2024-03-10_173b93f87741794914cbb5c2a0015775_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-03-10_173b93f87741794914cbb5c2a0015775_mafia
Size

4.1MB
MD5

173b93f87741794914cbb5c2a0015775
SHA1

b856977c2d1c597da65f3e98723789cce879d8a4
SHA256

8a63c9bc951186f888e000b1c14ae1c8a7eefa47bc682c4ea89f98f82f968a49
SHA512

da9c01fae993d3a0fb3d55476812d967459f09a90b2b07b55d51a4fee82d5a15908ec99207e4ff848e0ee10355fe3ea818269191cdbe861a5fee124b9d5f473d
SSDEEP

98304:xAIM6Rk2CNi3R7yj16tu/t8LSgRMrRPuenCq:2IM6Rwv/tgerRPu

Score

1^/10

Malware Config

Signatures

Files

2024-03-10_173b93f87741794914cbb5c2a0015775_mafia
.exe windows:5 windows x86 arch:x86

4f69c71b04a09c376cb48feeba0778f1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

78:6d:42:87:39:d2:15:06:36:c3:1c:f7:d2:e7:7a:c6
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

04/08/2014, 00:00

Not After

04/08/2015, 23:59

Subject

CN=inscommunication Co.\, Ltd.,OU=IT Team,O=inscommunication Co.\, Ltd.,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

9d:db:f5:d8:00:67:98:15:ee:3d:6d:8a:a4:37:88:0e:db:22:0b:3d
Signer

Actual PE Digest

9d:db:f5:d8:00:67:98:15:ee:3d:6d:8a:a4:37:88:0e:db:22:0b:3d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\dev\cpp\Client\Down\Release\Down.pdb

Imports

user32

SetForegroundWindow
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
LoadIconA
ShowWindow
SetWindowPos
GetDoubleClickTime
CharUpperBuffA
CopyIcon
GetUpdateRect
FrameRect
IsClipboardFormatAvailable
CreateMenu
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcA
DefFrameProcA
WaitMessage
PostThreadMessageA
IsMenu
MonitorFromPoint
UpdateLayeredWindow
MapVirtualKeyExA
IsCharLowerA
LoadImageW
EmptyClipboard
SetTimer
SetClipboardData
DestroyMenu
LockWindowUpdate
SetCursorPos
CreateAcceleratorTableA
GetKeyboardState
GetKeyboardLayout
ToAsciiEx
DrawFrameControl
DrawEdge
DrawStateA
GetActiveWindow
DestroyAcceleratorTable
IsZoomed
UnionRect
SetParent
GetSystemMenu
RegisterClipboardFormatA
LoadMenuW
LoadAcceleratorsW
CopyImage
NotifyWinEvent
EnableScrollBar
HideCaret
InvertRect
GetAsyncKeyState
GetMenuDefaultItem
MessageBeep
GetNextDlgGroupItem
DeleteMenu
SetLayeredWindowAttributes
EnumDisplayMonitors
CharNextA
UnpackDDElParam
ReuseDDElParam
LoadMenuA
LoadAcceleratorsA
InsertMenuItemA
BringWindowToTop
TranslateAcceleratorA
InvalidateRgn
CopyAcceleratorTableA
SetRectEmpty
UnregisterClassA
GetMenuItemInfoA
RealChildWindowFromPoint
LoadCursorA
GetSysColorBrush
SetWindowContextHelpId
MapDialogRect
ShowOwnedPopups
GetMessageA
TranslateMessage
TrackPopupMenu
GetCursorPos
OpenClipboard
SetMenuDefaultItem
AppendMenuA
CreatePopupMenu
KillTimer
CloseWindow
GetSystemMetrics
GetSysColor
ReleaseCapture
DrawIconEx
GetIconInfo
LoadImageA
DestroyIcon
ExitWindowsEx
CopyRect
PtInRect
GetClassInfoA
OffsetRect
SendMessageA
GetClientRect
ClientToScreen
InvalidateRect
GetCapture
SubtractRect
DestroyCursor
GetWindowRgn
SetCapture
WindowFromPoint
LoadBitmapW
GetParent
GetWindowRect
EnableWindow
SetCursor
UpdateWindow
RedrawWindow
SetRect
ReleaseDC
GetDC
FillRect
CallWindowProcA
MessageBoxA
SetWindowLongA
CloseClipboard
IsWindow
ValidateRect
PostQuitMessage
MapVirtualKeyA
GetKeyNameTextA
GetDesktopWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
CharUpperA
LoadCursorW
DrawIcon
SystemParametersInfoA
IsRectEmpty
IsIconic
IntersectRect
EndPaint
BeginPaint
GetWindowDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
MoveWindow
SetWindowTextA
IsDialogMessageA
GetWindowLongA
SetWindowRgn
FindWindowA
PostMessageA
DrawFocusRect
GetFocus
GetClassNameA
EnumChildWindows
MapWindowPoints
SetClassLongA
RegisterWindowMessageA
CheckDlgButton
SendDlgItemMessageA
WinHelpA
IsChild
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetLastActivePopup
SetActiveWindow
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
ReplyMessage
LoadIconW
InflateRect
UnhookWindowsHookEx
GetMessageTime
RemoveMenu
GetSubMenu
GetMenuItemCount
InsertMenuA
GetMenuItemID
GetMenuStringA
GetMenuState
IsWindowEnabled
ScreenToClient
GetKeyState
CheckMenuItem
EnableMenuItem
ModifyMenuA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
GetWindow
GetMenu
DefWindowProcA
GetDlgCtrlID
GetWindowPlacement
SetWindowPlacement
SetScrollInfo
GetScrollInfo
DeferWindowPos
EqualRect
AdjustWindowRectEx
RegisterClassA
GetClassInfoExA
CreateWindowExA
IsWindowVisible
ShowScrollBar
GetScrollPos
SetScrollPos
GetScrollRange
SetScrollRange
SetMenu
ScrollWindow
GetMonitorInfoA
MonitorFromWindow
PeekMessageA
GetMessagePos

kernel32

GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
GetCPInfo
GetOEMCP
GetACP
GetFileAttributesA
GetFileTime
GetTempFileNameA
SetErrorMode
GetFileAttributesExA
GetFileSizeEx
GetCurrentDirectoryA
GetWindowsDirectoryA
GetNumberFormatA
GetTempPathA
InitializeCriticalSectionAndSpinCount
GetProfileIntA
SearchPathA
VirtualProtect
FindResourceExW
FindFirstFileExA
RtlUnwind
RaiseException
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
ExitThread
CreateThread
HeapSetInformation
GetStartupInfoW
VirtualAlloc
VirtualQuery
HeapReAlloc
ExitProcess
HeapQueryInformation
HeapSize
SetStdHandle
GetFileType
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
IsValidCodePage
LCMapStringW
GetStdHandle
GetTimeZoneInformation
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
GetDriveTypeW
CompareStringW
GetConsoleCP
GetConsoleMode
GetCurrentDirectoryW
WriteConsoleW
CreateFileW
SetEnvironmentVariableA
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoA
InterlockedExchange
lstrcmpA
GetModuleHandleW
FileTimeToLocalFileTime
FindNextFileA
GetFullPathNameA
GetFileSize
SetEndOfFile
UnlockFile
LockFile
TlsGetValue
ReadFile
DeleteFileA
lstrcmpiA
FileTimeToSystemTime
GetThreadLocale
GetCurrentProcessId
GetModuleFileNameW
ReleaseActCtx
CreateActCtxW
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
LoadLibraryW
lstrcmpW
CopyFileA
GlobalSize
FormatMessageA
lstrlenW
LocalFree
GetCommandLineA
GetExitCodeThread
GetSystemInfo
GetCurrentThread
SetThreadPriority
TerminateThread
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateMutexA
Sleep
GetTickCount
OpenProcess
VirtualAllocEx
ReadProcessMemory
VirtualFreeEx
ActivateActCtx
DeactivateActCtx
lstrcpynA
lstrcpyA
GlobalReAlloc
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
SetEvent
ResetEvent
FindResourceA
FreeResource
GlobalAlloc
ResumeThread
GlobalLock
GlobalUnlock
MulDiv
GlobalFree
CreateEventA
InterlockedDecrement
lstrlenA
WideCharToMultiByte
LoadResource
LockResource
SizeofResource
FindResourceW
CreateToolhelp32Snapshot
Process32First
Process32Next
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
GetCurrentThreadId
GetVolumeInformationA
CreateDirectoryA
FindFirstFileA
FindClose
GetDiskFreeSpaceExA
GetModuleHandleA
GetCurrentProcess
DuplicateHandle
GetExitCodeProcess
CreateRemoteThread
GetLastError
WaitForSingleObject
SetLastError
LoadLibraryA
GetProcAddress
FreeLibrary
GetVersionExA
CreateFileA
SetFilePointer
WriteFile
CloseHandle
MultiByteToWideChar
GetModuleFileNameA
LocalAlloc
InterlockedIncrement
FlushFileBuffers

gdi32

GetTextFaceA
SetPixelV
SetPaletteEntries
ExtFloodFill
GetBoundsRect
FrameRgn
FillRgn
PtInRegion
GetViewportOrgEx
GetWindowOrgEx
EnumFontFamiliesExA
OffsetRgn
SetPixel
SetDIBColorTable
Polygon
Polyline
CreatePolygonRgn
CreateRoundRectRgn
GetSystemPaletteEntries
RealizePalette
GetNearestPaletteIndex
GetPaletteEntries
CreatePalette
GetTextCharsetInfo
EnumFontFamiliesA
GetTextMetricsA
CreateDIBitmap
GetTextColor
GetBkColor
GetRgnBox
Ellipse
LPtoDP
CreateEllipticRgn
PatBlt
CreateHatchBrush
GetObjectType
SelectPalette
CreatePatternBrush
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
SelectClipRgn
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
SetTextColor
CopyMetaFileA
CreateDCA
GetPixel
CreateRectRgn
CreateFontA
SetRectRgn
CreateRectRgnIndirect
CreatePen
CreateDIBSection
ExtCreateRegion
CombineRgn
StretchBlt
DPtoLP
CreateBitmap
GetMapMode
SetMapMode
SetBkColor
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteDC
GetDeviceCaps
CreateFontIndirectA
DeleteObject
CreateSolidBrush
GetStockObject
GetObjectA
GetTextExtentPoint32A
Rectangle

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegQueryValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegConnectRegistryA
RegOpenKeyExA
RegEnumKeyA
RegEnumValueA
RegCloseKey
RegQueryInfoKeyA
RegSetValueExA
RegCreateKeyExA
RegEnumKeyExA
RegQueryValueA
RegDeleteValueA
RegDeleteKeyA

shell32

DragFinish
DragQueryFileA
SHGetDesktopFolder
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHBrowseForFolderA
SHAppBarMessage
Shell_NotifyIconA
ShellExecuteA
SHGetSpecialFolderPathA
SHGetFileInfoA

comctl32

ord17
ImageList_GetIconSize

shlwapi

PathGetArgsA
PathFindFileNameA
PathFindExtensionA
PathRemoveFileSpecW
PathIsUNCA
PathStripToRootA
StrFormatByteSize64A

ole32

RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
DoDragDrop
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromProgID
CoCreateGuid
CoInitializeEx
CLSIDFromString
OleDraw
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CoTaskMemFree
CreateStreamOnHGlobal
CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

VarBstrFromDate
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
VariantChangeType
SysAllocString
OleLoadPicture
SysAllocStringLen
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysFreeString
OleCreateFontIndirect

oledlg

ord8

ws2_32

WSARecv
WSACleanup
closesocket
WSAGetLastError
select
connect
htons
inet_addr
socket
__WSAFDIsSet
recv
WSASocketA
WSAConnect
setsockopt
WSAWaitForMultipleEvents
WSASend
WSAStartup

wininet

InternetOpenA
InternetConnectA
InternetCloseHandle
InternetReadFile
HttpSendRequestA
HttpOpenRequestA

nat

ord14
ord17
ord23
ord21
ord18
ord22

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

gdiplus

GdipGetImagePixelFormat
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdiplusShutdown
GdipFree
GdipAlloc
GdipDeleteGraphics
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCloneImage
GdipGetImageWidth
GdipDrawImageI
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImageGraphicsContext

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

winmm

PlaySoundA

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 321KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f69c71b04a09c376cb48feeba0778f1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

78:6d:42:87:39:d2:15:06:36:c3:1c:f7:d2:e7:7a:c6Certificate

Extended Key Usages

Key Usages

9d:db:f5:d8:00:67:98:15:ee:3d:6d:8a:a4:37:88:0e:db:22:0b:3dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

kernel32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

ws2_32

wininet

nat

oleacc

gdiplus

imm32

winmm

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 321KB - Virtual size: 320KB

.data Size: 26KB - Virtual size: 56KB

.rsrc Size: 2.2MB - Virtual size: 2.2MB

.reloc Size: 184KB - Virtual size: 184KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

78:6d:42:87:39:d2:15:06:36:c3:1c:f7:d2:e7:7a:c6
Certificate

9d:db:f5:d8:00:67:98:15:ee:3d:6d:8a:a4:37:88:0e:db:22:0b:3d
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 321KB - Virtual size: 320KB

.data
Size: 26KB - Virtual size: 56KB

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

.reloc
Size: 184KB - Virtual size: 184KB