2024-03-03_4d032c86367178073c8973c85b986f51_floxif_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2024-03-03_4d032c86367178073c8973c85b986f51_floxif_mafia
Size 1.5MB
Sample240303-nps8laac89
SHA256 7245c6b7391b61e5e5948250337e5388717f3fb6468748e251919e69167e3489
MD5 4d032c86367178073c8973c85b986f51
SHA1 77edcb22019e418725c5942e005e0554b53014b3
SHA512 8bf23cac6ea777d3c65277f34669bdb647632963b65a17a26a9a1ea7fba24508509507f1a4669afb385ddaf15578accafe26ac6d0de63c66fef5d166e05126c0
SSDEEP 49152:MpjjwslmYUJwN3D5iZhJ52kZZ1CTFufdU:MpfU+kM
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-03-03_4d032c86367178073c8973c85b986f51_floxif_mafia

.exe 1.5MB

2024-03-03_4d032c86367178073c8973c85b986f51_floxif_mafia

IMPHASH 39ab3e7f709f29621b986468db264bcf
SHA256 7245c6b7391b61e5e5948250337e5388717f3fb6468748e251919e69167e3489
MD5 4d032c86367178073c8973c85b986f51
SHA1 77edcb22019e418725c5942e005e0554b53014b3
SHA512 8bf23cac6ea777d3c65277f34669bdb647632963b65a17a26a9a1ea7fba24508509507f1a4669afb385ddaf15578accafe26ac6d0de63c66fef5d166e05126c0
SSDEEP 49152:MpjjwslmYUJwN3D5iZhJ52kZZ1CTFufdU:MpfU+kM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

eb:70:6e:f7:5a:9a:dc:8c:36:85:42:f2:e4:71:6a:62:d4:50:b6:be

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Malwarebytes Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Malwarebytes Corporation,L=San Jose,ST=California,C=US

Chains

Mar 10, 2016

Subject

CN=Malwarebytes Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Malwarebytes Corporation,L=San Jose,ST=California,C=US

Serial Number

6f:36:c4:b7:4b:4f:8a:b0:01:f0:39:d6:92:a7:5b:49

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 30, 2013 - Jun 19, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

Major OS version

Entry point

870158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Jenkins\workspace\mbam-killer.exe\mbam-killer.exe\build\Release\mbam-killer-vc100-x86-s-3_0_15_0.pdb

kernel32

GetComputerNameW GetVersionExW CreateFileW GetACP VerifyVersionInfoW DeviceIoControl GetSystemInfo GetVolumeInformationW FindFirstFileW BackupSeek BackupRead FindClose FindNextFileW GetSystemWindowsDirectoryW GetSystemDirectoryW GetTempPathW GetCurrentDirectoryW LocalFree GetVolumePathNameW GetFileAttributesW GetLongPathNameW GetShortPathNameW SetLastError GetSystemTime DeleteFileW FindVolumeClose SetFilePointer MapViewOfFile UnmapViewOfFile SetFilePointerEx WriteFile Sleep CopyFileW FindNextVolumeW ReadFile FlushFileBuffers GetFileSizeEx CreateFileMappingW FindFirstVolumeW GetFileInformationByHandle GetWindowsDirectoryW ExpandEnvironmentStringsW SetThreadExecutionState InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection FreeLibrary GetTickCount GetSystemTimeAsFileTime GetFileTime VerSetConditionMask FindResourceW LoadResource SizeofResource GetModuleFileNameW LockResource CreateMutexW OpenMutexW LocalAlloc InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW ReadConsoleInputA SetConsoleMode GetConsoleMode PeekConsoleInputA GetNumberOfConsoleInputEvents GetCommandLineW HeapSetInformation HeapFree HeapReAlloc GetLogicalDriveStringsW RaiseException GetCPInfo RtlUnwind LCMapStringW CompareStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount ExitProcess FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoW TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId HeapCreate QueryPerformanceCounter GetCurrentProcessId HeapSize GetLocaleInfoW GetOEMCP IsValidCodePage GetTimeZoneInformation GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetConsoleCP WriteConsoleW SetStdHandle SetEnvironmentVariableA GetStringTypeExW LoadLibraryA FileTimeToSystemTime GetTimeFormatW SystemTimeToFileTime GetDateFormatW GetDriveTypeW MultiByteToWideChar WideCharToMultiByte CloseHandle Module32NextW CreateToolhelp32Snapshot Process32NextW Module32FirstW Process32FirstW GetProcAddress TerminateProcess LoadLibraryW OpenProcess GetModuleHandleW WaitForSingleObject CompareFileTime CreateProcessW GetLastError FileTimeToLocalFileTime CreateDirectoryW GetFileAttributesExW HeapAlloc GetCurrentProcess GetConsoleScreenBufferInfo GetStdHandle VirtualQuery SetConsoleTextAttribute

sfc

SfcIsFileProtected

netapi32

NetWkstaGetInfo NetApiBufferFree

shlwapi

SHRegGetPathW PathFileExistsW

iphlpapi

GetAdaptersInfo

userenv

GetProfilesDirectoryW GetUserProfileDirectoryW ExpandEnvironmentStringsForUserW GetDefaultUserProfileDirectoryW

wintrust

WinVerifyTrust

mpr

WNetGetConnectionW

psapi

GetModuleFileNameExW

imagehlp

CheckSumMappedFile

user32

CharUpperW CharLowerA CharUpperA GetSystemMetrics CharLowerW LoadStringW

shell32

SHFileOperationW SHGetFolderPathW CommandLineToArgvW

ole32

PropVariantClear

advapi32

RegUnLoadKeyW RegLoadKeyW RegOpenCurrentUser RevertToSelf ImpersonateLoggedOnUser CryptHashData CryptDestroyHash CryptDecrypt CryptDestroyKey CryptCreateHash CryptEncrypt CryptGenRandom FreeSid SetEntriesInAclW CryptReleaseContext CryptDeriveKey CryptAcquireContextW CryptGetHashParam AllocateAndInitializeSid SetNamedSecurityInfoW RegEnumKeyW AdjustTokenPrivileges LookupPrivilegeValueW RegSetValueExW RegEnumKeyExW RegEnumValueW SetSecurityInfo RegDeleteValueW GetSecurityInfo RegSaveKeyW RegQueryInfoKeyW IsTextUnicode RegCloseKey RegOpenKeyExW RegDeleteKeyW RegQueryValueExW RegCreateKeyExW GetUserNameW OpenProcessToken CloseServiceHandle DeleteService OpenSCManagerW OpenServiceW RegSetValueW StartServiceW ChangeServiceConfigW ControlService InitializeSecurityDescriptor SetSecurityDescriptorDacl CreateServiceW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

Sharing

General

Malware Config

Signatures

File Explorer

2024-03-03_4d032c86367178073c8973c85b986f51_floxif_mafia

PE Signature issue

kernel32

sfc

netapi32

shlwapi

iphlpapi

userenv

wintrust

mpr

psapi

imagehlp

user32

shell32

ole32

advapi32

version

generic