2024-03-29_63ace7932ad17ec3d5f525810286d918_mafia_sedreco

Sharing

Copy URL

Twitter E-mail

General

Target

2024-03-29_63ace7932ad17ec3d5f525810286d918_mafia_sedreco
Size

2.0MB
MD5

63ace7932ad17ec3d5f525810286d918
SHA1

8b10620f29ddcb88cc136352cc57835e6584076b
SHA256

a6bf21e1a15a1a84f528db8ee99e72fa11fe1f9d5b51412f11555c16af1f5680
SHA512

43cc2da25e17d1e7bd6a849df3543bd5c0aa34448f43cb703a81ad60c4d2aa00b2849a13e5f1950f58c29afd8c613d36f2faa08deb6f64f87891959e741d6a81
SSDEEP

49152:zXSidT45mbrZ+ZkSR+JFsAD4GTZ2wP14IRCMkLmhedC1Wqp/tVkF6z9PHIBhmTuP:zfwmbrNJFslGF2wP1Z4LmheeHtGF6z9+

Score

1^/10

Malware Config

Signatures

Files

2024-03-29_63ace7932ad17ec3d5f525810286d918_mafia_sedreco
.exe windows:5 windows x86 arch:x86

5ae5a9f3d884abb7139e16ad76691a05

Code Sign

20:7a:06:bd:65:54:45:09:5b:35:8b:2c:51:24:04:6e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

01-05-2013 00:00

Not After

01-05-2014 23:59

Subject

CN=OOO Lega Media,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IT,O=OOO Lega Media,L=Saint-Petersburg,ST=Saint-Petersburg,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8c:1b:77:29:89:5d:67:e7:ac:49:94:03:02:26:62:30:96:c0:ed:e0
Signer

Actual PE Digest

8c:1b:77:29:89:5d:67:e7:ac:49:94:03:02:26:62:30:96:c0:ed:e0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\projects\bitmaster\client\Production\bitmaster.pdb

Imports

torrent

ord1

kernel32

CreateThread
MulDiv
InitializeCriticalSection
Sleep
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateFileA
GetModuleHandleA
LoadLibraryA
LoadLibraryW
GetVersionExW
lstrcpynA
lstrlenA
lstrcpynW
LocalFree
FindClose
FindNextFileW
FindFirstFileW
GetUserDefaultLCID
GetModuleFileNameA
GetLocaleInfoA
WaitForSingleObject
CopyFileW
GetTickCount
SleepEx
FormatMessageA
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
ExpandEnvironmentStringsA
GetVersion
QueryPerformanceCounter
GlobalMemoryStatus
GetVersionExA
FlushConsoleInputBuffer
GetFileAttributesA
SetFileAttributesA
FindFirstFileExA
GetDriveTypeA
GetFileInformationByHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
ExitThread
HeapReAlloc
HeapSetInformation
GetCommandLineW
GetSystemTimeAsFileTime
RtlUnwind
GetExitCodeThread
EncodePointer
InterlockedExchange
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
GetTimeZoneInformation
LCMapStringW
GetCPInfo
HeapCreate
HeapDestroy
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThread
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetConsoleCP
SetStdHandle
GetFullPathNameA
SetUnhandledExceptionFilter
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
FreeLibrary
GetStringTypeW
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
SetConsoleCtrlHandler
CompareStringW
SetEnvironmentVariableA
GetDriveTypeW
FindNextFileA
FindFirstFileA
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
GetModuleHandleW
GetProcAddress
GetCurrentProcessId
GetEnvironmentVariableW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
GetModuleFileNameW
SetLastError
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
FatalAppExitA
LeaveCriticalSection
EnterCriticalSection
RaiseException
GlobalFree
SetEndOfFile
SetFilePointer
GetStartupInfoW
CreateProcessW
GetCurrentDirectoryW
WideCharToMultiByte
RemoveDirectoryW
DeleteFileW
MoveFileW
GetFileAttributesW
CreateDirectoryW
SetCurrentDirectoryW
GetLocalTime
MultiByteToWideChar
GetFileSize
GlobalAlloc
GlobalLock
ReadFile
GlobalUnlock
lstrlenW
CreateFileW
WriteFile
CloseHandle
ExitProcess
DecodePointer
FlushFileBuffers

user32

TrackPopupMenuEx
SetWindowPos
GetForegroundWindow
GetWindowThreadProcessId
MessageBeep
GetClipboardData
LoadAcceleratorsW
LoadMenuW
SystemParametersInfoW
EqualRect
UnionRect
AttachThreadInput
LoadStringA
SetFocus
LoadStringW
IsWindowVisible
MapWindowPoints
BringWindowToTop
IsZoomed
GetMenuItemInfoW
EnumWindows
MessageBoxA
AnimateWindow
SetCursor
GetProcessWindowStation
RemoveMenu
GetMenuItemCount
TranslateAcceleratorW
PostMessageW
PostQuitMessage
GetWindowPlacement
wvsprintfW
SetClipboardViewer
ChangeClipboardChain
KillTimer
SetTimer
SetWindowTextW
MessageBoxW
EndPaint
BeginPaint
FillRect
DrawTextW
PtInRect
InvalidateRect
TrackMouseEvent
CharNextW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
FindWindowW
GetSystemMetrics
CreateWindowExW
RegisterClassExW
CallWindowProcW
GetWindowLongW
DefWindowProcW
DestroyWindow
LoadCursorW
GetClassInfoExW
IsWindow
ShowWindow
GetClientRect
MoveWindow
SetWindowLongW
OpenClipboard
EmptyClipboard
CloseClipboard
SetClipboardData
GetCursorPos
SetForegroundWindow
TrackPopupMenu
MonitorFromPoint
GetMonitorInfoW
SetMenuDefaultItem
AppendMenuW
DestroyMenu
CreatePopupMenu
LoadIconW
LoadImageW
GetDesktopWindow
GetWindowRect
SendMessageW
GetDC
ReleaseDC
UnregisterClassA
UpdateWindow
GetUserObjectInformationW

gdi32

GetObjectW
DeleteDC
GetDIBits
CreateDIBSection
SetDIBitsToDevice
SetStretchBltMode
StretchDIBits
SetDIBits
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
CreatePen
CreateSolidBrush
CreateFontIndirectA
GetDeviceCaps
SetTextColor
SetBkMode
GetTextExtentPoint32W
LineTo
MoveToEx
SetViewportOrgEx
GetBitmapBits
GetObjectA
CreateDCA
DeleteObject

comdlg32

GetOpenFileNameW

advapi32

LookupAccountNameA
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegDeleteKeyW
RegisterEventSourceA
ReportEventA
DeregisterEventSource
GetUserNameA
RegCloseKey
ConvertSidToStringSidA
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteValueW

shell32

SHGetFolderPathW
Shell_NotifyIconW
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
ShellExecuteW

ole32

CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateGuid
CreateStreamOnHGlobal

oleaut32

VarUI4FromStr
SysFreeString
OleLoadPicture

shlwapi

SHDeleteKeyW

comctl32

ImageList_Create
ImageList_Destroy
ImageList_Add
ImageList_Draw
InitCommonControlsEx

dbghelp

MiniDumpWriteDump

ws2_32

gethostname
ioctlsocket
select
__WSAFDIsSet
listen
accept
recvfrom
sendto
getaddrinfo
freeaddrinfo
WSASetLastError
connect
socket
closesocket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
send
recv
WSAGetLastError
WSAStartup
WSACleanup
shutdown

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 325KB - Virtual size: 325KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5ae5a9f3d884abb7139e16ad76691a05

Code Sign

20:7a:06:bd:65:54:45:09:5b:35:8b:2c:51:24:04:6eCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

8c:1b:77:29:89:5d:67:e7:ac:49:94:03:02:26:62:30:96:c0:ed:e0Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

torrent

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

dbghelp

ws2_32

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 325KB - Virtual size: 325KB

.data Size: 44KB - Virtual size: 61KB

.rsrc Size: 32KB - Virtual size: 32KB

.reloc Size: 71KB - Virtual size: 70KB

20:7a:06:bd:65:54:45:09:5b:35:8b:2c:51:24:04:6e
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

8c:1b:77:29:89:5d:67:e7:ac:49:94:03:02:26:62:30:96:c0:ed:e0
Signer

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 325KB - Virtual size: 325KB

.data
Size: 44KB - Virtual size: 61KB

.rsrc
Size: 32KB - Virtual size: 32KB

.reloc
Size: 71KB - Virtual size: 70KB