2024-01-22_19bd1bc8db40ad83c57ae93fcea23e30_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-22_19bd1bc8db40ad83c57ae93fcea23e30_mafia
Size

503KB
MD5

19bd1bc8db40ad83c57ae93fcea23e30
SHA1

da05aa9db2c4935dfb0caa0a506c5c2c1b8af503
SHA256

3835fe9adad56f457db1f97d6f4506d745126bad001be2434d191a4560dde20c
SHA512

4adffd498e2359125ce543d2023efcc3a227d77d7303330ad21891cebd2edfbfcbed9da5bd00187e4ce77fccce637440a05eb71a621767a12969cd5c955678e0
SSDEEP

6144:3ZUJpPbttKBfvX/b9NX7N1/RbjCNK617o41Nptp7Nu+1LC:3+fbtts3X/b9NX7N1/tC37p7Nuy+

Score

1^/10

Malware Config

Signatures

Files

2024-01-22_19bd1bc8db40ad83c57ae93fcea23e30_mafia
.exe windows:5 windows x86 arch:x86

5007e16b49e5fb060b690c46cb9316e8

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:31:89:c6:37:e8
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

02/08/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:aa:63:26:9a:3f:1d:9d:ee:74:12:ec:4c:fe:c1:8e:ed
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

09/06/2014, 19:22

Not After

09/07/2017, 19:22

Subject

CN=QFX Software Corporation,O=QFX Software Corporation,L=Ormond Beach,ST=FL,C=US,1.2.840.113549.1.9.1=#0c17716678736f667440716678736f6674776172652e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:37:e8
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

02/08/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:aa:63:26:9a:3f:1d:9d:ee:74:12:ec:4c:fe:c1:8e:ed
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

09/06/2014, 19:22

Not After

09/07/2017, 19:22

Subject

CN=QFX Software Corporation,O=QFX Software Corporation,L=Ormond Beach,ST=FL,C=US,1.2.840.113549.1.9.1=#0c17716678736f667440716678736f6674776172652e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:13:91:c1:7a:fb:4a:4f:4f:ef:38:d5:bd:04:6a:4c:4e:8d:3d:54:39:9b:74:4d:45:cf:01:a0:10:4d:f0:b3
Signer

Actual PE Digest

07:13:91:c1:7a:fb:4a:4f:4f:ef:38:d5:bd:04:6a:4c:4e:8d:3d:54:39:9b:74:4d:45:cf:01:a0:10:4d:f0:b3

Digest Algorithm

sha256

PE Digest Matches

true

1d:26:eb:36:67:ae:20:11:a9:79:25:df:66:18:c7:e5:3f:bc:1c:b2
Signer

Actual PE Digest

1d:26:eb:36:67:ae:20:11:a9:79:25:df:66:18:c7:e5:3f:bc:1c:b2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

keyscramblerie

KSOptions
KSPromptForKey
KSSetKeyInfo
KSUpdate
KSSetOption
KSInit
KSUninit

kernel32

GetModuleHandleExW
OpenEventW
FlushInstructionCache
GetCurrentThreadId
lstrlenW
GetModuleHandleW
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
SetLastError
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
CreateFileW
MoveFileExW
FindClose
FindNextFileW
FindFirstFileW
ResetEvent
SetEvent
Sleep
CreateEventW
SetEndOfFile
CreateFileA
SetStdHandle
GetProcAddress
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
IsValidCodePage
GetOEMCP
DeleteCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
LoadLibraryW
SetConsoleCtrlHandler
SetFilePointer
ReadFile
FlushFileBuffers
GetConsoleMode
GetConsoleCP
FatalAppExitA
GetFileType
SetHandleCount
HeapSize
HeapReAlloc
GetStdHandle
WriteFile
GetCurrentProcess
FreeLibrary
OpenProcess
WaitForSingleObject
CloseHandle
DeleteFileW
WriteConsoleW
LocalFree
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
VirtualAlloc
EnterCriticalSection
RaiseException
InterlockedPopEntrySList
InterlockedExchange
InitializeCriticalSection
EncodePointer
DecodePointer
RtlUnwind
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapDestroy
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCPInfo
LCMapStringW
WideCharToMultiByte
GetStartupInfoW
HeapSetInformation
ExitProcess
GetACP
InterlockedCompareExchange
InterlockedPushEntrySList
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
GetCommandLineW

user32

GetClassInfoExW
LoadCursorW
DefWindowProcW
SetWindowLongW
LoadBitmapW
UpdateWindow
SetWindowRgn
MessageBoxW
BroadcastSystemMessageW
EndPaint
BeginPaint
CallWindowProcW
GetParent
GetWindow
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
SetWindowPos
KillTimer
SetTimer
PostMessageW
GetWindowLongW
RegisterClassExW
CreateWindowExW
DestroyWindow
CharNextW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
UnregisterClassA

gdi32

BitBlt
SelectObject
CreateCompatibleDC
DeleteObject
GetObjectW
CreateRoundRectRgn
DeleteDC

advapi32

RegOpenKeyExW
GetSecurityDescriptorSacl
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo

shell32

SHGetFolderPathW
ShellExecuteW

ole32

CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

SysFreeString
VarUI4FromStr

shlwapi

PathCombineW
PathRemoveFileSpecW

comctl32

InitCommonControlsEx

Sections

.text
Size: 192KB - Virtual size: 191KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 245KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5007e16b49e5fb060b690c46cb9316e8

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

04:00:00:00:00:01:31:89:c6:37:e8Certificate

Extended Key Usages

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

11:21:aa:63:26:9a:3f:1d:9d:ee:74:12:ec:4c:fe:c1:8e:edCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:37:e8Certificate

Extended Key Usages

Key Usages

11:21:aa:63:26:9a:3f:1d:9d:ee:74:12:ec:4c:fe:c1:8e:edCertificate

Extended Key Usages

Key Usages

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

07:13:91:c1:7a:fb:4a:4f:4f:ef:38:d5:bd:04:6a:4c:4e:8d:3d:54:39:9b:74:4d:45:cf:01:a0:10:4d:f0:b3Signer

1d:26:eb:36:67:ae:20:11:a9:79:25:df:66:18:c7:e5:3f:bc:1c:b2Signer

Headers

DLL Characteristics

File Characteristics

Imports

keyscramblerie

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

Sections

.text Size: 192KB - Virtual size: 191KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 6KB - Virtual size: 14KB

.rsrc Size: 245KB - Virtual size: 245KB

.reloc Size: 10KB - Virtual size: 10KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

04:00:00:00:00:01:31:89:c6:37:e8
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

11:21:aa:63:26:9a:3f:1d:9d:ee:74:12:ec:4c:fe:c1:8e:ed
Certificate

04:00:00:00:00:01:31:89:c6:37:e8
Certificate

11:21:aa:63:26:9a:3f:1d:9d:ee:74:12:ec:4c:fe:c1:8e:ed
Certificate

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

07:13:91:c1:7a:fb:4a:4f:4f:ef:38:d5:bd:04:6a:4c:4e:8d:3d:54:39:9b:74:4d:45:cf:01:a0:10:4d:f0:b3
Signer

1d:26:eb:36:67:ae:20:11:a9:79:25:df:66:18:c7:e5:3f:bc:1c:b2
Signer

.text
Size: 192KB - Virtual size: 191KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 6KB - Virtual size: 14KB

.rsrc
Size: 245KB - Virtual size: 245KB

.reloc
Size: 10KB - Virtual size: 10KB