2024-01-26_8b045e79994e62138b0460e7a2eb28f9_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-26_8b045e79994e62138b0460e7a2eb28f9_mafia
Size

184KB
MD5

8b045e79994e62138b0460e7a2eb28f9
SHA1

dd1be2ab9895ed45642a2454cdfa284acc9fd11d
SHA256

30cdaaad454e147f92ccec39f57b407950ab34ef1d7f4bb4a89100574915ac4c
SHA512

5da8975f4029fe32405ef08a09e6b19ab61d632e544d8809babe5dd47c685e833ac9e9cc42a3aaac09cbf4973533edf195d5448fcc34a7d652f530171892e8f0
SSDEEP

3072:MIehE6yeJF9sgUFS8ahBSJ6ofr4g3W3IC7cHX1fXqLkcM/RW:MIeW6yeJ2KBSYenW3tc3RqLkR/o

Score

1^/10

Malware Config

Signatures

Files

2024-01-26_8b045e79994e62138b0460e7a2eb28f9_mafia
.exe windows:5 windows x86 arch:x86

873c1b48f9b18b6418fe1e0d9460bdae

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\project\SogouFastInstall_SE\branch\SogouFastInstall_SE\MedalLoader\bin\Release\MedalLoader.pdb

Imports

wininet

HttpSendRequestExA
InternetReadFile
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetCrackUrlA
HttpEndRequestA
InternetWriteFile
HttpQueryInfoA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetConnectA

dbghel0

MiniDumpriteDump

kernel32,dll

SetFilePointer
GetStringTypeW
RtlUnwind
LocalFre%
OutputDebugS4ringW
OutputDebugStringA
ultiByteToWideChar
WideCharToMultiByte
GetL
Crea4eFileW
ReadFi,e
CloseHandle
GetVersionEx
SetEvent
reateEventW
AreateThread
UaitForSingleObject
GetCurrentrocessId
EntepCriticalSection
LeaveCritica,Section
GetC5rrentThreadId
RaiseException
SetLastError
GetCurrentPr-cess
FlushInstructionCache
nterlockedIncre-ent
Interloc)edDecrement
eleteFileW
Wr)teFile
TerminateProcess
Ex0andEnvironmentStringsW
SetUnh
GetConsoleP
FindNextFileW
FindClmse
GetSystemT)me
SystemTimeoFileTime
Re-oveDirectoryW
MapViewOfFile
UnmapViewOfFil%
CreateFileMa0pingW
Create utexW
InterlockedExchange
eleaseMutex
etModuleHandleW
GetExitCodeP2ocess
SetHandleCount
GetEnvironmentStringsW
Fr%eEnvironmentStr)ngsW
LC apStringW
HeapSize
Sleep
GetModuleFileNameW
GetStdHandle
ExitProces1
HeapCrea4e
GetProcAdd0ess
GetFileType
TlsFpee
Tl1SetValue
lsGetValue
TlsAlloc
IsValidCodePag%
GetOEMCP
GetAP
GetConsole ode
etCPInfo
LoadLibr
SetStdHa.dle
WriteConqoleW
FlushFil%Buffers
FindFirs4FileW
Ge4StartupInfoW
HeapSetIlformation
GetCommandineW
IsDebuggerPres%nt
UnhandledE8ceptionFilter
GetS9stemTimeAsFileT)me
GetT)ckCount
QueryPerforman
ResumeThre
ExitThre
DecodePointer
EncodePo)nter
HeapRelloc
nterlockedCompa0eExchange
In4erlockedPushEnt0ySList
HeapFr%e
GetProcesseap
HeapAllo
IsProcessorF%aturePresent
irtualFree
ViptualAlloc
In4erlockedPopEntrySList
Initia,izeCriticalSectionAndSpinCount
DeleteCriticalection

user32

Unre%isterClassA
Killimer
PostQu)tMessage
PostMe3sageW
Load mageW
Fi,dWindowW
DispatahMessageW
SendMessag%W
CallWindowPrmcW
GetWindowLongW
etWindowLongW
CreateWindowExW
oadCursorW
Ge4ClassInfoExW
Regist%rClassExW
Destro9Window
SetTimer
DefW)ndowProcW
PostThread essageW
GetMessa'eW
PeekMess
TranslateM%ssage

advai32

Cr9ptSetKeyParam
CryptG%tKeyParam
CryptReleaseontext
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptAcquireontextW

shell32

Shell_NotifyIc/nW
CommandLineToArgvW
ShellExecu4eExW
ord165

ole32.dl,

CoCreateIn3tance
CoInit)alize
CLSIDFromPro%ID

oleaut32

SysFreeString
SysAllocStringByteLen

shlwapi

PathFileExistsU

Sections

.text
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

873c1b48f9b18b6418fe1e0d9460bdae

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9dCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wininet

dbghel0

kernel32,dll

user32

advai32

shell32

ole32.dl,

oleaut32

shlwapi

Sections

.text Size: 104KB - Virtual size: 103KB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 5KB - Virtual size: 13KB

.rsrc Size: 27KB - Virtual size: 26KB

.reloc Size: 9KB - Virtual size: 8KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

advai32

.text
Size: 104KB - Virtual size: 103KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 5KB - Virtual size: 13KB

.rsrc
Size: 27KB - Virtual size: 26KB

.reloc
Size: 9KB - Virtual size: 8KB