General

Malware Config

Signatures

Files

• 2024-05-25_e7c557791a5d351a51a51c5f122389ce_mafia_magniber

  .exe windows:5 windows x86 arch:x86

  e091eabf47a184409a23abe70be84ce3

  
  

  Code Sign

  9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  05-05-2015 00:00

  Not After

  31-12-2015 23:59

  Subject

  CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  08:95:bf:af:55:a6:dc:53:92:1f:cd:ff:97:11:24:bd

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  20-04-2015 00:00

  Not After

  19-05-2017 23:59

  Subject

  CN=Pokki,O=Pokki,L=San Diego,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  98:f9:22:11:c4:7f:94:06:6c:66:45:11:d0:97:2c:7e:ac:9b:e8:57

  Signer

  Actual PE Digest

  98:f9:22:11:c4:7f:94:06:6c:66:45:11:d0:97:2c:7e:ac:9b:e8:57

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  ExpandEnvironmentStringsW

  GetSystemDirectoryW

  GetVolumeInformationW

  GetComputerNameW

  GetFileTime

  GetCurrentThread

  lstrlenA

  GetFileAttributesExW

  RemoveDirectoryW

  FindFirstFileW

  GetFileAttributesW

  FindClose

  FindNextFileW

  TerminateThread

  GetExitCodeThread

  GetModuleFileNameW

  OutputDebugStringW

  DeleteFileW

  MoveFileExW

  CopyFileW

  GetTempFileNameW

  GetTempPathW

  GetFileInformationByHandle

  FileTimeToSystemTime

  FileTimeToLocalFileTime

  FindFirstFileExW

  GetLongPathNameW

  CompareStringW

  OpenEventW

  GetModuleHandleA

  LeaveCriticalSection

  EnterCriticalSection

  FreeResource

  SetLastError

  QueryPerformanceCounter

  QueryPerformanceFrequency

  GetFileSizeEx

  VerifyVersionInfoW

  VerSetConditionMask

  IsWow64Process

  GetVersionExW

  GetEnvironmentVariableW

  GetUserDefaultUILanguage

  GetLocaleInfoW

  GetSystemTime

  VirtualQuery

  TlsGetValue

  GetThreadLocale

  TlsSetValue

  TlsAlloc

  SetThreadLocale

  GetSystemInfo

  CreateProcessW

  MulDiv

  CreateMutexA

  ReleaseMutex

  ReadFile

  WriteFile

  SetFilePointer

  GetFileSize

  WaitForSingleObjectEx

  QueueUserAPC

  CancelIo

  SleepEx

  ReadDirectoryChangesW

  WideCharToMultiByte

  RegisterWaitForSingleObject

  GetShortPathNameW

  InitializeCriticalSection

  DeleteCriticalSection

  TryEnterCriticalSection

  FlushInstructionCache

  FlushFileBuffers

  AreFileApisANSI

  SetEndOfFile

  UnlockFile

  LockFile

  LockFileEx

  UnlockFileEx

  GetFileAttributesA

  DeleteFileA

  UnmapViewOfFile

  GetTempPathA

  FormatMessageA

  FormatMessageW

  GetFullPathNameA

  GetFullPathNameW

  GetDiskFreeSpaceA

  GetDiskFreeSpaceW

  CreateFileA

  MapViewOfFile

  CreateFileMappingW

  GlobalFree

  GetLocaleInfoA

  HeapDestroy

  HeapReAlloc

  HeapSize

  InitializeCriticalSectionAndSpinCount

  InterlockedCompareExchange

  InterlockedPushEntrySList

  IsProcessorFeaturePresent

  VirtualFree

  VirtualAlloc

  InterlockedPopEntrySList

  InterlockedIncrement

  InterlockedDecrement

  GetStringTypeW

  EncodePointer

  DecodePointer

  TlsFree

  OpenEventA

  ResumeThread

  SystemTimeToFileTime

  CreateWaitableTimerA

  RtlUnwind

  ExitProcess

  GetCommandLineW

  HeapSetInformation

  GetStartupInfoW

  ExitThread

  LCMapStringW

  GetCPInfo

  GetStdHandle

  UnhandledExceptionFilter

  IsDebuggerPresent

  HeapCreate

  SetConsoleCtrlHandler

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  SetHandleCount

  GetFileType

  GetACP

  GetOEMCP

  IsValidCodePage

  GetConsoleCP

  GetConsoleMode

  GetTimeZoneInformation

  GetUserDefaultLCID

  EnumSystemLocalesA

  IsValidLocale

  SetStdHandle

  WriteConsoleW

  SetEnvironmentVariableA

  GetStringTypeExW

  MultiByteToWideChar

  Sleep

  Process32NextW

  Process32FirstW

  CreateToolhelp32Snapshot

  ProcessIdToSessionId

  LoadLibraryW

  FindResourceExW

  FindResourceW

  GetDriveTypeW

  LoadResource

  LockResource

  SizeofResource

  HeapFree

  GetProcessHeap

  HeapAlloc

  TerminateProcess

  OpenProcess

  RaiseException

  LoadLibraryA

  InterlockedExchange

  FreeLibrary

  LocalAlloc

  GetVersion

  VerifyVersionInfoA

  PeekNamedPipe

  ExpandEnvironmentStringsA

  GlobalMemoryStatus

  GetVersionExA

  FlushConsoleInputBuffer

  GetDriveTypeA

  FindFirstFileExA

  ReadConsoleInputA

  SetConsoleMode

  GetCurrentDirectoryW

  CreateThread

  CreateEventW

  WaitForMultipleObjects

  SetUnhandledExceptionFilter

  ResetEvent

  FindFirstChangeNotificationW

  FindNextChangeNotification

  CreateWaitableTimerW

  SetWaitableTimer

  CreateDirectoryW

  CreateFileW

  GetCurrentThreadId

  GetCurrentProcessId

  LocalFree

  GetLastError

  CancelWaitableTimer

  GetUserGeoID

  GetGeoInfoW

  SetEvent

  GetTickCount

  GetCurrentProcess

  DuplicateHandle

  CreateSemaphoreA

  CreateEventA

  GetSystemTimeAsFileTime

  lstrlenW

  GetModuleHandleW

  GetProcAddress

  WaitForSingleObject

  ReleaseSemaphore

  UnregisterWaitEx

  CloseHandle

  advapi32

  OpenThreadToken

  CryptReleaseContext

  CryptDestroyHash

  CryptGetHashParam

  CryptHashData

  CryptCreateHash

  CryptAcquireContextW

  RegGetKeySecurity

  AllocateAndInitializeSid

  GetLengthSid

  InitializeAcl

  AddAccessAllowedAce

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  RegSetKeySecurity

  FreeSid

  RegDeleteTreeW

  RegQueryInfoKeyW

  RegEnumValueW

  OpenProcessToken

  GetTokenInformation

  RegOpenKeyExW

  RegCreateKeyExW

  RegDeleteValueW

  RegCloseKey

  RegSetValueExW

  RegEnumKeyExW

  RegQueryValueExW

  LookupAccountNameW

  ConvertSidToStringSidW

  RegEnumKeyW

  RegisterEventSourceA

  IsValidSid

  RegOpenKeyW

  GetAce

  GetSecurityInfo

  SetSecurityInfo

  GetSecurityDescriptorSacl

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  ReportEventA

  AddAccessAllowedAceEx

  AddAce

  ConvertStringSidToSidW

  GetAclInformation

  DeregisterEventSource

  RegNotifyChangeKeyValue

  GetSidSubAuthority

  dbghelp

  MiniDumpWriteDump

  shell32

  SHGetPropertyStoreForWindow

  ShellExecuteExW

  SHGetDesktopFolder

  SHGetKnownFolderPath

  SHGetMalloc

  SHGetFolderPathW

  ShellExecuteW

  SHCreateDirectoryExW

  CommandLineToArgvW

  ole32

  CoSetProxyBlanket

  StringFromGUID2

  CoCreateGuid

  CoInitializeSecurity

  CoInitializeEx

  PropVariantClear

  CoTaskMemFree

  CoCreateInstance

  CoUninitialize

  oleaut32

  SafeArrayGetElement

  SysFreeString

  SafeArrayGetUBound

  VariantCopy

  VariantInit

  SysAllocString

  VariantClear

  SysStringLen

  SysAllocStringLen

  SafeArrayGetLBound

  msvfw32

  MCIWndCreateW

  rpcrt4

  RpcStringFreeW

  UuidToStringW

  UuidCreateSequential

  msi

  ord217

  ord173

  wininet

  DeleteUrlCacheEntryW

  InternetQueryOptionW

  winhttp

  WinHttpCloseHandle

  WinHttpGetProxyForUrl

  WinHttpOpen

  shlwapi

  ord487

  ord176

  PathFindFileNameW

  SHStrDupW

  StrRetToBufW

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  gdiplus

  GdipSaveImageToFile

  GdipCreateBitmapFromHBITMAP

  GdiplusShutdown

  GdipCloneImage

  GdipCreateBitmapFromScan0

  GdipGetImageEncodersSize

  GdipGetImageEncoders

  GdiplusStartup

  GdipCreateImageAttributes

  GdipDisposeImageAttributes

  GdipDisposeImage

  GdipDeleteGraphics

  GdipFlush

  GdipSetImageAttributesWrapMode

  GdipAlloc

  GdipCreateFromHDC

  GdipSetCompositingMode

  GdipSetCompositingQuality

  GdipSetTextRenderingHint

  GdipSetInterpolationMode

  GdipSetSmoothingMode

  GdipDrawImageRectRectI

  GdipFree

  hid

  HidD_GetHidGuid

  setupapi

  SetupDiGetDeviceRegistryPropertyW

  SetupDiGetClassDevsW

  SetupDiEnumDeviceInfo

  gdi32

  GetDIBits

  CreateBitmap

  CreateCompatibleDC

  DeleteDC

  SelectObject

  GetObjectW

  CreateDIBSection

  SetBkMode

  GetStockObject

  SetMapMode

  CreateFontIndirectW

  GetDeviceCaps

  SetBkColor

  SetTextColor

  CreateSolidBrush

  GetTextExtentPoint32W

  DeleteObject

  ws2_32

  getsockname

  ntohs

  bind

  htons

  setsockopt

  getpeername

  closesocket

  socket

  connect

  WSAIoctl

  freeaddrinfo

  getaddrinfo

  sendto

  recvfrom

  send

  recv

  select

  WSAGetLastError

  __WSAFDIsSet

  WSASetLastError

  WSAStartup

  WSACleanup

  shutdown

  gethostname

  ioctlsocket

  listen

  accept

  getsockopt

  wldap32

  ord30

  ord50

  ord35

  ord79

  ord60

  ord32

  ord26

  ord22

  ord200

  ord33

  ord301

  ord27

  ord41

  ord46

  ord211

  ord143

  normaliz

  IdnToAscii

  mfplat

  MFCreateAttributes

  mf

  MFEnumDeviceSources

  Sections

  .text

  Size: 2.7MB - Virtual size: 2.7MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 564KB - Virtual size: 563KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 67KB - Virtual size: 88KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 2B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 3.6MB - Virtual size: 3.6MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 178KB - Virtual size: 178KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ