Static task
static1
Behavioral task
behavioral1
Sample
2024-01-06_1f70f563a2c5009d532b7dac58cd9f68_floxif_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-06_1f70f563a2c5009d532b7dac58cd9f68_floxif_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-06_1f70f563a2c5009d532b7dac58cd9f68_floxif_mafia
-
Size
34.5MB
-
MD5
1f70f563a2c5009d532b7dac58cd9f68
-
SHA1
9f6625db5a7d7471d3d614fbd4ab830824e75946
-
SHA256
a1fc17c9834a1ccea4806136661016c71472b51aa12eeffc4a824b54c378824b
-
SHA512
5b924d2ccc98881e28d1f4a0e8dfa2d96bd3372f81a11289a68b44e65d29c30a3ab6e46a993849da00440ba4396009d81ad8a03626f23aadf1cbc046ba23e480
-
SSDEEP
786432:fIIk3MI9MBPFOteeLmMoco/FVtvRacfG4ufLmGp2D0Z8/RPExYhWm98ckZNDUS:I3MI9uNULmMoZ/rJDfG48LmGp2y8/RPW
Malware Config
Signatures
Files
-
2024-01-06_1f70f563a2c5009d532b7dac58cd9f68_floxif_mafia.exe windows:5 windows x86 arch:x86
34a13056204032fd2a87994fd2381dce
Code Sign
29:1e:e2:4c:14:94:42:5c:bb:6f:f7:94:f6:c8:53:01Certificate
IssuerCN=Coherent Labs CANot Before23/02/2013, 07:54Not After31/12/2039, 23:59SubjectCN=Coherent Labs7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before21/12/2012, 00:00Not After30/12/2020, 23:59SubjectCN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate
IssuerCN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=USNot Before18/10/2012, 00:00Not After29/12/2020, 23:59SubjectCN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
2c:e4:15:e5:35:c8:15:22:2c:3e:26:fe:3c:b6:a0:f8:8a:ca:c3:9aSigner
Actual PE Digest2c:e4:15:e5:35:c8:15:22:2c:3e:26:fe:3c:b6:a0:f8:8a:ca:c3:9aDigest Algorithmsha1PE Digest MatchesfalseHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedCompareExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
FormatMessageA
LocalFree
Sleep
SwitchToThread
DuplicateHandle
GetCurrentProcess
UnmapViewOfFile
CreateFileMappingA
MapViewOfFileEx
GetProcAddress
GetModuleFileNameW
GetModuleFileNameA
GetCurrentDirectoryW
GetFileAttributesW
GetTickCount
OpenEventA
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreA
OpenFileMappingA
InterlockedExchangeAdd
MoveFileExW
ReplaceFileW
MoveFileW
CopyFileW
CreateFileW
GetFileAttributesExW
SetCurrentDirectoryW
GetVolumeInformationW
GetVolumePathNameW
DeleteFileW
RemoveDirectoryW
CreateDirectoryW
GetTempPathW
GetLongPathNameW
GetTempFileNameW
SetLastError
ReadFile
WriteFile
QueryDosDeviceW
MapViewOfFile
CreateFileMappingW
SetUnhandledExceptionFilter
ReleaseMutex
LocalAlloc
CreateMutexW
SetFilePointer
OutputDebugStringA
GetCommandLineW
QueryPerformanceCounter
QueryPerformanceFrequency
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetModuleHandleW
GetNativeSystemInfo
GetVersionExW
GetDiskFreeSpaceExW
GlobalMemoryStatusEx
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
RaiseException
GetCurrentThread
CreateThread
SetThreadPriority
IsDebuggerPresent
InterlockedExchange
lstrlenW
SetFilePointerEx
SetEndOfFile
FlushFileBuffers
SetFileTime
GetFileInformationByHandle
FindClose
FindNextFileW
FindFirstFileW
OpenProcess
GetProcessId
SetInformationJobObject
GetExitCodeProcess
HeapSetInformation
SetPriorityClass
AllocConsole
AttachConsole
GetModuleHandleExA
TerminateProcess
ResumeThread
AssignProcessToJobObject
GetStdHandle
SetHandleInformation
TlsGetValue
TlsFree
TlsSetValue
TlsAlloc
GetQueuedCompletionStatus
CreateIoCompletionPort
PostQueuedCompletionStatus
ResetEvent
CreateEventW
WaitForMultipleObjects
VirtualQuery
OpenFileMappingW
GetSystemDirectoryW
GetWindowsDirectoryW
ExpandEnvironmentStringsW
GetModuleHandleExW
RtlCaptureStackBackTrace
QueueUserWorkItem
UnregisterWaitEx
RegisterWaitForSingleObject
CreateToolhelp32Snapshot
GetThreadLocale
GetACP
LoadLibraryA
FreeLibrary
CreateFileA
GetTimeZoneInformation
ConnectNamedPipe
WaitNamedPipeW
CancelIo
CreateNamedPipeW
GetNamedPipeInfo
GetEnvironmentVariableW
GlobalFree
FormatMessageW
GetComputerNameExW
GetFileSizeEx
lstrcmpiW
WideCharToMultiByte
MultiByteToWideChar
VirtualQueryEx
RtlCaptureContext
LoadLibraryW
CreateSemaphoreW
GetThreadContext
SuspendThread
OpenThread
TransactNamedPipe
SetNamedPipeHandleState
OpenMutexA
GetLocaleInfoW
GetLocalTime
VirtualAlloc
VirtualFree
HeapCreate
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
VirtualProtect
GetEnvironmentVariableA
Module32Next
Module32First
SizeofResource
LoadResource
FindResourceW
ExitProcess
SetThreadExecutionState
DeviceIoControl
DefineDosDeviceW
QueryInformationJobObject
IsProcessInJob
SetErrorMode
GetThreadTimes
GetUserDefaultLCID
GetUserDefaultLangID
GetFullPathNameW
GetSystemTime
SetThreadAffinityMask
GetProcessAffinityMask
DeleteFileA
GetDriveTypeA
GetFullPathNameA
MoveFileA
CreateDirectoryA
LockFile
UnlockFile
DebugBreak
SetEnvironmentVariableA
GetTempPathA
GetDiskFreeSpaceA
GetVolumeInformationA
GetComputerNameA
GetLogicalDrives
GlobalMemoryStatus
VirtualAllocEx
WriteProcessMemory
VirtualProtectEx
TerminateJobObject
SignalObjectAndWait
GetProcessHandleCount
GetFileType
VirtualFreeEx
CreateJobObjectW
OpenEventW
SearchPathW
ReadProcessMemory
GetSystemDirectoryA
GetTempFileNameA
IsBadWritePtr
GetFileSize
GlobalAddAtomW
GlobalDeleteAtom
lstrcmpiA
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetStringTypeW
EncodePointer
DecodePointer
UnhandledExceptionFilter
RtlUnwind
GetStartupInfoW
GetProcessHeap
GetConsoleCP
GetConsoleMode
SetStdHandle
FileTimeToLocalFileTime
FindFirstFileExA
GetFileAttributesA
ExitThread
PeekNamedPipe
GetTimeFormatA
GetDateFormatA
SetConsoleCtrlHandler
LCMapStringW
GetCPInfo
IsProcessorFeaturePresent
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
WriteConsoleW
SetEnvironmentVariableW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
GetDriveTypeW
CompareStringW
AreFileApisANSI
FindFirstChangeNotificationW
FindCloseChangeNotification
LoadLibraryExW
GetProcessTimes
GetOverlappedResult
GetUserDefaultUILanguage
LockResource
GetSystemPowerStatus
GetDateFormatW
GetTimeFormatW
GetNumberFormatW
GetCurrencyFormatW
LockFileEx
UnlockFileEx
GetDiskFreeSpaceW
CreateWaitableTimerW
SetFileAttributesA
FindFirstFileExW
SetEvent
CloseHandle
CreateEventA
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
GetSystemInfo
InterlockedDecrement
CreateProcessW
InterlockedIncrement
user32
SendInput
GetFocus
SetFocus
SetWindowsHookExW
ReleaseCapture
SetCapture
SetWindowLongA
DefWindowProcA
SetPropW
RedrawWindow
GetWindowRect
RealGetWindowClassW
EnumThreadWindows
GetClassNameW
FillRect
DrawFocusRect
DrawFrameControl
InflateRect
FrameRect
GetSysColorBrush
DrawEdge
InvertRect
GetKeyboardState
GetKeyboardLayoutList
MonitorFromRect
GetAncestor
RegisterClipboardFormatW
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
GetClipboardSequenceNumber
IsClipboardFormatAvailable
LoadIconW
WindowFromPoint
GetCursorPos
MonitorFromPoint
GetClientRect
SetRect
GetClassInfoExW
GetWindowDC
GetCursorInfo
SetThreadDesktop
GetIconInfo
RemovePropW
SetParent
OpenInputDesktop
CloseDesktop
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
CloseWindowStation
CharNextW
PostThreadMessageW
GetSysColor
GetCaretBlinkTime
GetAsyncKeyState
ReleaseDC
GetDC
DestroyWindow
UnregisterClassW
MsgWaitForMultipleObjectsEx
WaitMessage
SetTimer
PostMessageW
RegisterClassExW
CreateWindowExW
DefWindowProcW
GetQueueStatus
PostQuitMessage
CallMsgFilterW
TranslateMessage
DispatchMessageW
KillTimer
PeekMessageW
WaitForInputIdle
wsprintfW
MessageBoxW
CharUpperW
CallWindowProcW
CallNextHookEx
GetPropW
GetDoubleClickTime
GetSystemMetrics
SystemParametersInfoW
UnhookWindowsHookEx
InvalidateRect
GetCursor
SetCursor
TrackPopupMenu
GetWindowTextW
GetUserObjectInformationW
GetThreadDesktop
CreateDesktopW
CreateWindowStationW
MessageBoxA
DestroyIcon
MessageBeep
EnableWindow
GetWindowInfo
MoveWindow
LoadCursorW
RegisterClassW
BeginPaint
EndPaint
GetKeyState
EnumDisplayDevicesW
GetDesktopWindow
ClientToScreen
SetWindowLongW
RegisterDeviceNotificationW
GetWindowLongW
UnregisterDeviceNotification
ScrollDC
GetWindowThreadProcessId
RegisterWindowMessageW
GetParent
SendMessageW
SetWindowPos
GetShellWindow
MonitorFromWindow
GetMonitorInfoW
EnumDisplaySettingsW
IsWindow
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CreateProcessAsUserW
GetTokenInformation
OpenProcessToken
RegQueryInfoKeyW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegNotifyChangeKeyValue
CryptGenKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CryptDestroyKey
CreateWellKnownSid
GetSecurityInfo
SetEntriesInAclW
EqualSid
DuplicateToken
DuplicateTokenEx
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
CreateRestrictedToken
SetThreadToken
UnregisterTraceGuids
TraceEvent
RegisterTraceGuidsW
RegOpenKeyExA
RegQueryValueExA
CryptAcquireContextW
RegDeleteKeyW
CryptReleaseContext
CryptDestroyHash
CryptSignHashW
CryptSetHashParam
CryptGetHashParam
CryptCreateHash
CopySid
GetLengthSid
RegDisablePredefinedCache
RevertToSelf
SetTokenInformation
ConvertStringSidToSidW
LookupPrivilegeValueW
shlwapi
SHGetValueA
PathFindFileNameW
PathGetCharTypeW
comctl32
InitCommonControlsEx
winhttp
WinHttpGetIEProxyConfigForCurrentUser
winmm
waveOutReset
waveOutClose
waveOutWrite
waveOutOpen
timeKillEvent
timeSetEvent
timeGetTime
waveOutUnprepareHeader
timeEndPeriod
timeBeginPeriod
waveOutRestart
waveOutGetNumDevs
waveInGetNumDevs
waveInMessage
waveInPrepareHeader
waveInUnprepareHeader
waveInAddBuffer
waveInStart
waveInReset
waveInClose
waveInOpen
waveInGetDevCapsW
waveOutPause
waveOutPrepareHeader
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
setupapi
SetupDiEnumDriverInfoW
SetupDiDestroyDriverInfoList
SetupDiGetDeviceInstallParamsW
SetupDiBuildDriverInfoList
SetupDiSetDeviceInstallParamsW
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
iphlpapi
CancelIPChangeNotify
NotifyAddrChange
GetAdaptersAddresses
urlmon
CoInternetCreateSecurityManager
secur32
FreeCredentialsHandle
QuerySecurityPackageInfoW
InitializeSecurityContextW
AcquireCredentialsHandleW
DeleteSecurityContext
CompleteAuthToken
AcquireCredentialsHandleA
InitializeSecurityContextA
FreeContextBuffer
crypt32
CertOpenSystemStoreW
CertRDNValueToStrW
CertGetCertificateChain
CertFreeCertificateChainEngine
CryptAcquireCertificatePrivateKey
CertGetIntendedKeyUsage
CertVerifyTimeValidity
CertGetCertificateContextProperty
CertSetCertificateContextProperty
CryptFindOIDInfo
CryptSignAndEncodeCertificate
CryptExportPublicKeyInfoEx
CertFindChainInStore
CertCreateCertificateChainEngine
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertAddEncodedCertificateToStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CryptDecodeObjectEx
CertFindExtension
CertCompareCertificateName
CertCloseStore
CertAddCertificateContextToStore
CertOpenStore
CertAddSerializedElementToStore
CryptHashCertificate
CertGetPublicKeyLength
dhcpcsvc
DhcpRequestParams
DhcpCApiInitialize
imm32
ImmSetCandidateWindow
ImmGetCompositionStringW
ImmSetOpenStatus
ImmReleaseContext
ImmGetContext
ImmAssociateContextEx
ImmDisableTextFrameService
ws2_32
gethostbyname
recvfrom
__WSAFDIsSet
select
inet_ntoa
getservbyname
WSACreateEvent
getsockopt
WSAWaitForMultipleEvents
WSASetEvent
WSCEnumProtocols
ntohs
ntohl
WSACloseEvent
accept
send
htonl
htons
WSARecvFrom
WSASendTo
getpeername
getaddrinfo
freeaddrinfo
WSAGetOverlappedResult
WSAResetEvent
WSASend
connect
WSARecv
shutdown
WSASocketW
WSAIoctl
setsockopt
WSALookupServiceBeginW
getservbyport
WSASetLastError
WSAEventSelect
WSALookupServiceNextW
WSALookupServiceEnd
WSAStartup
WSAEnumNetworkEvents
recv
gethostbyaddr
listen
gethostname
WSAGetLastError
closesocket
bind
inet_addr
socket
getsockname
sendto
ioctlsocket
usp10
ScriptXtoCP
ScriptCPtoX
ScriptGetFontProperties
ScriptJustify
ScriptItemize
ScriptShape
ScriptFreeCache
ScriptPlace
psapi
EnumProcessModules
QueryWorkingSet
GetProcessMemoryInfo
gdi32
ModifyWorldTransform
Rectangle
GetObjectType
CreateEnhMetaFileW
CloseEnhMetaFile
GetFontData
DeleteEnhMetaFile
BitBlt
CreateRectRgn
GetDeviceCaps
CreateFontW
GetCharWidthI
GetStockObject
EnumFontFamiliesW
GetObjectW
GetCharABCWidthsW
EnumFontFamiliesExW
GetTextFaceW
GetFontUnicodeRanges
GetOutlineTextMetricsW
GetTextExtentPointI
SetTextAlign
GetWorldTransform
CreateSolidBrush
SetBkColor
CreateBitmap
StretchBlt
CreateCompatibleBitmap
StretchDIBits
GdiAlphaBlend
SetDIBitsToDevice
SetTextColor
CreateDIBSection
SetWorldTransform
SetPixelFormat
ChoosePixelFormat
SwapBuffers
CancelDC
EndDoc
CreateDCW
StartDocW
SetAbortProc
AbortPath
SetStretchBltMode
SetROP2
SetDCPenColor
SetDCBrushColor
SetArcDirection
SetBrushOrgEx
EndPath
PolyBezier
BeginPath
SetPolyFillMode
SelectClipRgn
PathToRegion
CreateRectRgnIndirect
ExtTextOutW
GdiFlush
AddFontMemResourceEx
GetGlyphIndicesW
SetGraphicsMode
SetBkMode
RemoveFontMemResourceEx
CreateFontIndirectW
CreateCompatibleDC
SelectObject
GetTextMetricsW
DeleteDC
DeleteObject
GetGlyphOutlineW
GetDIBits
PatBlt
GetICMProfileW
rpcrt4
UuidCreateSequential
UuidToStringW
RpcStringFreeW
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
winspool.drv
EnumPrintersW
OpenPrinterW
DocumentPropertiesW
ClosePrinter
GetPrinterW
comdlg32
PrintDlgW
GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW
PrintDlgExW
Exports
Exports
??0ILogHandler@Logging@Coherent@@QAE@ABV012@@Z
??0ILogHandler@Logging@Coherent@@QAE@XZ
??1IAllocator@MemoryManagement@Coherent@@UAE@XZ
??1ILogHandler@Logging@Coherent@@UAE@XZ
??4ILogHandler@Logging@Coherent@@QAEAAV012@ABV012@@Z
??_7ILogHandler@Logging@Coherent@@6B@
Sections
.text Size: 27.7MB - Virtual size: 27.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 320KB - Virtual size: 621KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.unwante Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rodata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 241KB - Virtual size: 241KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ