2024-05-11_8e6c08a5538c6bd5b55c8e3ef37ef7cb_floxif_karagany_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-11_8e6c08a5538c6bd5b55c8e3ef37ef7cb_floxif_karagany_mafia
Size

3.2MB
MD5

8e6c08a5538c6bd5b55c8e3ef37ef7cb
SHA1

c3071277c0638d008751132e37b15f8d30994445
SHA256

1d4ea89829a5a96565c83499c8fa6865c3c5b0d75fb6f550e4637f3b83a590a8
SHA512

7ab154d8d3314fb7ec9722aa5760edf2e87db8c5949410fa6443374411a4c2a738130e9d9ae411b54ece636bb7042ef91bca0e93507f7204f15513a899377592
SSDEEP

98304:XtoZdMXRgZoCOvhT6Twm2ZcNNwk9B0AjYGA57osVNU3yRKngnNc:XtoZdMXRgZxOgh9JTHmNU3yZu

Score

1^/10

Malware Config

Signatures

Files

2024-05-11_8e6c08a5538c6bd5b55c8e3ef37ef7cb_floxif_karagany_mafia
.exe windows:5 windows x86 arch:x86

f8e653dc85634658360cb3406d8b3fc9

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:7f:10:84:96:d6:1a:91:e3:d8:dd:cf:7f:ca:cb:d2
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

06/12/2017, 00:00

Not After

14/10/2020, 12:00

Subject

SERIALNUMBER=2208137906,CN=SK Communications,O=SK Communications,L=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

99:0f:66:71:8f:17:0f:4c:e4:8a:d5:3e:c0:e1:b6:98:a2:36:07:03
Signer

Actual PE Digest

99:0f:66:71:8f:17:0f:4c:e4:8a:d5:3e:c0:e1:b6:98:a2:36:07:03

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CertCreateCertificateContext
CertAddCertificateContextToStore
CryptDecodeObject
CertFreeCertificateChain
CertGetCertificateChain
CryptQueryObject
CertCloseStore
CryptMsgClose
CertFreeCTLContext
CryptMsgGetParam
CertOpenStore
CertGetSubjectCertificateFromStore
CertGetNameStringW
CertFreeCertificateContext
CryptMsgControl

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

iphlpapi

GetAdaptersInfo

kernel32

LoadLibraryA
SizeofResource
LockResource
LoadResource
FindResourceW
CompareStringW
CloseHandle
CreateProcessW
FreeLibrary
WaitForSingleObject
CreateRemoteThread
GetProcAddress
LoadLibraryW
OpenProcess
Sleep
MultiByteToWideChar
ExpandEnvironmentStringsW
GetShortPathNameW
WideCharToMultiByte
lstrcpyW
WinExec
lstrlenW
lstrcatW
GetWindowsDirectoryW
MoveFileExW
GetVersionExW
CreateSemaphoreW
OpenSemaphoreW
GetLastError
CreateMutexW
GetCommandLineW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ResumeThread
GetCurrentProcess
InterlockedExchangeAdd
GetTickCount
CreateThread
GetModuleFileNameW
TerminateThread
WaitForMultipleObjects
SetEnvironmentVariableA
GetProcessHeap
CreateFileA
WriteConsoleW
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
LCMapStringW
IsProcessorFeaturePresent
GetStringTypeW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
UnhandledExceptionFilter
QueryPerformanceCounter
HeapCreate
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
SetUnhandledExceptionFilter
VirtualQuery
GetSystemInfo
HeapQueryInformation
GetFileType
SetStdHandle
ExitProcess
HeapSize
GetTimeZoneInformation
GetDriveTypeW
HeapAlloc
HeapFree
HeapReAlloc
ExitThread
GetDateFormatW
GetTimeFormatW
GetSystemTimeAsFileTime
RaiseException
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetUserDefaultLCID
SearchPathW
GetProfileIntW
GetNumberFormatW
GetTempPathW
GetTempFileNameW
FindResourceExW
GetCurrentDirectoryW
SetErrorMode
GetSystemDirectoryW
CopyFileW
LocalFree
FormatMessageW
GlobalFlags
GlobalGetAtomNameW
InterlockedIncrement
GetFileTime
GetFileSizeEx
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileAttributesExW
FindNextFileW
lstrlenA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
VirtualProtect
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
SetThreadPriority
lstrcmpA
GetCurrentThread
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
LoadLibraryExW
InterlockedExchange
GetVolumeInformationW
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
MoveFileW
lstrcmpiW
GetThreadLocale
FreeResource
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
InitializeCriticalSectionAndSpinCount
GlobalFree
MulDiv
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
SetFilePointer
CompareStringA
ReadFile
GetLocaleInfoW
DeleteFileW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
FileTimeToSystemTime
WriteFile
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetExitCodeProcess
CreateFileW
GetFileSize
lstrcmpW
ReleaseSemaphore
CreateDirectoryW
GetFileAttributesW
SetFileAttributesW
RemoveDirectoryW
QueryDosDeviceW
VirtualAlloc
VirtualFree
DuplicateHandle
InterlockedDecrement
GetModuleHandleW
GetFullPathNameW
GetCurrentProcessId
TerminateProcess
SetLastError
LocalAlloc

user32

InsertMenuItemW
TranslateAcceleratorW
SetMenuDefaultItem
IsMenu
MonitorFromPoint
UpdateLayeredWindow
UnionRect
LoadImageW
EnableScrollBar
InvertRect
GetMenuDefaultItem
LockWindowUpdate
BringWindowToTop
SetCursorPos
CreateAcceleratorTableW
LoadAcceleratorsW
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
DrawFocusRect
DrawFrameControl
DrawEdge
DrawIconEx
GetSystemMenu
SetClassLongW
NotifyWinEvent
CreatePopupMenu
DestroyAcceleratorTable
SetParent
SetWindowRgn
IsZoomed
GetNextDlgGroupItem
InvalidateRgn
SetRect
IsRectEmpty
CopyAcceleratorTableW
CharNextW
DestroyIcon
WaitMessage
ReleaseCapture
SetCapture
DeleteMenu
SetLayeredWindowAttributes
EnumDisplayMonitors
SetRectEmpty
CopyImage
RealChildWindowFromPoint
SystemParametersInfoW
DestroyMenu
GetMenuItemInfoW
GetSysColorBrush
UnregisterClassW
GetAsyncKeyState
SetWindowContextHelpId
MapDialogRect
ShowOwnedPopups
GetMessageW
PostQuitMessage
CharUpperW
WindowFromPoint
LoadMenuW
DrawStateW
IntersectRect
GetWindowDC
GrayStringW
DrawTextExW
TabbedTextOutW
FillRect
GetActiveWindow
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
IsWindowEnabled
ShowWindow
SetWindowTextW
IsDialogMessageW
ReuseDDElParam
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
EnableMenuItem
CheckMenuItem
MapVirtualKeyW
GetKeyNameTextW
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
PostMessageW
EnableWindow
SendMessageW
LoadBitmapW
GetWindowRect
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetLastActivePopup
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
GetMessageTime
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
RedrawWindow
IsWindowVisible
ValidateRect
UpdateWindow
MessageBoxW
GetClassInfoExW
GetClassInfoW
RegisterClassW
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
CallWindowProcW
GetMenu
SetWindowPos
CopyRect
GetMenuState
GetMenuStringW
AppendMenuW
GetMenuItemID
UnpackDDElParam
RegisterClipboardFormatW
DefFrameProcW
DefMDIChildProcW
DrawMenuBar
TranslateMDISysAccel
CreateMenu
PostThreadMessageW
FrameRect
GetUpdateRect
OpenClipboard
SetClipboardData
CloseClipboard
EmptyClipboard
CopyIcon
CharUpperBuffW
GetDoubleClickTime
InsertMenuW
GetMenuItemCount
GetSubMenu
RemoveMenu
GetIconInfo
GetDesktopWindow
wsprintfW
OffsetRect
SetDlgItemTextW
GetCursorPos
IsCharLowerW
MapVirtualKeyExW
SubtractRect
DestroyCursor
GetWindowRgn
GetClientRect
InvalidateRect
GetSysColor
DrawTextW
CheckDlgButton
DispatchMessageW
TranslateMessage
PeekMessageW
PtInRect
InflateRect
ScreenToClient
GetDC
ReleaseDC
SetTimer
KillTimer
GetParent
GetMessagePos
SetCursor
IsWindow
LoadCursorW
SetWindowLongW
MessageBeep
SetForegroundWindow
DrawIcon
IsIconic
LoadIconW
GetSystemMetrics
SendNotifyMessageW
FindWindowW
DefWindowProcW
GetWindowLongW
CreateWindowExW
RegisterClassExW
GetForegroundWindow
DestroyWindow
ExitWindowsEx
GetDlgCtrlID
GetWindow
MoveWindow
AdjustWindowRectEx
ClientToScreen
EndPaint
BeginPaint
UnhookWindowsHookEx
GetWindowTextW
GetWindowThreadProcessId
HideCaret
IsClipboardFormatAvailable

gdi32

SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
CreatePatternBrush
SelectPalette
GetObjectType
CreatePen
CreateSolidBrush
CreateHatchBrush
SetRectRgn
CombineRgn
GetTextMetricsW
EnumFontFamiliesW
GetTextCharsetInfo
GetBkColor
Escape
GetRgnBox
EnumFontFamiliesExW
CreateRoundRectRgn
CreatePolygonRgn
CreateEllipticRgn
Polyline
Ellipse
Polygon
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
OffsetRgn
SetDIBColorTable
Rectangle
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
GetTextFaceW
SetPixelV
ExtTextOutW
TextOutW
PtVisible
GetWindowExtEx
GetViewportExtEx
CreateRectRgn
SelectClipRgn
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
SetTextColor
SetROP2
SetPolyFillMode
RestoreDC
SaveDC
CreateDCW
CopyMetaFileW
RectVisible
StretchBlt
GetClipBox
CreateRectRgnIndirect
ExtSelectClipRgn
SetStretchBltMode
SetDIBitsToDevice
RealizePalette
CreateDIBSection
CreateDIBitmap
CreateCompatibleBitmap
GetObjectW
CreateCompatibleDC
BitBlt
CreateFontIndirectW
GetStockObject
GetTextExtentPoint32W
GetTextExtentPointA
GetTextMetricsA
SelectObject
DeleteObject
CreateFontW
SetPixel
SetBkMode
DeleteDC
SetBkColor
CreateBitmap
SetMapMode
GetMapMode
GetDeviceCaps
GetPixel
PatBlt
DPtoLP
GetTextColor

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

GetServiceKeyNameW
EnumDependentServicesW
FreeSid
RegCloseKey
RegQueryValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegQueryValueExW
CloseServiceHandle
QueryServiceStatus
ControlService
StartServiceW
QueryServiceConfigW
OpenSCManagerW
CheckTokenMembership
AllocateAndInitializeSid
RegEnumKeyExW
CryptGetProvParam
CryptExportKey
CryptGetHashParam
CryptSetKeyParam
CryptAcquireContextA
CryptDestroyHash
CryptCreateHash
CryptHashData
RegDeleteKeyW
CryptReleaseContext
CryptImportKey
CryptEncrypt
CryptGetKeyParam
CryptGenKey
CryptGenRandom
CryptDestroyKey
RegDeleteValueW
RegEnumValueW
RegEnumKeyW
OpenServiceW

shell32

DragFinish
CommandLineToArgvW
SHGetSpecialFolderPathW
ShellExecuteExW
SHGetFolderPathW
SHGetFileInfoW
SHBrowseForFolderW
SHAppBarMessage
DragQueryFileW
ShellExecuteW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetDesktopFolder

comctl32

InitCommonControlsEx
ImageList_GetIconSize

shlwapi

PathStripToRootW
PathIsUNCW
PathFindExtensionW
PathFindFileNameW
UrlIsW
PathRemoveFileSpecW

ole32

CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoCreateGuid
OleDuplicateData
OleGetClipboard
ReleaseStgMedium
CoInitializeEx
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleLockRunning
CreateStreamOnHGlobal
OleIsCurrentClipboard
OleFlushClipboard
DoDragDrop
CoRevokeClassObject
CoRegisterMessageFilter
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
CoTaskMemAlloc

oleaut32

VariantClear
VariantChangeType
VariantCopy
VariantInit
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
VarBstrFromDate
OleCreateFontIndirect
SysAllocString
SysAllocStringLen
SysFreeString

oledlg

OleUIBusyW

urlmon

ObtainUserAgentString

wininet

InternetCrackUrlW
InternetReadFile
InternetOpenW
HttpQueryInfoW
InternetConnectW
InternetQueryOptionW
InternetSetOptionW
InternetCloseHandle
HttpOpenRequestW
HttpSendRequestW

ws2_32

WSACancelAsyncRequest
closesocket
socket
WSAAsyncGetHostByName
inet_addr
WSASetLastError
WSAAsyncSelect
listen
shutdown
getpeername
connect
send
recv
bind
ntohs
setsockopt
WSAGetLastError
ioctlsocket
htons
htonl
gethostbyname
inet_ntoa
WSAStartup
WSACleanup
accept

setupapi

SetupIterateCabinetW

cryptui

CryptUIDlgViewCertificateW

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

imm32

ImmGetContext
ImmGetOpenStatus
ImmReleaseContext

winmm

PlaySoundW

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 581KB - Virtual size: 581KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 490KB - Virtual size: 490KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 203KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f8e653dc85634658360cb3406d8b3fc9

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77Certificate

Key Usages

05:7f:10:84:96:d6:1a:91:e3:d8:dd:cf:7f:ca:cb:d2Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

99:0f:66:71:8f:17:0f:4c:e4:8a:d5:3e:c0:e1:b6:98:a2:36:07:03Signer

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

version

iphlpapi

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

urlmon

wininet

ws2_32

setupapi

cryptui

oleacc

imm32

winmm

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 581KB - Virtual size: 581KB

.data Size: 31KB - Virtual size: 79KB

.rsrc Size: 490KB - Virtual size: 490KB

.reloc Size: 203KB - Virtual size: 203KB

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

05:7f:10:84:96:d6:1a:91:e3:d8:dd:cf:7f:ca:cb:d2
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

99:0f:66:71:8f:17:0f:4c:e4:8a:d5:3e:c0:e1:b6:98:a2:36:07:03
Signer

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 581KB - Virtual size: 581KB

.data
Size: 31KB - Virtual size: 79KB

.rsrc
Size: 490KB - Virtual size: 490KB

.reloc
Size: 203KB - Virtual size: 203KB