2024-01-06_d2160582aae458d62fafda1a28ff421c_floxif_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-06_d2160582aae458d62fafda1a28ff421c_floxif_mafia
Size

34.5MB
MD5

d2160582aae458d62fafda1a28ff421c
SHA1

32e500cd26bbd1df0f464d4913dd1c3a6e4ecc90
SHA256

157fdcd6a775222f05b07be42b93084507e0b0c5330676113d456f0b07982e95
SHA512

165445c855d11bd8774052d658d64cc2b225c46269c3308ce8710b54e8964835ab88e32d60031200570c240d263836977f9b452093101c7548aee8a8a24bcf42
SSDEEP

786432:fIIk3MI9MBPFOteeLmMoco/FVtvRacfG4ufLmGU2D0su/RPExYhWm98ckZNDUy:I3MI9uNULmMoZ/rJDfG48LmGU2zu/RPW

Score

1^/10

Malware Config

Signatures

Files

2024-01-06_d2160582aae458d62fafda1a28ff421c_floxif_mafia
.exe windows:5 windows x86 arch:x86

34a13056204032fd2a87994fd2381dce

Code Sign

29:1e:e2:4c:14:94:42:5c:bb:6f:f7:94:f6:c8:53:01
Certificate

Issuer

CN=Coherent Labs CA

Not Before

23/02/2013, 07:54

Not After

31/12/2039, 23:59

Subject

CN=Coherent Labs

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

d7:6f:d5:cf:be:f7:ef:56:e7:20:0e:66:4a:e4:31:9f:11:7d:94:83
Signer

Actual PE Digest

d7:6f:d5:cf:be:f7:ef:56:e7:20:0e:66:4a:e4:31:9f:11:7d:94:83

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedCompareExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
FormatMessageA
LocalFree
Sleep
SwitchToThread
DuplicateHandle
GetCurrentProcess
UnmapViewOfFile
CreateFileMappingA
MapViewOfFileEx
GetProcAddress
GetModuleFileNameW
GetModuleFileNameA
GetCurrentDirectoryW
GetFileAttributesW
GetTickCount
OpenEventA
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreA
OpenFileMappingA
InterlockedExchangeAdd
MoveFileExW
ReplaceFileW
MoveFileW
CopyFileW
CreateFileW
GetFileAttributesExW
SetCurrentDirectoryW
GetVolumeInformationW
GetVolumePathNameW
DeleteFileW
RemoveDirectoryW
CreateDirectoryW
GetTempPathW
GetLongPathNameW
GetTempFileNameW
SetLastError
ReadFile
WriteFile
QueryDosDeviceW
MapViewOfFile
CreateFileMappingW
SetUnhandledExceptionFilter
ReleaseMutex
LocalAlloc
CreateMutexW
SetFilePointer
OutputDebugStringA
GetCommandLineW
QueryPerformanceCounter
QueryPerformanceFrequency
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetModuleHandleW
GetNativeSystemInfo
GetVersionExW
GetDiskFreeSpaceExW
GlobalMemoryStatusEx
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
RaiseException
GetCurrentThread
CreateThread
SetThreadPriority
IsDebuggerPresent
InterlockedExchange
lstrlenW
SetFilePointerEx
SetEndOfFile
FlushFileBuffers
SetFileTime
GetFileInformationByHandle
FindClose
FindNextFileW
FindFirstFileW
OpenProcess
GetProcessId
SetInformationJobObject
GetExitCodeProcess
HeapSetInformation
SetPriorityClass
AllocConsole
AttachConsole
GetModuleHandleExA
TerminateProcess
ResumeThread
AssignProcessToJobObject
GetStdHandle
SetHandleInformation
TlsGetValue
TlsFree
TlsSetValue
TlsAlloc
GetQueuedCompletionStatus
CreateIoCompletionPort
PostQueuedCompletionStatus
ResetEvent
CreateEventW
WaitForMultipleObjects
VirtualQuery
OpenFileMappingW
GetSystemDirectoryW
GetWindowsDirectoryW
ExpandEnvironmentStringsW
GetModuleHandleExW
RtlCaptureStackBackTrace
QueueUserWorkItem
UnregisterWaitEx
RegisterWaitForSingleObject
CreateToolhelp32Snapshot
GetThreadLocale
GetACP
LoadLibraryA
FreeLibrary
CreateFileA
GetTimeZoneInformation
ConnectNamedPipe
WaitNamedPipeW
CancelIo
CreateNamedPipeW
GetNamedPipeInfo
GetEnvironmentVariableW
GlobalFree
FormatMessageW
GetComputerNameExW
GetFileSizeEx
lstrcmpiW
WideCharToMultiByte
MultiByteToWideChar
VirtualQueryEx
RtlCaptureContext
LoadLibraryW
CreateSemaphoreW
GetThreadContext
SuspendThread
OpenThread
TransactNamedPipe
SetNamedPipeHandleState
OpenMutexA
GetLocaleInfoW
GetLocalTime
VirtualAlloc
VirtualFree
HeapCreate
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
VirtualProtect
GetEnvironmentVariableA
Module32Next
Module32First
SizeofResource
LoadResource
FindResourceW
ExitProcess
SetThreadExecutionState
DeviceIoControl
DefineDosDeviceW
QueryInformationJobObject
IsProcessInJob
SetErrorMode
GetThreadTimes
GetUserDefaultLCID
GetUserDefaultLangID
GetFullPathNameW
GetSystemTime
SetThreadAffinityMask
GetProcessAffinityMask
DeleteFileA
GetDriveTypeA
GetFullPathNameA
MoveFileA
CreateDirectoryA
LockFile
UnlockFile
DebugBreak
SetEnvironmentVariableA
GetTempPathA
GetDiskFreeSpaceA
GetVolumeInformationA
GetComputerNameA
GetLogicalDrives
GlobalMemoryStatus
VirtualAllocEx
WriteProcessMemory
VirtualProtectEx
TerminateJobObject
SignalObjectAndWait
GetProcessHandleCount
GetFileType
VirtualFreeEx
CreateJobObjectW
OpenEventW
SearchPathW
ReadProcessMemory
GetSystemDirectoryA
GetTempFileNameA
IsBadWritePtr
GetFileSize
GlobalAddAtomW
GlobalDeleteAtom
lstrcmpiA
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetStringTypeW
EncodePointer
DecodePointer
UnhandledExceptionFilter
RtlUnwind
GetStartupInfoW
GetProcessHeap
GetConsoleCP
GetConsoleMode
SetStdHandle
FileTimeToLocalFileTime
FindFirstFileExA
GetFileAttributesA
ExitThread
PeekNamedPipe
GetTimeFormatA
GetDateFormatA
SetConsoleCtrlHandler
LCMapStringW
GetCPInfo
IsProcessorFeaturePresent
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
WriteConsoleW
SetEnvironmentVariableW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
GetDriveTypeW
CompareStringW
AreFileApisANSI
FindFirstChangeNotificationW
FindCloseChangeNotification
LoadLibraryExW
GetProcessTimes
GetOverlappedResult
GetUserDefaultUILanguage
LockResource
GetSystemPowerStatus
GetDateFormatW
GetTimeFormatW
GetNumberFormatW
GetCurrencyFormatW
LockFileEx
UnlockFileEx
GetDiskFreeSpaceW
CreateWaitableTimerW
SetFileAttributesA
FindFirstFileExW
SetEvent
CloseHandle
CreateEventA
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
GetSystemInfo
InterlockedDecrement
CreateProcessW
InterlockedIncrement

user32

SendInput
GetFocus
SetFocus
SetWindowsHookExW
ReleaseCapture
SetCapture
SetWindowLongA
DefWindowProcA
SetPropW
RedrawWindow
GetWindowRect
RealGetWindowClassW
EnumThreadWindows
GetClassNameW
FillRect
DrawFocusRect
DrawFrameControl
InflateRect
FrameRect
GetSysColorBrush
DrawEdge
InvertRect
GetKeyboardState
GetKeyboardLayoutList
MonitorFromRect
GetAncestor
RegisterClipboardFormatW
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
GetClipboardSequenceNumber
IsClipboardFormatAvailable
LoadIconW
WindowFromPoint
GetCursorPos
MonitorFromPoint
GetClientRect
SetRect
GetClassInfoExW
GetWindowDC
GetCursorInfo
SetThreadDesktop
GetIconInfo
RemovePropW
SetParent
OpenInputDesktop
CloseDesktop
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
CloseWindowStation
CharNextW
PostThreadMessageW
GetSysColor
GetCaretBlinkTime
GetAsyncKeyState
ReleaseDC
GetDC
DestroyWindow
UnregisterClassW
MsgWaitForMultipleObjectsEx
WaitMessage
SetTimer
PostMessageW
RegisterClassExW
CreateWindowExW
DefWindowProcW
GetQueueStatus
PostQuitMessage
CallMsgFilterW
TranslateMessage
DispatchMessageW
KillTimer
PeekMessageW
WaitForInputIdle
wsprintfW
MessageBoxW
CharUpperW
CallWindowProcW
CallNextHookEx
GetPropW
GetDoubleClickTime
GetSystemMetrics
SystemParametersInfoW
UnhookWindowsHookEx
InvalidateRect
GetCursor
SetCursor
TrackPopupMenu
GetWindowTextW
GetUserObjectInformationW
GetThreadDesktop
CreateDesktopW
CreateWindowStationW
MessageBoxA
DestroyIcon
MessageBeep
EnableWindow
GetWindowInfo
MoveWindow
LoadCursorW
RegisterClassW
BeginPaint
EndPaint
GetKeyState
EnumDisplayDevicesW
GetDesktopWindow
ClientToScreen
SetWindowLongW
RegisterDeviceNotificationW
GetWindowLongW
UnregisterDeviceNotification
ScrollDC
GetWindowThreadProcessId
RegisterWindowMessageW
GetParent
SendMessageW
SetWindowPos
GetShellWindow
MonitorFromWindow
GetMonitorInfoW
EnumDisplaySettingsW
IsWindow

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CreateProcessAsUserW
GetTokenInformation
OpenProcessToken
RegQueryInfoKeyW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegNotifyChangeKeyValue
CryptGenKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CryptDestroyKey
CreateWellKnownSid
GetSecurityInfo
SetEntriesInAclW
EqualSid
DuplicateToken
DuplicateTokenEx
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
CreateRestrictedToken
SetThreadToken
UnregisterTraceGuids
TraceEvent
RegisterTraceGuidsW
RegOpenKeyExA
RegQueryValueExA
CryptAcquireContextW
RegDeleteKeyW
CryptReleaseContext
CryptDestroyHash
CryptSignHashW
CryptSetHashParam
CryptGetHashParam
CryptCreateHash
CopySid
GetLengthSid
RegDisablePredefinedCache
RevertToSelf
SetTokenInformation
ConvertStringSidToSidW
LookupPrivilegeValueW

shlwapi

SHGetValueA
PathFindFileNameW
PathGetCharTypeW

comctl32

InitCommonControlsEx

winhttp

WinHttpGetIEProxyConfigForCurrentUser

winmm

waveOutReset
waveOutClose
waveOutWrite
waveOutOpen
timeKillEvent
timeSetEvent
timeGetTime
waveOutUnprepareHeader
timeEndPeriod
timeBeginPeriod
waveOutRestart
waveOutGetNumDevs
waveInGetNumDevs
waveInMessage
waveInPrepareHeader
waveInUnprepareHeader
waveInAddBuffer
waveInStart
waveInReset
waveInClose
waveInOpen
waveInGetDevCapsW
waveOutPause
waveOutPrepareHeader

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

setupapi

SetupDiEnumDriverInfoW
SetupDiDestroyDriverInfoList
SetupDiGetDeviceInstallParamsW
SetupDiBuildDriverInfoList
SetupDiSetDeviceInstallParamsW
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList

iphlpapi

CancelIPChangeNotify
NotifyAddrChange
GetAdaptersAddresses

urlmon

CoInternetCreateSecurityManager

secur32

FreeCredentialsHandle
QuerySecurityPackageInfoW
InitializeSecurityContextW
AcquireCredentialsHandleW
DeleteSecurityContext
CompleteAuthToken
AcquireCredentialsHandleA
InitializeSecurityContextA
FreeContextBuffer

crypt32

CertOpenSystemStoreW
CertRDNValueToStrW
CertGetCertificateChain
CertFreeCertificateChainEngine
CryptAcquireCertificatePrivateKey
CertGetIntendedKeyUsage
CertVerifyTimeValidity
CertGetCertificateContextProperty
CertSetCertificateContextProperty
CryptFindOIDInfo
CryptSignAndEncodeCertificate
CryptExportPublicKeyInfoEx
CertFindChainInStore
CertCreateCertificateChainEngine
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertAddEncodedCertificateToStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CryptDecodeObjectEx
CertFindExtension
CertCompareCertificateName
CertCloseStore
CertAddCertificateContextToStore
CertOpenStore
CertAddSerializedElementToStore
CryptHashCertificate
CertGetPublicKeyLength

dhcpcsvc

DhcpRequestParams
DhcpCApiInitialize

imm32

ImmSetCandidateWindow
ImmGetCompositionStringW
ImmSetOpenStatus
ImmReleaseContext
ImmGetContext
ImmAssociateContextEx
ImmDisableTextFrameService

ws2_32

gethostbyname
recvfrom
__WSAFDIsSet
select
inet_ntoa
getservbyname
WSACreateEvent
getsockopt
WSAWaitForMultipleEvents
WSASetEvent
WSCEnumProtocols
ntohs
ntohl
WSACloseEvent
accept
send
htonl
htons
WSARecvFrom
WSASendTo
getpeername
getaddrinfo
freeaddrinfo
WSAGetOverlappedResult
WSAResetEvent
WSASend
connect
WSARecv
shutdown
WSASocketW
WSAIoctl
setsockopt
WSALookupServiceBeginW
getservbyport
WSASetLastError
WSAEventSelect
WSALookupServiceNextW
WSALookupServiceEnd
WSAStartup
WSAEnumNetworkEvents
recv
gethostbyaddr
listen
gethostname
WSAGetLastError
closesocket
bind
inet_addr
socket
getsockname
sendto
ioctlsocket

usp10

ScriptXtoCP
ScriptCPtoX
ScriptGetFontProperties
ScriptJustify
ScriptItemize
ScriptShape
ScriptFreeCache
ScriptPlace

psapi

EnumProcessModules
QueryWorkingSet
GetProcessMemoryInfo

gdi32

ModifyWorldTransform
Rectangle
GetObjectType
CreateEnhMetaFileW
CloseEnhMetaFile
GetFontData
DeleteEnhMetaFile
BitBlt
CreateRectRgn
GetDeviceCaps
CreateFontW
GetCharWidthI
GetStockObject
EnumFontFamiliesW
GetObjectW
GetCharABCWidthsW
EnumFontFamiliesExW
GetTextFaceW
GetFontUnicodeRanges
GetOutlineTextMetricsW
GetTextExtentPointI
SetTextAlign
GetWorldTransform
CreateSolidBrush
SetBkColor
CreateBitmap
StretchBlt
CreateCompatibleBitmap
StretchDIBits
GdiAlphaBlend
SetDIBitsToDevice
SetTextColor
CreateDIBSection
SetWorldTransform
SetPixelFormat
ChoosePixelFormat
SwapBuffers
CancelDC
EndDoc
CreateDCW
StartDocW
SetAbortProc
AbortPath
SetStretchBltMode
SetROP2
SetDCPenColor
SetDCBrushColor
SetArcDirection
SetBrushOrgEx
EndPath
PolyBezier
BeginPath
SetPolyFillMode
SelectClipRgn
PathToRegion
CreateRectRgnIndirect
ExtTextOutW
GdiFlush
AddFontMemResourceEx
GetGlyphIndicesW
SetGraphicsMode
SetBkMode
RemoveFontMemResourceEx
CreateFontIndirectW
CreateCompatibleDC
SelectObject
GetTextMetricsW
DeleteDC
DeleteObject
GetGlyphOutlineW
GetDIBits
PatBlt
GetICMProfileW

rpcrt4

UuidCreateSequential
UuidToStringW
RpcStringFreeW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

winspool.drv

EnumPrintersW
OpenPrinterW
DocumentPropertiesW
ClosePrinter
GetPrinterW

comdlg32

PrintDlgW
GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW
PrintDlgExW

Exports

Exports

??0ILogHandler@Logging@Coherent@@QAE@ABV012@@Z
??0ILogHandler@Logging@Coherent@@QAE@XZ
??1IAllocator@MemoryManagement@Coherent@@UAE@XZ
??1ILogHandler@Logging@Coherent@@UAE@XZ
??4ILogHandler@Logging@Coherent@@QAEAAV012@ABV012@@Z
??_7ILogHandler@Logging@Coherent@@6B@

Sections

.text
Size: 27.7MB - Virtual size: 27.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 320KB - Virtual size: 621KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.unwante
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 241KB - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

34a13056204032fd2a87994fd2381dce

Code Sign

29:1e:e2:4c:14:94:42:5c:bb:6f:f7:94:f6:c8:53:01Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

d7:6f:d5:cf:be:f7:ef:56:e7:20:0e:66:4a:e4:31:9f:11:7d:94:83Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

comctl32

winhttp

winmm

userenv

setupapi

iphlpapi

urlmon

secur32

crypt32

dhcpcsvc

imm32

ws2_32

usp10

psapi

gdi32

rpcrt4

version

winspool.drv

comdlg32

Exports

Exports

Sections

.text Size: 27.7MB - Virtual size: 27.7MB

.rdata Size: 4.9MB - Virtual size: 4.9MB

.data Size: 320KB - Virtual size: 621KB

.unwante Size: 4KB - Virtual size: 3KB

.tls Size: 512B - Virtual size: 2B

.rodata Size: 3KB - Virtual size: 3KB

.rsrc Size: 241KB - Virtual size: 241KB

.reloc Size: 1.3MB - Virtual size: 1.3MB

29:1e:e2:4c:14:94:42:5c:bb:6f:f7:94:f6:c8:53:01
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

d7:6f:d5:cf:be:f7:ef:56:e7:20:0e:66:4a:e4:31:9f:11:7d:94:83
Signer

.text
Size: 27.7MB - Virtual size: 27.7MB

.rdata
Size: 4.9MB - Virtual size: 4.9MB

.data
Size: 320KB - Virtual size: 621KB

.unwante
Size: 4KB - Virtual size: 3KB

.tls
Size: 512B - Virtual size: 2B

.rodata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 241KB - Virtual size: 241KB

.reloc
Size: 1.3MB - Virtual size: 1.3MB