2024-03-29_398e7aae92401d1c34c1db2548354a2e_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-03-29_398e7aae92401d1c34c1db2548354a2e_mafia
Size

1.1MB
MD5

398e7aae92401d1c34c1db2548354a2e
SHA1

cd35240d8bcb003cbab41016485be5c54feda104
SHA256

eefc90a0edc6c319421867484f121efb8a717afad845eeabb23ee411e1168beb
SHA512

893f2bbd0602c00a50ac91d9b390009af02f70a488d7f7b68236b2a0dd0fa7893eb163efc100797e44e95e904f365e7abf1b22182ceea22d4e06317db868e4ad
SSDEEP

24576:O1nvieMbtV/dDK9to2YwJ9pfC7JyH4B3TfebYYs:qUteC7gYB3TmbYYs

Score

1^/10

Malware Config

Signatures

Files

2024-03-29_398e7aae92401d1c34c1db2548354a2e_mafia
.exe windows:5 windows x86 arch:x86

aba309b2b2758d967e94cafb7b4e0efd

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

03:01
Certificate

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Not Before

16-11-2006 01:54

Not After

16-11-2026 01:54

Subject

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4b:02:a0:00:64:56:c0
Certificate

Issuer

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

06-11-2013 20:25

Not After

06-11-2014 20:25

Subject

CN=Open Labs\, LLC,O=Open Labs\, LLC,L=Austin,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

92:ff:cd:a2:2f:6a:cc:31:b0:a1:86:94:43:91:ac:c9:a8:94:51:8e
Signer

Actual PE Digest

92:ff:cd:a2:2f:6a:cc:31:b0:a1:86:94:43:91:ac:c9:a8:94:51:8e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FlushFileBuffers
GetTempPathW
GetLastError
GetCurrentDirectoryW
GetProcAddress
MoveFileW
EnterCriticalSection
CreateEventW
RemoveDirectoryW
GetModuleHandleA
IsDebuggerPresent
GetFileAttributesExW
QueryPerformanceFrequency
DeleteCriticalSection
GetCurrentThreadId
SetThreadAffinityMask
ReleaseMutex
CloseHandle
DeleteFileW
GetCommandLineW
GlobalSize
GlobalLock
GlobalAlloc
GlobalUnlock
GetCurrentProcessId
CompareStringW
SetStdHandle
WriteConsoleW
RtlUnwind
GetTickCount
GetEnvironmentStringsW
SetThreadPriority
GetModuleFileNameA
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
HeapSize
GetStdHandle
HeapCreate
MultiByteToWideChar
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
InitializeCriticalSectionAndSpinCount
GetStringTypeW
LCMapStringW
SetLastError
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
UnhandledExceptionFilter
RaiseException
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetSystemTimeAsFileTime
HeapReAlloc
GetTimeZoneInformation
WideCharToMultiByte
DecodePointer
EncodePointer
CreateThread
ExitThread
HeapAlloc
HeapFree
InterlockedIncrement
InterlockedDecrement
CreateFileW
GetModuleFileNameW
ReadFile
GetFileAttributesW
TerminateProcess
IsProcessorFeaturePresent
LeaveCriticalSection
GetVersionExW
FormatMessageW
Sleep
GetLocaleInfoW
TerminateThread
LoadLibraryW
InitializeCriticalSection
WriteFile
GetCurrentThread
ExitProcess
OutputDebugStringW
SetEvent
WaitForSingleObject
CreateDirectoryW
QueryPerformanceCounter
GetCurrentProcess
SetUnhandledExceptionFilter
FreeLibrary
SetFilePointer
CreateMutexW
FreeEnvironmentStringsW
SetEnvironmentVariableA

user32

DestroyIcon
SetWindowTextW
SetClipboardData
SendMessageW
SetCaretPos
IsWindowVisible
GetSystemMetrics
ReleaseCapture
OpenClipboard
CreateCaret
RegisterClassExW
ShowWindow
SetLayeredWindowAttributes
GetCursorPos
GetMessageTime
GetDesktopWindow
DestroyCaret
DestroyCursor
RedrawWindow
SetWindowLongW
EmptyClipboard
EnableMenuItem
SystemParametersInfoW
GetDC
GetAncestor
SetCursorPos
InvalidateRect
GetAsyncKeyState
GetWindowPlacement
GetForegroundWindow
SetWindowPos
GetMessagePos
GetCapture
CreateIconIndirect
GetWindowLongW
GetWindowTextW
PeekMessageW
SendMessageTimeoutW
CreateWindowExW
DefWindowProcW
GetWindowInfo
MessageBeep
WindowFromPoint
GetClientRect
ShowCaret
BeginPaint
DispatchMessageW
AttachThreadInput
GetWindowThreadProcessId
ReleaseDC
DestroyWindow
GetMessageW
UnregisterClassW
PostMessageW
GetFocus
SetFocus
EnumWindows
GetClipboardData
TranslateMessage
LoadCursorW
TrackMouseEvent
GetParent
SetForegroundWindow
SetCapture
GetMessageExtraInfo
IsChild
GetWindowRect
GetSystemMenu
MapVirtualKeyW
GetUpdateRgn
CloseClipboard
EnumDisplayMonitors
SetCursor
EndPaint
GetActiveWindow

gdi32

DeleteObject
SelectObject
CreateCompatibleDC
SetMapMode
GetOutlineTextMetricsW
SetMapperFlags
GetKerningPairsW
GetDeviceCaps
GetGlyphIndicesW
GetRegionData
CreateBitmap
ExcludeClipRect
CreateDIBSection
CreateFontIndirectW
GetTextMetricsW
DeleteDC
RestoreDC
CreateRectRgn
StretchDIBits
SaveDC
CombineRgn
GetGlyphOutlineW
CreateRectRgnIndirect

advapi32

RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW

shell32

SHGetSpecialFolderPathW
ExtractAssociatedIconW
ShellExecuteW

ole32

RegisterDragDrop
RevokeDragDrop
OleUninitialize
OleInitialize

wininet

InternetSetOptionW
InternetConnectW
HttpOpenRequestW
InternetSetFilePointer
InternetCrackUrlW
HttpSendRequestExW
HttpQueryInfoW
InternetWriteFile
InternetOpenW
HttpEndRequestW
InternetCloseHandle
FtpOpenFileW
InternetReadFile

winmm

timeBeginPeriod
timeGetTime

imm32

ImmGetContext
ImmGetCompositionStringW
ImmSetCandidateWindow
ImmNotifyIME
ImmReleaseContext

Sections

.text
Size: 737KB - Virtual size: 736KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aba309b2b2758d967e94cafb7b4e0efd

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

03:01Certificate

Key Usages

4b:02:a0:00:64:56:c0Certificate

Extended Key Usages

Key Usages

92:ff:cd:a2:2f:6a:cc:31:b0:a1:86:94:43:91:ac:c9:a8:94:51:8eSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

wininet

winmm

imm32

Sections

.text Size: 737KB - Virtual size: 736KB

.rdata Size: 156KB - Virtual size: 156KB

.data Size: 17KB - Virtual size: 25KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 120KB - Virtual size: 120KB

.reloc Size: 72KB - Virtual size: 72KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

03:01
Certificate

4b:02:a0:00:64:56:c0
Certificate

92:ff:cd:a2:2f:6a:cc:31:b0:a1:86:94:43:91:ac:c9:a8:94:51:8e
Signer

.text
Size: 737KB - Virtual size: 736KB

.rdata
Size: 156KB - Virtual size: 156KB

.data
Size: 17KB - Virtual size: 25KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 120KB - Virtual size: 120KB

.reloc
Size: 72KB - Virtual size: 72KB