2024-03-28_7d9fd8d68f9d577bac76305a33344d68_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-28_7d9fd8d68f9d577bac76305a33344d68_mafia
Size

231KB
MD5

7d9fd8d68f9d577bac76305a33344d68
SHA1

7981c9058e1690cda98fd79545ed270f100ee497
SHA256

7e273ef68e23e92365a9a92d76cbce7898ce50447fc52028d6e41ae23a1903a0
SHA512

a5d637d7b6742d8cd40fbfa37b880259f05c77a3b9e9f663d9543a85058b2059effd48d29dd16da7993dd173427b191554e39754282a58de48746ba2d264854f
SSDEEP

3072:5gvvGAoqf2GMvzZtnHavpmWiI8zJ4uPPzDiXtN51j/s8X4YQe/T:5gvvGAojGsZhONB8z1zUjk8X+mT

Score

1^/10

Malware Config

Signatures

Files

2024-03-28_7d9fd8d68f9d577bac76305a33344d68_mafia
.exe windows:5 windows x86 arch:x86

5b7065a2703a119a1c36f4f2ba5d5c98

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:93:60:05:1b:cc:f6:66:42:99:89:98:d5:ba:97:ce
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

17/08/2022, 00:00

Not After

15/08/2025, 23:59

Subject

CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e2:9b:8e:b2:89:be:91:a0:d6:06:03:94:00:3a:dd:65:d7:00:50:26:ce:df:57:ed:c3:cc:85:c9:24:6d:db:7e
Signer

Actual PE Digest

e2:9b:8e:b2:89:be:91:a0:d6:06:03:94:00:3a:dd:65:d7:00:50:26:ce:df:57:ed:c3:cc:85:c9:24:6d:db:7e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrStrIA

powrprof

GetPwrCapabilities

kernel32

WideCharToMultiByte
FormatMessageA
GetLastError
CreateDirectoryA
lstrcmpiA
lstrcatA
lstrcpyA
GetSystemInfo
GetProcAddress
GetModuleHandleA
GetVersionExA
FindClose
FindFirstFileA
GetTimeFormatA
GetLocalTime
WriteFile
ReadFile
CreateProcessA
DuplicateHandle
GetCurrentProcess
CreatePipe
CreateFileA
GetExitCodeProcess
WaitForSingleObject
Sleep
lstrlenW
GetPrivateProfileStringA
GetWindowsDirectoryA
OutputDebugStringA
DeleteFileA
GetModuleFileNameA
FreeLibrary
LoadLibraryA
GetCommandLineA
InterlockedDecrement
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
CloseHandle
HeapAlloc
GetTickCount
CreateFileW
SetEndOfFile
WriteConsoleW
FlushFileBuffers
SetStdHandle
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleCP
GetStringTypeW
GetConsoleMode
HeapDestroy
LoadLibraryW
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
MultiByteToWideChar
lstrlenA
LocalFree
RtlUnwind
GetModuleHandleW
ExitProcess
DecodePointer
HeapSetInformation
GetStartupInfoW
EncodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
GetModuleFileNameW
HeapCreate
SetHandleCount
GetFileType
LCMapStringW

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey
GetUserNameA

ole32

CoUninitialize
CoCreateInstance
CoInitialize

oleaut32

SysAllocString
SysFreeString
VariantClear

Sections

.text
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5b7065a2703a119a1c36f4f2ba5d5c98

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0b:93:60:05:1b:cc:f6:66:42:99:89:98:d5:ba:97:ceCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

e2:9b:8e:b2:89:be:91:a0:d6:06:03:94:00:3a:dd:65:d7:00:50:26:ce:df:57:ed:c3:cc:85:c9:24:6d:db:7eSigner

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

powrprof

kernel32

advapi32

ole32

oleaut32

Sections

.text Size: 121KB - Virtual size: 121KB

.rdata Size: 31KB - Virtual size: 30KB

.data Size: 5KB - Virtual size: 61KB

.rsrc Size: 52KB - Virtual size: 51KB

.reloc Size: 12KB - Virtual size: 12KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0b:93:60:05:1b:cc:f6:66:42:99:89:98:d5:ba:97:ce
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

e2:9b:8e:b2:89:be:91:a0:d6:06:03:94:00:3a:dd:65:d7:00:50:26:ce:df:57:ed:c3:cc:85:c9:24:6d:db:7e
Signer

.text
Size: 121KB - Virtual size: 121KB

.rdata
Size: 31KB - Virtual size: 30KB

.data
Size: 5KB - Virtual size: 61KB

.rsrc
Size: 52KB - Virtual size: 51KB

.reloc
Size: 12KB - Virtual size: 12KB