2024-04-26_87354499fd64eed979ac5e5e9719a311_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-26_87354499fd64eed979ac5e5e9719a311_mafia
Size

3.1MB
MD5

87354499fd64eed979ac5e5e9719a311
SHA1

ace5c475c2ca84ea24db1d4d1cdff3eda6af7305
SHA256

23dddb7e23526613f285c0bc534faf95ab55bd3db23c9db5209e7daa9561b438
SHA512

4b8bad1206ba522bc82deaf62152d8c7e86657828df8b729a53cecb66de5cae05dd8b0287d8d64669db9304036f62804df0892f23d9e1b5339dd38007aea9760
SSDEEP

98304:HtAwBaV/wccfEGpD1XTg7EM2+gJVcwo4uDcDw1CtPmbQswS2DE0aX:HtAwBaV/wccfEsz+GDDObQswS2DDS

Score

1^/10

Malware Config

Signatures

Files

2024-04-26_87354499fd64eed979ac5e5e9719a311_mafia
.exe windows:5 windows x86 arch:x86

ac9065c65718738599a5e5fd09e089e5

Code Sign

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

95:7c:45:b5:ff:fd:97:f4
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

01/07/2015, 02:00

Not After

01/07/2016, 02:00

Subject

CN=Cellica Software Pvt Ltd,O=Cellica Software Pvt Ltd,L=Jalgaon,ST=Maharashtra,C=IN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

42:27:d8:e0:20:4a:8b:ea:76:ad:65:0e:09:2b:92:b6:5f:d2:43:50
Signer

Actual PE Digest

42:27:d8:e0:20:4a:8b:ea:76:ad:65:0e:09:2b:92:b6:5f:d2:43:50

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\Yogesh Current_Work\Desktop Side\Cellica Database Anywhere\Single User\Current work\Desktop\SyncService\AW_MNF\CellicaDBAnywhereSyncService.pdb

Imports

ws2_32

send
recv
socket
inet_ntoa
gethostname
connect
WSAStartup
htons
closesocket
gethostbyname
WSACleanup
WSAGetLastError

odbc32

ord171
ord68
ord31
ord26
ord108
ord30
ord12
ord119
ord176
ord24
ord127
ord18
ord43
ord13
ord4
ord111
ord136
ord152
ord16
ord165
ord140
ord61
ord139
ord75
ord9
ord107
ord154
ord157
ord49
ord48
ord78
ord145
ord72

wininet

InternetCrackUrlW
InternetSetOptionExW
HttpOpenRequestW
InternetConnectW
HttpSendRequestW
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetOpenW
InternetGetLastResponseInfoW
InternetCloseHandle
HttpQueryInfoW
InternetQueryDataAvailable

kernel32

FindNextFileW
FileTimeToLocalFileTime
CreateSemaphoreW
ReleaseSemaphore
GetFullPathNameW
ReleaseActCtx
LoadLibraryExW
lstrcmpW
GetSystemDefaultUILanguage
ConvertDefaultLocale
GetUserDefaultUILanguage
GlobalDeleteAtom
lstrcmpA
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
LocalReAlloc
GlobalGetAtomNameW
GetFileAttributesExW
GetFileSizeEx
GetFileTime
GlobalFlags
SetThreadPriority
ResumeThread
GetCurrentDirectoryW
GetSystemDirectoryW
lstrcpyW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
GlobalAddAtomW
GlobalFindAtomW
FreeResource
GetTempFileNameW
GetTempPathW
GetWindowsDirectoryW
GetNumberFormatW
GetProfileIntW
SearchPathW
VirtualProtect
FindResourceExW
GetVolumeInformationW
FindClose
DuplicateHandle
UnlockFile
LockFile
ActivateActCtx
DeactivateActCtx
GlobalFree
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
SetEnvironmentVariableA
CompareStringW
WriteConsoleW
SetEndOfFile
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
ReadFile
GetConsoleCP
LCMapStringW
GetTimeZoneInformation
SetFilePointer
GetStartupInfoW
SetHandleCount
SetStdHandle
GetStringTypeW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetLocaleInfoW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
HeapCreate
GetModuleFileNameW
lstrlenA
IsProcessorFeaturePresent
GetCurrentThread
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
InterlockedExchange
ExitProcess
HeapSetInformation
GetCommandLineW
LeaveCriticalSection
EnterCriticalSection
CreateThread
ExitThread
GetSystemTimeAsFileTime
GetFileAttributesW
HeapSize
HeapReAlloc
IsDebuggerPresent
UnhandledExceptionFilter
SetConsoleCtrlHandler
RaiseException
DecodePointer
EncodePointer
RtlUnwind
GetVersionExA
GlobalMemoryStatus
QueryPerformanceCounter
GetTickCount
FlushConsoleInputBuffer
GetStdHandle
GetFileType
GetVersion
GetModuleHandleA
GetSystemDirectoryA
CreateFileA
GetFileSize
MoveFileExA
GetModuleFileNameA
LocalAlloc
LocalLock
LocalUnlock
LoadLibraryA
Module32FirstW
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
Process32NextW
CopyFileW
GetModuleHandleW
GetSystemInfo
lstrcmpiW
SetErrorMode
Sleep
WaitForSingleObject
HeapAlloc
UnmapViewOfFile
GetProcessHeap
HeapFree
GetVersionExW
GetLastError
CreateFileMappingW
MapViewOfFile
SetLastError
FormatMessageW
LocalFree
WideCharToMultiByte
CreateDirectoryW
GetLocalTime
MultiByteToWideChar
lstrlenW
TerminateProcess
LoadLibraryW
CreateFileW
GetCurrentThreadId
GetProcAddress
GetCurrentProcess
GetCurrentProcessId
FreeLibrary
SetUnhandledExceptionFilter
MoveFileW
FindFirstFileW
DeleteFileW
SetEvent
WaitForMultipleObjects
CloseHandle
CreateEventW
LoadResource
LockResource
SizeofResource
FindResourceW
FileTimeToSystemTime
WriteFile
HeapQueryInformation
VirtualAlloc
VirtualQuery
GetDriveTypeW

user32

EndDialog
GetUpdateRect
FrameRect
IsClipboardFormatAvailable
SetMenuDefaultItem
WaitMessage
PostThreadMessageW
CreateMenu
IsMenu
UpdateLayeredWindow
UnionRect
MonitorFromPoint
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
UnpackDDElParam
ReuseDDElParam
InsertMenuItemW
TranslateAcceleratorW
GetNextDlgGroupItem
LoadImageW
GetIconInfo
GetNextDlgTabItem
EnableScrollBar
HideCaret
InvertRect
GetMenuDefaultItem
CopyImage
LockWindowUpdate
BringWindowToTop
SetCursorPos
SetRect
CreateAcceleratorTableW
LoadAcceleratorsW
GetKeyboardState
GetKeyboardLayout
MapVirtualKeyW
ToUnicodeEx
CopyAcceleratorTableW
DrawFocusRect
DrawFrameControl
DrawEdge
DrawIconEx
DrawStateW
MessageBeep
ReleaseCapture
SetCapture
GetSystemMenu
LoadMenuW
SetClassLongW
GetAsyncKeyState
NotifyWinEvent
WindowFromPoint
CreatePopupMenu
DestroyAcceleratorTable
SetParent
SetWindowRgn
IsZoomed
IsIconic
OffsetRect
IsRectEmpty
DestroyMenu
GetMenuItemInfoW
IntersectRect
InflateRect
RegisterWindowMessageW
LoadIconW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MonitorFromWindow
CreateDialogIndirectParamW
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetForegroundWindow
ShowScrollBar
RedrawWindow
CreateWindowExW
GetClassInfoExW
RegisterClassW
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
CallWindowProcW
GetMenu
DestroyIcon
KillTimer
SetTimer
InvalidateRect
UpdateWindow
GetClassInfoW
DefWindowProcW
MapWindowPoints
GetClientRect
SetLayeredWindowAttributes
EnumDisplayMonitors
SystemParametersInfoW
GetMonitorInfoW
SetRectEmpty
CopyRect
DeleteMenu
ShowOwnedPopups
SetCursor
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageW
GetCursorPos
ValidateRect
EndPaint
BeginPaint
GetWindowDC
ScreenToClient
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
FillRect
SetWindowPos
ShowWindow
MoveWindow
SetWindowLongW
IsWindow
IsDialogMessageW
SendDlgItemMessageW
GetDlgItem
OpenClipboard
SetClipboardData
CloseClipboard
EmptyClipboard
RegisterClipboardFormatW
CopyIcon
CharUpperBuffW
GetDoubleClickTime
IsCharLowerW
GetKeyNameTextW
MapVirtualKeyExW
SubtractRect
MapDialogRect
DrawIcon
DestroyCursor
CheckDlgButton
GetScrollPos
SetScrollPos
SetFocus
GetFocus
RealChildWindowFromPoint
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
GetWindowRgn
ScrollWindow
GetClassNameW
PtInRect
SetWindowTextW
GetWindowThreadProcessId
SendMessageW
GetParent
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxW
LoadCursorW
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
PostMessageW
PostQuitMessage
UnhookWindowsHookEx
GetWindowTextLengthW
GetWindowTextW
CharUpperW
GetSystemMetrics
GetMenuState
GetMenuStringW
AppendMenuW
GetMenuItemID
InsertMenuW
GetMenuItemCount
GetSubMenu
RemoveMenu
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
wsprintfW

gdi32

GetBkColor
GetTextColor
CreateEllipticRgn
Polyline
Ellipse
Polygon
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
OffsetRgn
GetRgnBox
SetDIBColorTable
StretchBlt
SetRectRgn
SetPixel
Rectangle
EnumFontFamiliesExW
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
CreatePolygonRgn
FillRgn
FrameRgn
ExtFloodFill
SetPaletteEntries
GetTextFaceW
SetPixelV
GetTextCharsetInfo
EnumFontFamiliesW
GetTextMetricsW
PtInRegion
CreateRoundRectRgn
CreateRectRgnIndirect
CreateFontIndirectW
CreateDIBitmap
CreateHatchBrush
CreateSolidBrush
SelectClipRgn
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetTextColor
SetROP2
SetPolyFillMode
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateDCW
CopyMetaFileW
CreateCompatibleDC
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteDC
CreateDIBSection
GetTextExtentPoint32W
DPtoLP
PatBlt
GetBoundsRect
DeleteObject
CreatePen
GetObjectType
SelectPalette
GetStockObject
CreateBitmap
CreatePatternBrush
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetPixel
GetWindowExtEx
GetViewportExtEx
GetObjectW
CreateRectRgn
CombineRgn

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegCreateKeyW
SetKernelObjectSecurity
GetKernelObjectSecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegEnumValueW
RegEnumKeyW
RegQueryValueW
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyW
FreeSid
RegCreateKeyExW
RegSetValueExW
RegFlushKey
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
IsValidSecurityDescriptor
GetSecurityDescriptorOwner
SetSecurityDescriptorOwner
GetSecurityDescriptorGroup
SetSecurityDescriptorGroup
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
GetSecurityDescriptorDacl

shell32

SHAppBarMessage
SHGetFileInfoW
ShellExecuteW
SHGetDesktopFolder
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetSpecialFolderPathW
DragQueryFileW
DragFinish
SHGetSpecialFolderLocation

comctl32

ImageList_GetIconSize

shlwapi

PathIsUNCW
PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathRemoveFileSpecW

ole32

CoInitializeEx
CoCreateGuid
CLSIDFromProgID
OleRun
CoInitialize
CoUninitialize
CoTaskMemFree
ReleaseStgMedium
CoTaskMemAlloc
OleDuplicateData
CoCreateInstance
CLSIDFromString
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleLockRunning
CreateStreamOnHGlobal
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
DoDragDrop

oleaut32

VariantInit
VariantClear
VarR8FromCy
VariantChangeType
VariantCopy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysAllocStringLen
VarBstrFromDate
SysAllocString
SysFreeString
VarR8FromDec

gdiplus

GdipFree
GdipDrawImageI
GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

imm32

ImmGetOpenStatus
ImmReleaseContext
ImmGetContext

winmm

PlaySoundW

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 596KB - Virtual size: 596KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 213KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac9065c65718738599a5e5fd09e089e5

Code Sign

07Certificate

Key Usages

95:7c:45:b5:ff:fd:97:f4Certificate

Extended Key Usages

Key Usages

42:27:d8:e0:20:4a:8b:ea:76:ad:65:0e:09:2b:92:b6:5f:d2:43:50Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

odbc32

wininet

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

gdiplus

oleacc

imm32

winmm

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.rdata Size: 596KB - Virtual size: 596KB

.data Size: 36KB - Virtual size: 74KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 213KB - Virtual size: 213KB

07
Certificate

95:7c:45:b5:ff:fd:97:f4
Certificate

42:27:d8:e0:20:4a:8b:ea:76:ad:65:0e:09:2b:92:b6:5f:d2:43:50
Signer

.text
Size: 2.3MB - Virtual size: 2.3MB

.rdata
Size: 596KB - Virtual size: 596KB

.data
Size: 36KB - Virtual size: 74KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 213KB - Virtual size: 213KB