2024-03-27_ca4649041e6651d24ffbc3386f75fdb5_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-27_ca4649041e6651d24ffbc3386f75fdb5_mafia
Size

5.1MB
MD5

ca4649041e6651d24ffbc3386f75fdb5
SHA1

190e6a0304ab8699c2244886c1c652dd00b02ffb
SHA256

cb837327547678085b81f6758a48e85efaafba301e02ea879fabc6042f362b0f
SHA512

6117eb17b82ef7be60f5fe5add1be9f68dfceff08f85350c260e6fbcf79f82d9e8eaecaf35478d7d6318edea3bf9534bd299e5f9144b37e9fc6039070fbe9cee
SSDEEP

49152:xCnZ0c2C4RG2WcMl1Du9pNAhhIuODDvu+3h9mYdh5ZeqeDIs6d57+/cTy1vdZ3Pk:APcUHlUFAhavx3h9XhPeqeDlX3uk

Score

1^/10

Malware Config

Signatures

Files

2024-03-27_ca4649041e6651d24ffbc3386f75fdb5_mafia
.exe windows:5 windows x86 arch:x86

c1e8ea6c90cb0f45ca630bf1feae9ba8

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4b:48:b2:7c:82:24:fe:37:b1:7a:6a:2e:d7:a8:1c:9f
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/08/2015, 00:00

Not After

10/10/2018, 23:59

Subject

CN=Piriform Ltd,O=Piriform Ltd,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:31:c8:9b:5b:68:00:57:7a:35:5a:e8:68:9a:81:d2:a0:d6:37:99
Signer

Actual PE Digest

41:31:c8:9b:5b:68:00:57:7a:35:5a:e8:68:9a:81:d2:a0:d6:37:99

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

S:\workspace\SpeccyNew\trunk\bin\Release\Win32\Speccy.pdb

Imports

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW
WTSEnumerateSessionsW

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

iphlpapi

GetAdaptersAddresses

wininet

HttpAddRequestHeadersW
HttpOpenRequestW
InternetConnectW
InternetReadFile
InternetCrackUrlW
InternetQueryDataAvailable
InternetOpenW
HttpQueryInfoW
InternetCloseHandle
InternetOpenUrlW
HttpSendRequestW
InternetGetConnectedStateExW

kernel32

FormatMessageA
GetUserDefaultLCID
GetStringTypeExA
GetStringTypeExW
LCMapStringA
LCMapStringW
LoadLibraryA
QueryPerformanceCounter
QueryPerformanceFrequency
InterlockedIncrement
InterlockedDecrement
LoadLibraryExW
lstrcmpiW
FreeLibrary
Sleep
GetPrivateProfileStructW
WritePrivateProfileStructW
CreateEventW
lstrcpynW
SetLastError
MulDiv
RaiseException
GetCurrentThreadId
FlushInstructionCache
GetSystemTimeAsFileTime
WritePrivateProfileStringW
FileTimeToSystemTime
SystemTimeToFileTime
MultiByteToWideChar
DeleteFileW
GetPrivateProfileStringW
WideCharToMultiByte
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
EnterCriticalSection
ResetEvent
OpenEventA
SetEvent
GetCurrentProcessId
CreateEventA
WaitForSingleObject
GetModuleFileNameW
GetVersionExW
CloseHandle
GetCurrentProcess
GetModuleHandleW
GetProcAddress
lstrlenW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
CreateWaitableTimerA
GetSystemInfo
GetTickCount
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
SetWaitableTimer
SetEnvironmentVariableA
SetEndOfFile
SetEnvironmentVariableW
WriteConsoleW
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetOEMCP
GetACP
GetStdHandle
GetCPInfo
GetDateFormatA
GetTimeFormatA
RtlUnwind
VirtualQuery
VirtualProtect
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
HeapSetInformation
InterlockedPopEntrySList
IsProcessorFeaturePresent
InterlockedPushEntrySList
HeapSize
HeapReAlloc
GetStringTypeW
OutputDebugStringW
VerSetConditionMask
VerifyVersionInfoW
ExpandEnvironmentStringsW
lstrcmpW
CreateProcessA
lstrcmpiA
GetSystemDirectoryA
GetLongPathNameW
GetSystemDirectoryW
GlobalMemoryStatusEx
SetThreadPriority
SetThreadAffinityMask
FindResourceA
GetWindowsDirectoryA
DeleteFileA
RemoveDirectoryA
GetComputerNameA
GetTempPathW
GetWindowsDirectoryW
CreateMutexW
VirtualFree
VirtualAlloc
CompareFileTime
OpenProcess
GetSystemDefaultLCID
GetGeoInfoW
GetUserGeoID
GetSystemPowerStatus
SetErrorMode
GetProcessAffinityMask
SetProcessAffinityMask
ExitThread
CreateFileA
LocalAlloc
GetCurrentDirectoryA
CreateDirectoryA
CreateMutexA
ReleaseMutex
GetVersionExA
GetComputerNameExW
DeviceIoControl
GetDriveTypeW
GetTempPathA
GetModuleHandleA
GlobalMemoryStatus
GetModuleFileNameA
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
CreatePipe
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
ReadFile
InterlockedExchangeAdd
InterlockedCompareExchange
ExitProcess
GetNumberFormatW
GetLocaleInfoW
GlobalFree
InterlockedExchange
FindNextFileW
FindFirstFileW
GetFullPathNameW
FindClose
RemoveDirectoryW
GlobalUnlock
GlobalAlloc
lstrcmpA
SetFileTime
SetFilePointer
GetFileSize
GetFileAttributesExW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
LocalFree
FormatMessageW
DuplicateHandle
GetSystemTime
CreateThread
ResumeThread
CreateSemaphoreW
TerminateThread
InitializeCriticalSection
VirtualQueryEx
SetUnhandledExceptionFilter
RtlCaptureContext
GetCurrentThread
LoadLibraryW
GetTimeFormatW
GetDateFormatW
WaitForMultipleObjects
GlobalLock
CreateSemaphoreA
ReleaseSemaphore
GetComputerNameW
WriteFile
CreateFileW
HeapFree
HeapAlloc
HeapDestroy
HeapCreate
lstrcpyW
CompareStringW
lstrlenA
GetProcessHeap
GetCommandLineW
CreateProcessW
GetStartupInfoW
FlushFileBuffers
GetLocalTime

user32

GetDesktopWindow
SetScrollInfo
GetScrollInfo
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
BeginPaint
EndPaint
SetWindowRgn
DrawEdge
UnregisterClassA
EnumDisplaySettingsExW
EnumDisplayDevicesW
GetUserObjectSecurity
wsprintfA
DrawTextW
IntersectRect
RedrawWindow
SetTimer
KillTimer
GetMessageTime
GetDoubleClickTime
SetCapture
GetWindowLongW
IsWindowVisible
EnumWindows
ReleaseCapture
SetCursor
CreatePopupMenu
LoadIconW
DestroyIcon
LoadImageW
SetWindowLongW
GetWindowRect
SendMessageW
SetDlgItemTextW
GetDlgItem
CheckRadioButton
ShowWindow
ScreenToClient
MoveWindow
LoadStringA
GetClipboardData
IsWindow
IsDlgButtonChecked
EnableWindow
DefWindowProcW
CallWindowProcW
GetParent
SetWindowPos
MapWindowPoints
GetClientRect
GetMonitorInfoW
MonitorFromWindow
GetWindow
SetWindowTextW
DestroyWindow
IsCharAlphaNumericW
GetWindowDC
ReleaseDC
InvalidateRect
IsWindowEnabled
PostMessageW
InflateRect
GetSystemMetrics
SystemParametersInfoW
UpdateWindow
GetKeyState
RegisterClassExW
GetClassInfoExW
LoadCursorW
CreateWindowExW
IsClipboardFormatAvailable
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetDlgItemTextW
BringWindowToTop
CharLowerA
CharLowerW
UnregisterClassW
DrawTextExW
GetSysColorBrush
MapDialogRect
SetWindowPlacement
GetWindowPlacement
GetMenuItemCount
CheckMenuItem
IsIconic
SwitchToThisWindow
TranslateAcceleratorW
MonitorFromRect
EnableMenuItem
GetTopWindow
PostQuitMessage
GetClassLongW
SetClassLongW
DeleteMenu
LoadBitmapW
LoadAcceleratorsW
CheckDlgButton
FillRect
GetSysColor
GetFocus
DrawFocusRect
EndDialog
GetDlgCtrlID
GetCapture
SetRectEmpty
SetFocus
GetSubMenu
GetMenuDefaultItem
IsMenu
SetForegroundWindow
GetCursorPos
CreateIconIndirect
SetMenuDefaultItem
RegisterWindowMessageW
LoadMenuW
InsertMenuItemW
GetMenuItemInfoW
SetMenuItemInfoW
CreateMenu
OffsetRect
CopyRect
TrackPopupMenu
GetClassNameW
GetMenu
GetWindowTextLengthW
GetWindowTextW
LoadStringW
GetForegroundWindow
DialogBoxParamW
CreateDialogParamW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
RegisterClassW
GetClassInfoW
GetActiveWindow
MessageBoxW
CharNextW
FindWindowW
CallNextHookEx
SetWindowsHookExW
UnhookWindowsHookEx
GetKeyboardState
DestroyCursor
PtInRect
GetDC
MonitorFromPoint
DestroyMenu
AppendMenuW
ShowScrollBar

gdi32

EndPage
StartPage
GetBitmapBits
CreatePatternBrush
Ellipse
SetBitmapDimensionEx
GetBitmapDimensionEx
SetBkMode
CreateBitmap
Polyline
DPtoLP
GetDeviceCaps
GetTextMetricsW
CreateFontIndirectW
Rectangle
GetTextColor
GetBkColor
GetCurrentObject
SetPixel
LineTo
AbortDoc
RoundRect
GetStockObject
CreatePen
ExtTextOutW
CreateRoundRectRgn
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SetViewportOrgEx
CreateSolidBrush
GetTextExtentExPointW
GetTextExtentPoint32W
TextOutW
SetBkColor
RestoreDC
SaveDC
SetTextColor
SelectObject
DeleteDC
GetObjectW
CreateDIBSection
DeleteObject
EndDoc
StartDocW
StretchBlt
GetDIBColorTable
CreateDCW
ExtEscape
SetDIBColorTable
MoveToEx

comdlg32

GetSaveFileNameW
PrintDlgExW
GetOpenFileNameW

advapi32

RegSetValueExW
RegCreateKeyExW
RegCreateKeyW
RegDeleteKeyW
InitializeSecurityDescriptor
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
GetTokenInformation
OpenProcessToken
GetUserNameW
AllocateAndInitializeSid
FreeSid
OpenSCManagerW
EnumServicesStatusExW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegEnumKeyExW
RegQueryInfoKeyW
SetSecurityDescriptorDacl
CloseServiceHandle
RegEnumValueW
RegQueryValueExA
OpenServiceW
QueryServiceConfigW
EnumServicesStatusW
OpenThreadToken
ImpersonateSelf
LookupAccountSidW
GetSecurityDescriptorOwner
IsValidSid
LookupPrivilegeValueW
AdjustTokenPrivileges
GetSidSubAuthorityCount
GetSidLengthRequired
InitializeSid
GetSidIdentifierAuthority
GetSidSubAuthority
LsaOpenPolicy
LsaQueryInformationPolicy
LsaFreeMemory
CreateServiceA
DeleteService
OpenServiceA
StartServiceA
ControlService
OpenSCManagerA
RegOpenKeyExA
ConvertStringSidToSidW
RegLoadKeyW
RegUnLoadKeyW
CreateServiceW
StartServiceW
RevertToSelf
AccessCheck
IsValidSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
AddAccessAllowedAce
InitializeAcl
GetLengthSid
RegDeleteValueW

shell32

DoEnvironmentSubstW
SHGetSpecialFolderPathW
SHGetFolderPathA
ShellExecuteExW
ShellExecuteW
Shell_NotifyIconW
DragFinish
DuplicateIcon
DragQueryFileW

ole32

CoInitializeSecurity
CoUninitialize
CreateStreamOnHGlobal
CoSetProxyBlanket
CoInitialize
CoTaskMemAlloc
CoTaskMemRealloc
PropVariantClear
CoInitializeEx
CoCreateInstance
CoTaskMemFree

oleaut32

SysFreeString
VariantTimeToSystemTime
SysAllocStringByteLen
SafeArrayAccessData
SafeArrayGetVartype
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayUnaccessData
SafeArrayGetElement
SysStringByteLen
VariantInit
VariantClear
SysAllocString
SystemTimeToVariantTime
SysStringLen
SysAllocStringLen
VarUI4FromStr
VariantChangeType
VarBstrFromR8
VarUdateFromDate
VariantCopy

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

setupapi

SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInstanceIdW
SetupDiOpenDevRegKey
SetupDiBuildDriverInfoList
SetupDiDestroyDriverInfoList
SetupDiGetSelectedDriverW
SetupDiSetSelectedDriverW
SetupDiGetDeviceInstallParamsW
SetupDiEnumDeviceInfo
SetupDiCallClassInstaller
CM_Get_DevNode_Registry_PropertyW
CM_Open_DevNode_Key
CM_Get_Parent
SetupOpenFileQueue
SetupCloseFileQueue
SetupScanFileQueueW
SetupDiDestroyDeviceInfoList
SetupDiSetDeviceInstallParamsW
CM_Get_Sibling_Ex
SetupDiGetClassDevsW
CM_Connect_MachineW
CM_Locate_DevNode_ExW
CM_Get_Child_Ex
CM_Get_DevNode_Registry_Property_ExW

powrprof

GetActivePwrScheme
ReadPwrScheme
GetPwrCapabilities

psapi

GetProcessImageFileNameW
GetProcessMemoryInfo
GetModuleFileNameExW

winmm

waveInGetDevCapsW
waveOutGetDevCapsW
waveInMessage
waveOutMessage
waveOutGetNumDevs
waveInGetNumDevs

netapi32

NetUserModalsGet
NetWkstaGetInfo
NetUserGetInfo
NetApiBufferFree

shlwapi

PathIsDirectoryEmptyW
PathFindFileNameA
PathCombineW
PathCanonicalizeW
StrFormatByteSizeW
PathMatchSpecW
PathAddExtensionW
PathAppendW
PathFileExistsW
PathRemoveExtensionW
PathIsDirectoryW
PathRemoveFileSpecW
PathStripPathW

gdiplus

GdipGetImageHeight
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDisposeImage
GdipFree
GdipAlloc
GdipCloneImage
GdipCreateBitmapFromScan0
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromStream
GdipGetImagePixelFormat
GdipBitmapUnlockBits
GdipDrawImageI
GdipBitmapLockBits
GdipGetImageWidth
GdipGetImagePaletteSize
GdipGetImagePalette

msimg32

TransparentBlt
AlphaBlend

comctl32

CreatePropertySheetPageW
_TrackMouseEvent
InitCommonControlsEx
PropertySheetW
DestroyPropertySheetPage

crypt32

CryptDecodeObject
CryptMsgGetParam
CertGetNameStringW
CertFindCertificateInStore
CryptQueryObject
CryptMsgClose
CertCloseStore
CertFreeCertificateContext

wintrust

WinVerifyTrust

ws2_32

WSALookupServiceNextW
WSALookupServiceBeginW
getnameinfo
htons
WSAAddressToStringW
inet_ntoa
htonl
WSALookupServiceEnd
WSAStartup
WSACleanup
WSAGetLastError
inet_addr

winspool.drv

ClosePrinter
GetPrinterDriverW
OpenPrinterW
EnumPrintersW
ord203

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 873KB - Virtual size: 872KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 294KB - Virtual size: 336KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 428KB - Virtual size: 428KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 400KB - Virtual size: 400KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c1e8ea6c90cb0f45ca630bf1feae9ba8

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

4b:48:b2:7c:82:24:fe:37:b1:7a:6a:2e:d7:a8:1c:9fCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

41:31:c8:9b:5b:68:00:57:7a:35:5a:e8:68:9a:81:d2:a0:d6:37:99Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wtsapi32

version

iphlpapi

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

rpcrt4

setupapi

powrprof

psapi

winmm

netapi32

shlwapi

gdiplus

msimg32

comctl32

crypt32

wintrust

ws2_32

winspool.drv

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.rdata Size: 873KB - Virtual size: 872KB

.data Size: 294KB - Virtual size: 336KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 428KB - Virtual size: 428KB

.reloc Size: 400KB - Virtual size: 400KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

4b:48:b2:7c:82:24:fe:37:b1:7a:6a:2e:d7:a8:1c:9f
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

41:31:c8:9b:5b:68:00:57:7a:35:5a:e8:68:9a:81:d2:a0:d6:37:99
Signer

.text
Size: 3.2MB - Virtual size: 3.2MB

.rdata
Size: 873KB - Virtual size: 872KB

.data
Size: 294KB - Virtual size: 336KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 428KB - Virtual size: 428KB

.reloc
Size: 400KB - Virtual size: 400KB