2024-05-27_60cd159f13b8cb426765f9c5b1779f31_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-27_60cd159f13b8cb426765f9c5b1779f31_mafia
Size

2.7MB
MD5

60cd159f13b8cb426765f9c5b1779f31
SHA1

5fdf96f2e6af333df4dfbfe85ab88a02e66942bf
SHA256

a47c7767e66bee2d5b4c164dfe9e91e87d5a02481d337f04390c9a55e0c58ff6
SHA512

2df429a8ff73ae15e570185687561038c85e5343dbd949fafb935fadcee37bc2634dfefc1554ee40756c79695d2b30e021a5937507077658b3c5369655fa8dad
SSDEEP

49152:ogWmv9Sm+nHNAAPYchiPqX5G1YgguT3kBtz+qa:QO+nHHYcQqX5IXgwkBta

Score

1^/10

Malware Config

Signatures

Files

2024-05-27_60cd159f13b8cb426765f9c5b1779f31_mafia
.exe windows:5 windows x86 arch:x86

2f406c1ed5a57533b455b146d734fbae

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:8c:5d:17:58:47:4a:57:62:5f:f5:40:d9:1a:81:3c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

09-11-2023 00:00

Not After

09-11-2024 23:59

Subject

SERIALNUMBER=80303961,CN=Howyar Technologies Inc.,O=Howyar Technologies Inc.,ST=新北市,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:8c:5d:17:58:47:4a:57:62:5f:f5:40:d9:1a:81:3c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

09-11-2023 00:00

Not After

09-11-2024 23:59

Subject

SERIALNUMBER=80303961,CN=Howyar Technologies Inc.,O=Howyar Technologies Inc.,ST=新北市,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

32:f4:de:70:e4:06:9e:8b:e2:76:95:c3:c7:c3:c3:bd:e0:01:05:ee:8a:84:ac:95:2f:25:1f:2b:a8:22:e7:41
Signer

Actual PE Digest

32:f4:de:70:e4:06:9e:8b:e2:76:95:c3:c7:c3:c3:bd:e0:01:05:ee:8a:84:ac:95:2f:25:1f:2b:a8:22:e7:41

Digest Algorithm

sha256

PE Digest Matches

true

4b:e2:34:3b:9d:8f:97:69:b0:21:09:3f:9f:24:eb:c9:4e:c5:dc:91
Signer

Actual PE Digest

4b:e2:34:3b:9d:8f:97:69:b0:21:09:3f:9f:24:eb:c9:4e:c5:dc:91

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Output\Tools\PMonitor\PMonitor.pdb

Imports

kernel32

SetErrorMode
InterlockedDecrement
CreateEventW
LocalFree
GetUserDefaultLangID
OpenEventW
GetPrivateProfileStringW
ResetEvent
DeleteFileW
GetFileAttributesW
CreateProcessW
LoadLibraryW
GetPrivateProfileIntW
GetTempPathW
GetTempFileNameW
GetProcAddress
FreeLibrary
GetModuleFileNameW
FindResourceW
SizeofResource
LoadResource
LockResource
FreeResource
OpenProcess
WaitForMultipleObjects
DebugBreakProcess
GetFileSize
ReadFile
WriteFile
lstrlenW
DeleteFileA
WaitForSingleObject
OutputDebugStringW
Sleep
CreateThread
CopyFileW
SetEvent
TerminateThread
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetModuleHandleW
CreateFileW
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
GetCurrentProcess
MultiByteToWideChar
GetLocalTime
WideCharToMultiByte
IsBadReadPtr
OutputDebugStringA
SetEnvironmentVariableA
CompareStringW
SetEndOfFile
SetStdHandle
WriteConsoleW
GetExitCodeProcess
CreatePipe
CreateFileA
GetFileAttributesA
GetProcessHeap
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
HeapSize
GetLocaleInfoW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
SetHandleCount
IsValidCodePage
GetOEMCP
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStdHandle
HeapCreate
IsProcessorFeaturePresent
CreateProcessA
MoveFileA
ExitProcess
lstrlenA
IsDebuggerPresent
HeapReAlloc
LCMapStringW
GetCPInfo
GetStartupInfoW
HeapSetInformation
GetCommandLineW
ResumeThread
ExitThread
FindNextFileW
FindFirstFileExW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
GetSystemTimeAsFileTime
InterlockedIncrement
InterlockedExchange
DeleteCriticalSection
EncodePointer
DecodePointer
GetACP
GetLastError
GetCurrentDirectoryW
SetCurrentDirectoryW
GetTickCount
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
SetFilePointer
GetFileType
DuplicateHandle
SystemTimeToFileTime
DosDateTimeToFileTime
CreateDirectoryW
SetFileTime
LocalFileTimeToFileTime
MulDiv
GetDateFormatW
GetTimeFormatW
GlobalUnlock
GlobalLock
GlobalAlloc
VirtualAlloc
GetSystemInfo
VirtualFree
VirtualQuery
SetLastError
GetModuleFileNameA
FormatMessageA
LoadLibraryA
GetModuleHandleExA
GetModuleHandleA
VirtualProtect
HeapFree
HeapAlloc
RtlUnwind
RaiseException
MoveFileW
GetTimeFormatA
GetDateFormatA

user32

GetKeyState
MessageBoxW
ShowWindow
GetWindowTextLengthW
GetWindowTextW
MapWindowPoints
CreateAcceleratorTableW
InvalidateRgn
SendMessageA
GetCaretPos
GetSysColor
ClientToScreen
ShowCaret
HideCaret
SetRect
CharPrevW
DrawTextW
FillRect
LoadIconW
GetWindowRgn
MoveWindow
InflateRect
OffsetRect
SetCursor
GetGestureInfo
GetCursorPos
IsWindowVisible
PtInRect
ReleaseCapture
SetCapture
GetUpdateRect
BeginPaint
EndPaint
IsRectEmpty
CharNextW
IsIconic
GetMonitorInfoW
MonitorFromWindow
IsZoomed
GetClientRect
ScreenToClient
SetWindowRgn
GetWindowRect
SetWindowPos
SetWindowLongW
GetWindowLongW
wsprintfW
DefWindowProcW
DestroyWindow
IsWindow
CreateWindowExW
PostQuitMessage
DispatchMessageW
TranslateMessage
SetFocus
GetMessageW
EnableWindow
GetWindow
GetParent
SendMessageW
LoadImageW
RegisterClassW
LoadCursorW
RegisterClassExW
GetClassInfoExW
CallWindowProcW
GetPropW
SetPropW
PostMessageW
AdjustWindowRectEx
GetMenu
MessageBoxA
ReleaseDC
SetWindowTextW
GetDC
RedrawWindow
SetTimer
GetCaretBlinkTime
KillTimer
SetCaretPos
CreateCaret
IntersectRect
GetFocus
SetGestureConfig
InvalidateRect
UpdateLayeredWindow

comdlg32

GetSaveFileNameW

advapi32

RegQueryValueExW
RegOpenKeyW

shell32

CommandLineToArgvW
SHFileOperationW
SHCreateDirectoryExW
Shell_NotifyIconW

ole32

CLSIDFromProgID
OleLockRunning
CreateStreamOnHGlobal
CoSetProxyBlanket
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CLSIDFromString

oleaut32

SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetLBound
SafeArrayGetUBound
SysAllocStringLen
VariantInit
SysAllocString
SysFreeString
VariantClear

dbgeng

DebugCreate

ws2_32

htonl
inet_ntoa
inet_addr
connect
socket
send
recv
closesocket
WSAStartup
WSACleanup
htons
gethostname
gethostbyname
gethostbyaddr

gdiplus

GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipStringFormatGetGenericTypographic
GdipSetTextRenderingHint
GdipDeleteStringFormat
GdipFillRectangleI
GdipDrawString
GdipMeasureString
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipSetStringFormatFlags
GdipDrawImageRectI
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipDisposeImage
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdiplusStartup
GdiplusShutdown
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipFree
GdipGetPropertyItem
GdipAlloc
GdipCreatePen1
GdipDeletePen
GdipCreatePath
GdipCloneStringFormat
GdipFillPath
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipAddPathArcI
GdipClosePathFigure
GdipDeletePath
GdipDeleteFont

winhttp

WinHttpCloseHandle
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData

gdi32

BitBlt
RestoreDC
SaveDC
CreateCompatibleBitmap
SelectObject
CreateDIBSection
CreateCompatibleDC
GetTextMetricsW
EnumFontsW
PtInRegion
CreateRectRgn
SelectClipRgn
CombineRgn
CreateRectRgnIndirect
GetClipBox
Rectangle
SetStretchBltMode
CreateSolidBrush
LineTo
MoveToEx
CreatePenIndirect
RoundRect
SetTextColor
SetBkMode
TextOutW
GetTextExtentPoint32W
GetCharABCWidthsW
SetBkColor
ExtSelectClipRgn
GetObjectA
GetDeviceCaps
DeleteDC
GetStockObject
GetObjectW
CreateFontIndirectW
CreatePen
StretchBlt
DeleteObject
CreateRoundRectRgn

comctl32

_TrackMouseEvent
ord17

imm32

ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 956KB - Virtual size: 956KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2f406c1ed5a57533b455b146d734fbae

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

01:8c:5d:17:58:47:4a:57:62:5f:f5:40:d9:1a:81:3cCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

01:8c:5d:17:58:47:4a:57:62:5f:f5:40:d9:1a:81:3cCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

32:f4:de:70:e4:06:9e:8b:e2:76:95:c3:c7:c3:c3:bd:e0:01:05:ee:8a:84:ac:95:2f:25:1f:2b:a8:22:e7:41Signer

4b:e2:34:3b:9d:8f:97:69:b0:21:09:3f:9f:24:eb:c9:4e:c5:dc:91Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

comdlg32

advapi32

shell32

ole32

oleaut32

dbgeng

ws2_32

gdiplus

winhttp

gdi32

comctl32

imm32

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 232KB - Virtual size: 231KB

.data Size: 15KB - Virtual size: 27KB

.rsrc Size: 956KB - Virtual size: 956KB

.reloc Size: 68KB - Virtual size: 68KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

01:8c:5d:17:58:47:4a:57:62:5f:f5:40:d9:1a:81:3c
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

01:8c:5d:17:58:47:4a:57:62:5f:f5:40:d9:1a:81:3c
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

32:f4:de:70:e4:06:9e:8b:e2:76:95:c3:c7:c3:c3:bd:e0:01:05:ee:8a:84:ac:95:2f:25:1f:2b:a8:22:e7:41
Signer

4b:e2:34:3b:9d:8f:97:69:b0:21:09:3f:9f:24:eb:c9:4e:c5:dc:91
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 232KB - Virtual size: 231KB

.data
Size: 15KB - Virtual size: 27KB

.rsrc
Size: 956KB - Virtual size: 956KB

.reloc
Size: 68KB - Virtual size: 68KB