2024-04-09_238475cf58fe2fa98a60b19aeab3d0d6_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-09_238475cf58fe2fa98a60b19aeab3d0d6_mafia
Size

690KB
MD5

238475cf58fe2fa98a60b19aeab3d0d6
SHA1

bd2cb1f884fa2c83d5d66b7bd4211d23d670ddb9
SHA256

dd6da76025f2c6e7fe52095b7696dad4d034b8b2c130ec3a2bfd2c148a88bc75
SHA512

3eb48128a058c769d39487d1c0ccdb4d264103cee4938f08e719b5c3f76648e2a5869c00e25149676d6e5e33a98d590cf067d51353ceb0f72ae1618bc2044d3c
SSDEEP

12288:lsw+9VeSGUMoZl89/VER4f+xk4RHvmX1Us1cDP0XYWzWdoJ3r:lsw+9kSGUtmEw4R+FUsaDPw9rh

Score

1^/10

Malware Config

Signatures

Files

2024-04-09_238475cf58fe2fa98a60b19aeab3d0d6_mafia
.exe windows:5 windows x86 arch:x86

0912f29a25eca1c196ca6643f0fc2ce5

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1f:6c:98:ca:ad:2a:e7:c1:8a:bb:ca:ad
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

17/06/2022, 13:01

Not After

17/06/2025, 13:01

Subject

SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1f:6c:98:ca:ad:2a:e7:c1:8a:bb:ca:ad
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

17/06/2022, 13:01

Not After

17/06/2025, 13:01

Subject

SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ad:ac:70:2e:c3:bc:a0:33:e6:d2:c3:b7:78:dd:2a:20:21:03:ae:73:4c:10:98:70:19:c0:bf:f6:9b:df:3c:50
Signer

Actual PE Digest

ad:ac:70:2e:c3:bc:a0:33:e6:d2:c3:b7:78:dd:2a:20:21:03:ae:73:4c:10:98:70:19:c0:bf:f6:9b:df:3c:50

Digest Algorithm

sha256

PE Digest Matches

true

91:55:0d:19:83:c0:62:fb:9f:35:1f:8a:f2:7d:47:17:f9:2c:51:3c
Signer

Actual PE Digest

91:55:0d:19:83:c0:62:fb:9f:35:1f:8a:f2:7d:47:17:f9:2c:51:3c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\nsmsrc\nsm\1410\1410\ctl32\release_unicode\pcirisvr.pdb

Imports

comctl32

ImageList_GetImageCount
ImageList_ReplaceIcon
ord17

kernel32

ExpandEnvironmentStringsW
GetPrivateProfileStringW
DeleteFileW
GetExitCodeProcess
CreateSemaphoreW
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
PulseEvent
InitializeCriticalSection
DeleteCriticalSection
CreateDirectoryW
TerminateProcess
CreateRemoteThread
DuplicateHandle
GetProfileStringW
FormatMessageW
WinExec
SizeofResource
FindResourceExW
EnumResourceLanguagesW
EnumResourceNamesW
Beep
VirtualQueryEx
RaiseException
GetThreadContext
SuspendThread
GetExitCodeThread
OpenThread
GetFileAttributesW
GetSystemDefaultLangID
EnumResourceTypesW
IsBadReadPtr
GetSystemInfo
SetCurrentDirectoryW
GetCurrentDirectoryW
LoadLibraryExW
InterlockedExchange
LoadLibraryA
WriteConsoleW
SetUnhandledExceptionFilter
SetEndOfFile
GetConsoleMode
GetConsoleCP
SetConsoleCtrlHandler
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetLocaleInfoW
GetUserDefaultLCID
FatalAppExitA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
GetStringTypeW
GetTimeZoneInformation
IsProcessorFeaturePresent
GetWindowsDirectoryW
GetStartupInfoW
SetHandleCount
GetFileType
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetStdHandle
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapDestroy
HeapCreate
IsDebuggerPresent
UnhandledExceptionFilter
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapSetInformation
GetCommandLineW
DecodePointer
EncodePointer
HeapReAlloc
RtlUnwind
WideCharToMultiByte
MultiByteToWideChar
ExitProcess
GetProcessTimes
SetEnvironmentVariableA
GetSystemTimeAsFileTime
OutputDebugStringW
GetTempPathW
GetLocalTime
InterlockedIncrement
GetModuleHandleW
LocalAlloc
CreateFileMappingW
LocalFree
GetModuleFileNameW
GetTickCount
CreateEventW
GetCurrentThreadId
CreateThread
ResetEvent
OpenFileMappingW
GetLastError
MapViewOfFile
OpenProcess
OpenEventW
GetVersionExW
WaitForSingleObject
Sleep
WaitForMultipleObjects
UnmapViewOfFile
SetEvent
CloseHandle
GetCurrentProcess
CompareStringW
GetVersion
FindFirstFileW
MoveFileExW
FindNextFileW
FindClose
lstrlenW
GetDateFormatW
GetTimeFormatW
CopyFileW
SetFilePointer
lstrcpyW
CreateProcessW
SetThreadPriority
GetCurrentThread
SetPriorityClass
ResumeThread
QueryFullProcessImageNameW
FindResourceW
LoadResource
LockResource
HeapFree
GetProcessHeap
HeapAlloc
CreateFileW
WriteFile
GlobalReAlloc
GetFileSize
ReadFile
GlobalLock
GlobalAlloc
GlobalUnlock
CreateFileA
GlobalFree
GetCurrentProcessId
SetLastError
GetProcAddress
FreeLibrary
LoadLibraryW
FlushFileBuffers

user32

OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetMenuItemInfoW
CreatePopupMenu
InsertMenuItemW
GetMenuStringW
GetMenuItemCount
GetSubMenu
GetMenuItemID
DeleteMenu
SetRect
GetClassInfoW
RegisterClassW
LoadCursorW
ExitWindowsEx
GetThreadDesktop
SetMenuItemInfoW
LoadImageW
DestroyIcon
CreateDialogParamW
DialogBoxParamW
OpenDesktopW
EnumDesktopWindows
EndDialog
SetDlgItemInt
GetIconInfo
LoadBitmapW
GetKeyState
SetMenuInfo
GetMenuInfo
wsprintfW
FindWindowW
GetClassNameW
IsWindow
PostMessageW
SendMessageW
PostThreadMessageW
PostQuitMessage
PeekMessageW
SetThreadDesktop
MessageBeep
SendDlgItemMessageW
SetDlgItemTextW
GetWindowLongW
SetWindowLongW
GetWindowRect
GetSystemMetrics
SetWindowPos
SystemParametersInfoW
SetForegroundWindow
GetDlgItem
EnableWindow
GetWindowThreadProcessId
DefWindowProcW
IsDialogMessageW
UpdateWindow
CreateWindowExW
ShowWindow
DestroyWindow
OpenInputDesktop
GetUserObjectInformationW
CloseDesktop
LoadStringW
GetWindowTextW
SetWindowTextW
GetSysColor
GetDC
ReleaseDC
wvsprintfW
GetMessageW
TranslateMessage
DispatchMessageW
GetGuiResources
SetTimer
MessageBoxW
KillTimer
EnumChildWindows

gdi32

CreateFontIndirectW
GetTextExtentPoint32W
StretchBlt
CreatePen
SetPixel
MoveToEx
LineTo
CreateDCW
ExtTextOutW
CreateBitmap
SetBkColor
SetTextColor
CreateDIBitmap
GetSystemPaletteEntries
CreatePalette
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
DeleteDC
GetDeviceCaps
GetObjectW
GetStockObject
SelectPalette
RealizePalette
GetDIBits
DeleteObject
CreateDIBSection

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

SetSecurityDescriptorDacl
GetUserNameW
AllocateAndInitializeSid
FreeSid
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
InitializeSecurityDescriptor
GetTokenInformation
CloseServiceHandle
OpenServiceW
OpenSCManagerW
DeleteService
SetServiceStatus
DeregisterEventSource
RegCloseKey
RegSetValueExW
RegCreateKeyW
ReportEventW
RegisterEventSourceW
RegisterServiceCtrlHandlerW
CreateServiceW
StartServiceCtrlDispatcherW
QueryServiceStatus
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
ControlService
RegDeleteValueW
DuplicateTokenEx
StartServiceW
CreateProcessAsUserW
SetTokenInformation
RegEnumValueW
RegQueryValueExW
RegQueryInfoKeyW

shell32

SHGetFolderPathW
SHParseDisplayName
SHBindToParent
ExtractIconExW

ole32

CoTaskMemFree

winmm

timeGetTime
PlaySoundW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

shlwapi

PathFileExistsW

Sections

.text
Size: 341KB - Virtual size: 340KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 240KB - Virtual size: 239KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0912f29a25eca1c196ca6643f0fc2ce5

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

1f:6c:98:ca:ad:2a:e7:c1:8a:bb:ca:adCertificate

Extended Key Usages

Key Usages

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6aCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

1f:6c:98:ca:ad:2a:e7:c1:8a:bb:ca:adCertificate

Extended Key Usages

Key Usages

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6aCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

ad:ac:70:2e:c3:bc:a0:33:e6:d2:c3:b7:78:dd:2a:20:21:03:ae:73:4c:10:98:70:19:c0:bf:f6:9b:df:3c:50Signer

91:55:0d:19:83:c0:62:fb:9f:35:1f:8a:f2:7d:47:17:f9:2c:51:3cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

winmm

version

shlwapi

Sections

.text Size: 341KB - Virtual size: 340KB

.rdata Size: 60KB - Virtual size: 60KB

.data Size: 8KB - Virtual size: 23KB

.rsrc Size: 240KB - Virtual size: 239KB

.reloc Size: 16KB - Virtual size: 16KB

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

1f:6c:98:ca:ad:2a:e7:c1:8a:bb:ca:ad
Certificate

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

1f:6c:98:ca:ad:2a:e7:c1:8a:bb:ca:ad
Certificate

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

ad:ac:70:2e:c3:bc:a0:33:e6:d2:c3:b7:78:dd:2a:20:21:03:ae:73:4c:10:98:70:19:c0:bf:f6:9b:df:3c:50
Signer

91:55:0d:19:83:c0:62:fb:9f:35:1f:8a:f2:7d:47:17:f9:2c:51:3c
Signer

.text
Size: 341KB - Virtual size: 340KB

.rdata
Size: 60KB - Virtual size: 60KB

.data
Size: 8KB - Virtual size: 23KB

.rsrc
Size: 240KB - Virtual size: 239KB

.reloc
Size: 16KB - Virtual size: 16KB