceW

bcrypt

BCryptGenRandom

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.gcode
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 596KB - Virtual size: 595KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 158KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 288KB - Virtual size: 287KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

44ec16a65a77f4e128cf09a244508c5a

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ffCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ffCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

cf:50:e5:c0:3a:3c:df:1d:a8:fc:78:07:3b:f9:52:23:e4:bf:fa:a3:01:9a:86:2e:f3:7d:7a:0b:68:cc:d5:36Signer

3d:54:37:1a:e9:94:e0:14:15:95:2d:76:b7:d7:ee:e6:b7:73:97:f7Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

ntdll

comctl32

shlwapi

crypt32

ws2_32

version

mpr

bcrypt

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.gcode Size: 5KB - Virtual size: 4KB

.rdata Size: 596KB - Virtual size: 595KB

.data Size: 158KB - Virtual size: 175KB

.gdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 288KB - Virtual size: 287KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ff
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ff
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

cf:50:e5:c0:3a:3c:df:1d:a8:fc:78:07:3b:f9:52:23:e4:bf:fa:a3:01:9a:86:2e:f3:7d:7a:0b:68:cc:d5:36
Signer

3d:54:37:1a:e9:94:e0:14:15:95:2d:76:b7:d7:ee:e6:b7:73:97:f7
Signer

.text
Size: 1.7MB - Virtual size: 1.7MB

.gcode
Size: 5KB - Virtual size: 4KB

.rdata
Size: 596KB - Virtual size: 595KB

.data
Size: 158KB - Virtual size: 175KB

.gdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 288KB - Virtual size: 287KB