2024-05-15_95d52a8e0f75d924689af2a141520883_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-15_95d52a8e0f75d924689af2a141520883_mafia
Size

2.6MB
MD5

95d52a8e0f75d924689af2a141520883
SHA1

8cb7704fb2bbb07050237b853d7c927352ec5739
SHA256

89e978a98c947cbe1980986ac2f66c4440233a8357e183ad5839c1ce03101756
SHA512

4bdfbc8fa231d69002201ba862a2e17e4470e51f2ad2a9ccad34810b3405b1bfb92412073188e97370d4a85f606815c0bf0c58b5eb1b0d1023a64e83dc3d2971
SSDEEP

49152:PMuaYhTN7WC+VcaWhsE3ADxLoIQ8uSgVuRTdcS2tXi/ox:7BKC4caWhuxsIQ8uj/x

Score

1^/10

Malware Config

Signatures

Files

2024-05-15_95d52a8e0f75d924689af2a141520883_mafia
.exe windows:5 windows x86 arch:x86

3c27ef73c735cd23445bbe93b128a30b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:7a:53
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

03-03-2009 12:53

Not After

03-03-2024 12:53

Subject

CN=Certum Level III CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:3a:95:9d:e2:b7:08:83:25:e1:39:df:f0:1b:d3:e4
Certificate

Issuer

CN=Certum Level III CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

18-11-2013 15:15

Not After

18-11-2014 15:15

Subject

CN=Open Source Developer\, dongcan ZHUANG,OU=xingfeng,O=xingfeng,C=CN,1.2.840.113549.1.9.1=#0c127a646f6e6763616e40676d61696c2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d2:a0:b0:10:ec:47:c4:78:fe:eb:87:2c:0c:fc:b3:f0:73:01:08:b0
Signer

Actual PE Digest

d2:a0:b0:10:ec:47:c4:78:fe:eb:87:2c:0c:fc:b3:f0:73:01:08:b0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\dev\BTC_PassCrack\out\BTC_PassCrack.pdb

Imports

kernel32

InterlockedDecrement
InterlockedExchangeAdd
InitializeCriticalSectionAndSpinCount
TerminateThread
QueueUserAPC
SleepEx
TlsAlloc
PostQueuedCompletionStatus
CreateIoCompletionPort
SetWaitableTimer
GetQueuedCompletionStatus
InterlockedCompareExchange
SetLastError
WaitForMultipleObjects
TlsGetValue
TlsSetValue
TlsFree
LocalFree
FormatMessageA
LocalLock
LocalUnlock
GetModuleFileNameA
ExpandEnvironmentStringsA
SearchPathA
WriteFile
GetFileAttributesA
MultiByteToWideChar
InterlockedExchange
GetDateFormatA
GetTimeFormatA
GetFullPathNameA
GetDriveTypeW
SetConsoleMode
ReadConsoleInputA
GetSystemInfo
GetFileSize
ReadFile
CreateFileA
CloseHandle
GetTickCount
GlobalLock
SizeofResource
LoadResource
FindResourceA
Sleep
GetCurrentThread
LockFile
LockFileEx
UnlockFile
CreateDirectoryW
MoveFileExW
GetDiskFreeSpaceW
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
GetVolumeInformationW
DeviceIoControl
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
SetThreadPriority
HeapFree
GetProcessHeap
HeapAlloc
SetEvent
WaitForSingleObject
CreateEventA
InterlockedIncrement
LoadLibraryA
GetCurrentDirectoryW
GetProcAddress
GetLastError
MulDiv
GetFileInformationByHandle
UnmapViewOfFile
MoveFileW
GetFileAttributesW
DeleteFileW
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleA
FindFirstFileW
FindNextFileW
FindClose
GetEnvironmentVariableW
GetTempPathW
GetVersionExW
PulseEvent
CreateEventW
GetVersionExA
GlobalMemoryStatus
FlushConsoleInputBuffer
GetVersion
ResumeThread
ResetEvent
OpenEventA
SetEnvironmentVariableA
CompareStringW
SetEndOfFile
CreateFileW
SetStdHandle
WriteConsoleW
LoadLibraryW
FreeLibrary
HeapReAlloc
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
WideCharToMultiByte
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
ExitThread
CreateThread
SetConsoleCtrlHandler
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
LCMapStringW
GetCPInfo
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapSize
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameW
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetConsoleCP
GetConsoleMode
SetFilePointer
FlushFileBuffers
HeapCreate
GetTimeZoneInformation
FreeEnvironmentStringsW

user32

SetTimer
PostQuitMessage
GetDC
GetWindowTextLengthA
GetWindowTextA
SendMessageA
DrawTextA
ReleaseDC
InvalidateRect
TrackMouseEvent
FrameRect
FillRect
GetMessageA
TranslateMessage
DispatchMessageA
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
IsWindowUnicode
SetWindowLongW
SystemParametersInfoA
CreateWindowExA
IsWindow
RegisterClassA
SetWindowPos
EnableWindow
GetWindowLongA
SetWindowLongA
DefWindowProcA
GetWindowRect
SetWindowTextA
ScreenToClient
GetParent
MessageBoxA
PostMessageA
LoadCursorA

gdi32

GetDeviceCaps
GetObjectA
GetStockObject
DeleteObject
SetBkMode
SetTextColor
SetBkColor
SelectObject
CreateSolidBrush
CreateFontIndirectA

comdlg32

GetOpenFileNameA

shell32

ShellExecuteA

ole32

CoInitializeEx
CoCreateGuid

comctl32

ord17

crypt32

CryptMsgGetParam
CertCloseStore
CryptQueryObject
CryptMsgClose

shlwapi

wvnsprintfA
PathCanonicalizeA

ws2_32

WSASetLastError
WSAStartup
WSACleanup
closesocket
ioctlsocket
listen
WSARecv
WSASend
WSASocketA
setsockopt
select
WSAAddressToStringA
htons
ntohs
getaddrinfo
freeaddrinfo
ntohl
htonl
inet_addr
__WSAFDIsSet
accept
bind
connect
getsockopt
getpeername
getsockname
WSAGetLastError

mswsock

AcceptEx
GetAcceptExSockaddrs

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegisterEventSourceA
DeregisterEventSource
ReportEventA

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 375KB - Virtual size: 374KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3c27ef73c735cd23445bbe93b128a30b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

04:7a:53Certificate

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

02:3a:95:9d:e2:b7:08:83:25:e1:39:df:f0:1b:d3:e4Certificate

Extended Key Usages

Key Usages

d2:a0:b0:10:ec:47:c4:78:fe:eb:87:2c:0c:fc:b3:f0:73:01:08:b0Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

shell32

ole32

comctl32

crypt32

shlwapi

ws2_32

mswsock

advapi32

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 375KB - Virtual size: 374KB

.data Size: 59KB - Virtual size: 76KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 100KB - Virtual size: 99KB

.reloc Size: 132KB - Virtual size: 131KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

04:7a:53
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

02:3a:95:9d:e2:b7:08:83:25:e1:39:df:f0:1b:d3:e4
Certificate

d2:a0:b0:10:ec:47:c4:78:fe:eb:87:2c:0c:fc:b3:f0:73:01:08:b0
Signer

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 375KB - Virtual size: 374KB

.data
Size: 59KB - Virtual size: 76KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 100KB - Virtual size: 99KB

.reloc
Size: 132KB - Virtual size: 131KB