2024-01-24_0b33855cdedda27eb5138835b269d6fc_floxif_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-01-24_0b33855cdedda27eb5138835b269d6fc_floxif_mafia
Size

4.4MB
MD5

0b33855cdedda27eb5138835b269d6fc
SHA1

1bf475d71e20e1546ab1d4c4bd96f347820dffe8
SHA256

092af87e9f8dd6fc281dfcbe4ae784d8ac49feb94c68f565c2eef3f415a28851
SHA512

2ec0d734f9a5018e73badba1ec56dc4349d362aed6cb8f125bbe916fc0eae3d94149eb452f42b20ddbdaa1d5c4d54a1997ded62be7b5d455870a898ebb917ce2
SSDEEP

98304:UlGp//mBAjAKS1SiiyMmuX+HV9KPHvsCYCBwnH96bds:MGp/S0OC+osCYCY6bm

Score

1^/10

Malware Config

Signatures

Files

2024-01-24_0b33855cdedda27eb5138835b269d6fc_floxif_mafia
.exe windows:5 windows x86 arch:x86

749af3b41c43f97bd1f39f2574a6ed81

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:14:84
Certificate

Issuer

OU=Starfield Class 2 Certification Authority,O=Starfield Technologies\, Inc.,C=US

Not Before

01-01-2014 07:00

Not After

30-05-2031 07:00

Subject

CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03-05-2011 07:00

Not After

03-05-2031 07:00

Subject

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

28:0f:0a:44:45:2b:0f
Certificate

Issuer

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

25-08-2014 17:00

Not After

25-08-2017 17:00

Subject

CN=Foxit Software Incorporated,O=Foxit Software Incorporated,L=Fremont,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2f:5c:cb:44:dc:eb:90:dd:a6:6b:d1:e8:39:69:d0:59:e1:23:03:ca
Signer

Actual PE Digest

2f:5c:cb:44:dc:eb:90:dd:a6:6b:d1:e8:39:69:d0:59:e1:23:03:ca

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
LeaveCriticalSection
EnterCriticalSection
GetTempPathW
InterlockedDecrement
InterlockedIncrement
MoveFileExW
GetSystemTime
ReadFile
GetCommandLineW
GetSystemDefaultLangID
LoadLibraryExW
FindResourceW
RtlUnwind
HeapAlloc
HeapFree
EncodePointer
DecodePointer
HeapSetInformation
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
LoadResource
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
ExitProcess
WriteFile
GetStdHandle
HeapCreate
HeapReAlloc
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
GetLocaleInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedExchange
LoadLibraryW
WideCharToMultiByte
LCMapStringW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetFileSize
SetFilePointer
GetLocalTime
InitializeCriticalSection
FindClose
GetVersionExA
LoadLibraryA
GetSystemDirectoryA
GetLogicalDriveStringsA
DeviceIoControl
CreateFileA
GetVolumeInformationA
GetComputerNameA
GetSystemInfo
GlobalMemoryStatus
FindNextFileW
FindFirstFileW
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
SetEndOfFile
DeleteFileA
ExitThread
TryEnterCriticalSection
GetTimeZoneInformation
GetSystemDirectoryW
GlobalAlloc
GetExitCodeThread
CreateDirectoryW
SetFileAttributesW
GetVersionExW
GetComputerNameW
OpenEventW
TzSpecificLocalTimeToSystemTime
TerminateThread
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
lstrlenA
LocalFree
SizeofResource
MultiByteToWideChar
FreeLibrary
SetEvent
CreateEventW
CreateThread
GetCurrentThreadId
Sleep
GetModuleFileNameW
WaitForSingleObject
lstrcmpiW
GetModuleHandleW
GetProcAddress
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
RaiseException
lstrlenW
DeleteFileW
CreateFileW
CloseHandle
CopyFileW
GetLastError
GetCurrentProcess
GetFileAttributesW
GetProcessHeap

user32

TranslateMessage
SetForegroundWindow
CallWindowProcW
SetWindowTextW
GetWindowTextW
SetWindowLongW
GetWindowLongW
GetParent
PeekMessageW
MsgWaitForMultipleObjects
MessageBoxW
LoadStringW
EnumChildWindows
DispatchMessageW
GetMessageW
PostThreadMessageW
ShowWindow
CreateWindowExW
CharUpperW
PostQuitMessage
EndPaint
ScreenToClient
BeginPaint
DefWindowProcW
GetDlgCtrlID
CharNextW
wsprintfW
GetClassNameW
SystemParametersInfoW
GetWindow
GetWindowRect
LoadImageW
FillRect
SetWindowsHookExW
IsWindow
UnhookWindowsHookEx
LoadCursorW
RegisterClassExW
GetDC
ReleaseDC
CallNextHookEx
GetDlgItem
SetWindowPos
GetSystemMetrics
GetActiveWindow
SendMessageW

gdi32

CreateSolidBrush
EndPath
CloseFigure
PolyBezierTo
LineTo
MoveToEx
BeginPath
StrokePath
FillPath
StrokeAndFillPath
SetPolyFillMode
SetMiterLimit
SelectClipPath
IntersectClipRect
WidenPath
ExtCreatePen
CreateCompatibleBitmap
GetDeviceCaps
CreateBitmap
GetObjectType
SaveDC
RestoreDC
CreateFontA
ExtTextOutW
CreateFontIndirectW
SetTextColor
SelectClipRgn
GetClipBox
SetStretchBltMode
SetBrushOrgEx
ExtEscape
StretchDIBits
SetDIBitsToDevice
CreateRectRgn
GetClipRgn
GetTextMetricsA
GetTextFaceA
EnumFontFamiliesExA
GetObjectW
DeleteObject
GetStockObject
BitBlt
GetDIBits
GetObjectA
CreateFontIndirectA
CreateCompatibleDC
SelectObject
DeleteDC
CreatePen
GetFontData
EnumFontFamiliesExW
GetRegionData
SetTextAlign
SetBkMode

advapi32

GetUserNameW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegEnumValueW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA

shell32

ShellExecuteW
SHGetSpecialFolderPathW
SHCreateDirectoryExW
ord165

ole32

CoSetProxyBlanket
CoTaskMemAlloc
CoTaskMemRealloc
CoInitializeEx
CoTaskMemFree
CoInitialize
CoUninitialize
StringFromGUID2
CoCreateInstance
CoAddRefServerProcess
CoReleaseServerProcess
OleRun
CLSIDFromString
CoRevokeClassObject
CLSIDFromProgID
CoRegisterClassObject

oleaut32

GetErrorInfo
SysFreeString
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
SafeArrayUnaccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayCreateVector
LoadRegTypeLi
VariantClear

comdlg32

GetSaveFileNameW
GetOpenFileNameW

iphlpapi

GetNetworkParams
GetAdaptersInfo

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 92KB - Virtual size: 251KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

749af3b41c43f97bd1f39f2574a6ed81

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

39:14:84Certificate

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

07Certificate

Key Usages

28:0f:0a:44:45:2b:0fCertificate

Extended Key Usages

Key Usages

2f:5c:cb:44:dc:eb:90:dd:a6:6b:d1:e8:39:69:d0:59:e1:23:03:caSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comdlg32

iphlpapi

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 1.9MB - Virtual size: 1.9MB

.data Size: 92KB - Virtual size: 251KB

.rsrc Size: 9KB - Virtual size: 8KB

.reloc Size: 123KB - Virtual size: 123KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

39:14:84
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

07
Certificate

28:0f:0a:44:45:2b:0f
Certificate

2f:5c:cb:44:dc:eb:90:dd:a6:6b:d1:e8:39:69:d0:59:e1:23:03:ca
Signer

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 1.9MB - Virtual size: 1.9MB

.data
Size: 92KB - Virtual size: 251KB

.rsrc
Size: 9KB - Virtual size: 8KB

.reloc
Size: 123KB - Virtual size: 123KB