2024-05-24_a5fbea9c7f60e421eef3a76ee80597fe_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-24_a5fbea9c7f60e421eef3a76ee80597fe_mafia
Size

667KB
MD5

a5fbea9c7f60e421eef3a76ee80597fe
SHA1

e0bcee751949968894cc0ffbbd928948306129a5
SHA256

f536054dae8e6573cf5ffa378c9a12f9aaf0f3eb2ceed566f361e0d04c5ab98c
SHA512

eb991b7f8d5ad4f037bdc21a7b50bce6e046ea7c2e4c8701709a58ef15c4ca7bb592e5a71f788fda2da494024b80cb8487989bb449422a059f2dbfe747a628db
SSDEEP

12288:R9ZVaKfZIWdmFKiheXZ0z1Ny9/0QYmXOus/ZbXV:7ZVtUa61NReOusBbF

Score

1^/10

Malware Config

Signatures

Files

2024-05-24_a5fbea9c7f60e421eef3a76ee80597fe_mafia
.exe windows:5 windows x86 arch:x86

7ff61f6a90e225aeebfb828636b38507

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7d:7b:3c:bf:41:05:da:e7:a2:5a:a3:0f:f7:c8:cd:21
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26/06/2014, 00:00

Not After

25/08/2015, 23:59

Subject

CN=Hangzhou Yunbao Network&Technology Co.\,Ltd,OU=IT Dept.,O=Hangzhou Yunbao Network&Technology Co.\,Ltd,L=Hangzhou,ST=Zhejiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e5:7c:e2:0a:98:02:8e:03:eb:55:54:1e:25:b5:ae:72:dd:81:a8:27
Signer

Actual PE Digest

e5:7c:e2:0a:98:02:8e:03:eb:55:54:1e:25:b5:ae:72:dd:81:a8:27

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
LoadLibraryExW
GlobalFree
GlobalHandle
InitializeCriticalSection
CloseHandle
GetCurrentProcessId
CreateFileW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
GetCommandLineW
GetLocalTime
SetUnhandledExceptionFilter
SetErrorMode
LoadLibraryW
WriteFile
SetFilePointer
GetFileSize
WideCharToMultiByte
ReadFile
lstrlenA
GetTickCount
VirtualProtect
WriteProcessMemory
CreateDirectoryW
Sleep
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
SystemTimeToFileTime
GetSystemTime
EnterCriticalSection
LeaveCriticalSection
LocalFree
FlushFileBuffers
WriteConsoleW
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetConsoleMode
GetConsoleCP
GetStringTypeW
LCMapStringW
GetLocaleInfoW
InterlockedExchange
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
HeapCreate
GetSystemTimeAsFileTime
ExitProcess
GetStartupInfoW
HeapSetInformation
DecodePointer
EncodePointer
RtlUnwind
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SizeofResource
RaiseException
LockResource
LoadResource
FindResourceW
FindResourceExW
FlushInstructionCache
GetCurrentProcess
FreeLibrary
SetLastError
GlobalLock
GlobalUnlock
GetModuleFileNameW
MulDiv
lstrcmpW
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
GetModuleHandleW
GetProcAddress
lstrlenW
GetCurrentThreadId
GlobalAlloc

user32

PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CharNextW
UnregisterClassA
FindWindowExW
SetWindowLongW
DestroyWindow
DefWindowProcW
SetWindowPos
MoveWindow
GetWindowLongW
GetSysColor
PtInRect
OffsetRect
IntersectRect
UnionRect
GetClientRect
ClientToScreen
ScreenToClient
GetDC
ReleaseDC
InvalidateRect
InvalidateRgn
RedrawWindow
SetCapture
IsChild
GetParent
GetDlgItem
EnumChildWindows
SetActiveWindow
GetClassNameW
ReleaseCapture
FillRect
CallWindowProcW
EndPaint
BeginPaint
GetDesktopWindow
GetSystemMetrics
DestroyAcceleratorTable
SetFocus
GetWindow
GetFocus
SendMessageW
IsWindow
GetClassInfoExW
AnimateWindow
ShowWindow
BringWindowToTop
SetForegroundWindow
OpenClipboard
SystemParametersInfoW
EnableWindow
PostMessageW
SetTimer
KillTimer
EndDialog
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
IsRectEmpty
SendDlgItemMessageW
SetWindowsHookExW
CallNextHookEx
GetAncestor
UnhookWindowsHookEx
CreateDialogIndirectParamW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateAcceleratorTableW
CreateWindowExW
RegisterClassExW
LoadCursorW

gdi32

GetObjectW
DeleteObject
GetStockObject
DeleteDC
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject

advapi32

RegQueryInfoKeyW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegSetValueExW

shell32

SHCreateDirectoryExW
SHGetFolderPathA
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoInitialize
CoUninitialize
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CLSIDFromString
OleRun
CoGetClassObject
StringFromGUID2
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
OleLockRunning
ProgIDFromCLSID
CLSIDFromProgID
CoTaskMemAlloc

oleaut32

OleCreateFontIndirect
SysStringLen
VarBstrCmp
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayDestroy
VariantChangeType
VariantCopy
SysStringByteLen
SysAllocStringByteLen
DispCallFunc
GetErrorInfo
LoadTypeLi
LoadRegTypeLi
SysAllocStringLen
VariantClear
VariantInit
VarUI4FromStr
SysAllocString
SysFreeString

urlmon

UrlMkSetSessionOption
CoInternetGetSession
ObtainUserAgentString

wininet

HttpAddRequestHeadersW
InternetOpenW
HttpSendRequestW
InternetCloseHandle
InternetConnectW
HttpOpenRequestW
InternetSetOptionW
InternetErrorDlg
InternetCanonicalizeUrlW
InternetCrackUrlW

dsound

ord1

dbghelp

MiniDumpWriteDump
ImageDirectoryEntryToDataEx

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

psapi

EnumProcessModules

winmm

PlaySoundA
waveOutWrite
midiStreamOut
PlaySoundW

wintrust

WinVerifyTrust

crypt32

CertOpenStore

Sections

.text
Size: 357KB - Virtual size: 356KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 13KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7ff61f6a90e225aeebfb828636b38507

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78Certificate

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

7d:7b:3c:bf:41:05:da:e7:a2:5a:a3:0f:f7:c8:cd:21Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

e5:7c:e2:0a:98:02:8e:03:eb:55:54:1e:25:b5:ae:72:dd:81:a8:27Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

urlmon

wininet

dsound

dbghelp

version

psapi

winmm

wintrust

crypt32

Sections

.text Size: 357KB - Virtual size: 356KB

.rdata Size: 81KB - Virtual size: 81KB

.data Size: 13KB - Virtual size: 21KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 38KB - Virtual size: 30KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

7d:7b:3c:bf:41:05:da:e7:a2:5a:a3:0f:f7:c8:cd:21
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

e5:7c:e2:0a:98:02:8e:03:eb:55:54:1e:25:b5:ae:72:dd:81:a8:27
Signer

.text
Size: 357KB - Virtual size: 356KB

.rdata
Size: 81KB - Virtual size: 81KB

.data
Size: 13KB - Virtual size: 21KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 38KB - Virtual size: 30KB