2024-02-22_fc868ad1e0f9fc7c55e5286a9af822d7_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-22_fc868ad1e0f9fc7c55e5286a9af822d7_mafia
Size

1.3MB
MD5

fc868ad1e0f9fc7c55e5286a9af822d7
SHA1

8c369ca9a031a4499f02e1d38fb491bd5ee84688
SHA256

09d72239b66b54a1c5a1c7e52a3aec3ad111caf5d1504296f0f1cdf2ae341554
SHA512

0443a8c71793a98e9ea0bf2716fc0907ef83d1ee17fbd6dd006af6673cec27d5819af40dc1372477e19daedf123442692c78a5215db633b484a575b80b464e5e
SSDEEP

24576:atTgj8VwwbgcRDduVEe7w8zcTPSE+nDrydtVD6CH:ZdU5uX88zcTPEnHwcCH

Score

1^/10

Malware Config

Signatures

Files

2024-02-22_fc868ad1e0f9fc7c55e5286a9af822d7_mafia
.exe windows:5 windows x86 arch:x86

d4f311e386b13eb2401ab06b65a094f5

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7d:2d:0c:a0:6f:4d:88:04:2d:cb:64:48:2b:c9:c0:64
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

22/07/2011, 00:00

Not After

20/08/2014, 23:59

Subject

CN=NetSupport Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=NetSupport,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\nsmsrc\nsm\1201\1201\studentui\Release\StudentUI.pdb

Imports

shfolder

SHGetFolderPathA

gdiplus

GdipSetPenColor
GdipSetSolidFillColor
GdipSetStringFormatTabStops
GdipDrawEllipse
GdipDrawArc
GdipAddPathStringI
GdipSetClipRectI
GdipTransformPath
GdipGetStringFormatAlign
GdipCreateMatrix2
GdipFree
GdipAlloc
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipGetGenericFontFamilySansSerif
GdipGetPathWorldBoundsI
GdipDeleteMatrix
GdipFillRectanglesI
GdipCreatePathGradientFromPath
GdipSetPathGradientSurroundColorsWithCount
GdipGetPathGradientPointCount
GdipSetPathGradientCenterColor
GdipClonePath
GdipDrawCachedBitmap
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipAddPathCurveI
GdipAddPathArcI
GdipAddPathLineI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipDrawLine
GdipDrawRectangle
GdipFillRectangle
GdipSetStringFormatTrimming
GdipDrawImageI
GdipCloneBitmapAreaI
GdipAddPathPieI
GdipCreateBitmapFromHICON
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipDeleteCachedBitmap
GdipCreateCachedBitmap
GdipCreatePath
GdipCloneImage
GdipCloneBrush
GdipGetFontHeightGivenDPI
GdipCreateFont
GdipResetClip
GdipSetClipPath
GdipDrawImageRectRectI
GdipDrawImageRectI
GdipMeasureString
GdipDrawString
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipDrawRectangleI
GdipDrawLineI
GdipSetSmoothingMode
GdipGetSmoothingMode
GdipReleaseDC
GdipGetDC
GdipGetImageGraphicsContext
GdipCreateFromHDC
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipCreateLineBrushFromRectI
GdipCreateSolidFill
GdipSetImageAttributesColorMatrix
GdiplusStartup
GdipCreateHICONFromBitmap
GdipCreateBitmapFromScan0
GdipImageRotateFlip
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDeleteGraphics
GdipDeletePath
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeletePen
GdipCreatePen1
GdipDeleteBrush
GdipGetImagePixelFormat

comctl32

ImageList_GetIconSize
ImageList_DragShowNolock
ImageList_DragMove
ImageList_EndDrag
ImageList_GetImageInfo
ImageList_Merge
ImageList_Draw
ImageList_GetImageCount
ImageList_ReplaceIcon
ImageList_LoadImageA
ImageList_AddMasked
ImageList_Create
ImageList_DrawEx
ImageList_Destroy
_TrackMouseEvent
ImageList_Add
ImageList_GetIcon
ImageList_DragLeave
ImageList_DragEnter
ord17
ImageList_BeginDrag

kernel32

RtlUnwind
HeapReAlloc
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetCPInfo
GetACP
GetOEMCP
GetTickCount
SetThreadPriority
GetThreadPriority
GetCurrentThread
Sleep
LoadLibraryA
FreeLibrary
GetProcAddress
SetLastError
GetCurrentProcessId
GetVersion
EnterCriticalSection
LeaveCriticalSection
ExpandEnvironmentStringsA
InitializeCriticalSection
DeleteCriticalSection
IsValidCodePage
GlobalDeleteAtom
InterlockedIncrement
InterlockedDecrement
GetLastError
IsDBCSLeadByte
CompareStringA
LockResource
LoadResource
FindResourceA
GetCurrentThreadId
CloseHandle
WaitForSingleObject
SetEvent
ResetEvent
CreateEventA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
SizeofResource
GetVersionExA
GetCurrentProcess
UnmapViewOfFile
OpenEventA
OpenProcess
MapViewOfFile
OpenFileMappingA
WaitForMultipleObjects
CreateThread
GetModuleFileNameA
LocalFree
CreateFileMappingA
LocalAlloc
GetLocalTime
DeleteFileA
GetTempFileNameA
ReadFile
GetFileSize
CreateFileA
WriteFile
MultiByteToWideChar
GetModuleHandleA
GetTempPathA
OutputDebugStringA
ExitProcess
FindResourceExA
WideCharToMultiByte
GlobalReAlloc
HeapAlloc
GetProcessHeap
HeapFree
PulseEvent
GetProfileStringA
FormatMessageA
GetDateFormatA
Beep
VirtualQueryEx
RaiseException
CreateDirectoryA
GetFileAttributesA
GetSystemDefaultLangID
CreateProcessA
GetSystemInfo
SetCurrentDirectoryA
GetCurrentDirectoryA
ResumeThread
GetThreadContext
SuspendThread
GetExitCodeThread
DuplicateHandle
IsBadReadPtr
GlobalGetAtomNameA
DeviceIoControl
SetFileAttributesA
GetComputerNameA
FindClose
FindFirstFileA
CompareFileTime
GetDriveTypeA
LoadLibraryExA
SetProcessShutdownParameters
SetUnhandledExceptionFilter
GetTimeFormatA
lstrlenW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetStdHandle
GetModuleFileNameW
HeapCreate
HeapDestroy
IsProcessorFeaturePresent
LCMapStringW
GetStringTypeW
InitializeCriticalSectionAndSpinCount
HeapSize
GetTimeZoneInformation
FatalAppExitA
GetUserDefaultLCID
GetLocaleInfoW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetHandleCount
GetFileType
SetFilePointer
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetConsoleCtrlHandler
InterlockedExchange
LoadLibraryW
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
WriteConsoleW
SetEndOfFile
CreateFileW
CompareStringW
SetEnvironmentVariableA
lstrlenA
GlobalAddAtomA

user32

GetTopWindow
EndDeferWindowPos
BeginDeferWindowPos
RemovePropA
GetPropA
SetPropA
DrawTextA
OffsetRect
SetCapture
GetCapture
ReleaseCapture
FillRect
EndPaint
BeginPaint
GetUpdateRect
CallNextHookEx
GetLastActivePopup
PostQuitMessage
DispatchMessageA
PeekMessageA
CreateDialogParamA
GetDlgItemTextA
SetWindowsHookExA
UnhookWindowsHookEx
GetMenu
WinHelpA
MessageBoxIndirectA
SetCursor
DrawIcon
GetIconInfo
PostThreadMessageA
DrawFocusRect
UnionRect
MessageBoxA
TranslateMessage
GetMessageA
SetWindowTextA
GetWindowTextLengthA
IsDlgButtonChecked
IsIconic
EndDialog
IsDialogMessageA
DialogBoxParamA
DialogBoxIndirectParamA
SetForegroundWindow
CreateDialogIndirectParamA
SetFocus
ChildWindowFromPoint
InflateRect
AdjustWindowRectEx
GetKeyState
GetDoubleClickTime
DrawTextW
RedrawWindow
IsRectEmpty
GetWindowTextW
wsprintfW
LoadStringW
DeleteMenu
GetMenuItemID
GetMenuItemCount
GetMenuStringA
MessageBeep
InsertMenuItemA
GetMenuItemInfoA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
SetMenu
TrackPopupMenuEx
IsMenu
EnableMenuItem
CheckMenuItem
LoadIconA
SetDlgItemInt
GetDlgItemInt
DrawIconEx
RegisterDeviceNotificationA
UnregisterDeviceNotification
wvsprintfA
IntersectRect
DestroyCursor
LoadImageA
LoadBitmapA
SystemParametersInfoA
GetActiveWindow
IsZoomed
CreatePopupMenu
AppendMenuA
SetMenuItemInfoA
LoadMenuA
GetSubMenu
DestroyMenu
CopyIcon
IsWindowVisible
WindowFromPoint
CopyRect
EqualRect
SetRect
DestroyWindow
SetRectEmpty
GetSysColor
LoadStringA
EnableWindow
SetDlgItemTextA
ValidateRect
InvalidateRect
ReleaseDC
GetDC
ClientToScreen
MapWindowPoints
GetDlgCtrlID
IsChild
IsWindowEnabled
GetClientRect
DeferWindowPos
GetWindowLongA
SetWindowLongA
GetDlgItem
wsprintfA
MoveWindow
FindWindowA
RegisterWindowMessageA
EnumWindows
IsWindow
GetWindowTextA
GetSystemMetrics
GetClassNameA
DefWindowProcA
UpdateWindow
GetParent
ShowWindow
PostMessageA
SendDlgItemMessageA
SendMessageA
GetCursorPos
GetForegroundWindow
PtInRect
GetWindow
GetDesktopWindow
GetClassInfoA
LoadCursorA
RegisterClassA
CreateWindowExA
CallWindowProcA
KillTimer
SetTimer
GetWindowRect
SetWindowPos
DestroyIcon

gdi32

SetBrushOrgEx
ExtTextOutA
CreateFontIndirectW
RectVisible
SelectObject
GetTextMetricsA
CreateFontIndirectA
DeleteObject
CreatePatternBrush
GetTextExtentPoint32A
DeleteDC
BitBlt
TextOutA
SetTextColor
SetBkMode
CreateCompatibleBitmap
CreateCompatibleDC
LineTo
MoveToEx
CreatePen
GetTextExtentPointA
CreateDCA
SetPixel
PatBlt
CreateSolidBrush
GetDeviceCaps
SetBkColor
AbortDoc
EndDoc
EndPage
StartDocA
StartPage
SetMapMode
CreateDIBitmap
SelectPalette
RealizePalette
GetDIBits
StretchBlt
GetRegionData
GetRgnBox
OffsetRgn
SelectClipRgn
CreateRectRgn
CombineRgn
GetSystemPaletteEntries
CreatePalette
CreateBitmap
GetStockObject
GetObjectA

winspool.drv

ord201

comdlg32

GetOpenFileNameA
PageSetupDlgA
GetSaveFileNameA

advapi32

InitializeSecurityDescriptor
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryInfoKeyA
RegDeleteValueA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
GetTokenInformation
CloseServiceHandle
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegQueryValueExA
FreeSid
AllocateAndInitializeSid
GetUserNameW
GetUserNameA
SetSecurityDescriptorDacl
RegDeleteKeyA
RegOpenKeyExA
RegCloseKey
RegEnumKeyExA

shell32

SHGetFileInfoA
FindExecutableA
DuplicateIcon
SHAppBarMessage
ExtractIconExA
ShellExecuteA

ole32

OleUninitialize
CreateStreamOnHGlobal
OleInitialize

oleaut32

SafeArrayAccessData
CreateErrorInfo
SysFreeString
SetErrorInfo
GetErrorInfo
SysAllocStringLen
VariantInit
SysStringByteLen
VariantClear
VariantChangeType
SafeArrayCreate
SafeArrayUnaccessData
SysAllocString
SafeArrayGetElemsize
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim

winmm

timeGetTime
PlaySoundA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

Sections

.text
Size: 835KB - Virtual size: 834KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 255KB - Virtual size: 255KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d4f311e386b13eb2401ab06b65a094f5

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

7d:2d:0c:a0:6f:4d:88:04:2d:cb:64:48:2b:c9:c0:64Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shfolder

gdiplus

comctl32

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

winmm

version

Sections

.text Size: 835KB - Virtual size: 834KB

.rdata Size: 121KB - Virtual size: 120KB

.data Size: 11KB - Virtual size: 24KB

.rsrc Size: 255KB - Virtual size: 255KB

.reloc Size: 51KB - Virtual size: 50KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

7d:2d:0c:a0:6f:4d:88:04:2d:cb:64:48:2b:c9:c0:64
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

.text
Size: 835KB - Virtual size: 834KB

.rdata
Size: 121KB - Virtual size: 120KB

.data
Size: 11KB - Virtual size: 24KB

.rsrc
Size: 255KB - Virtual size: 255KB

.reloc
Size: 51KB - Virtual size: 50KB