2024-05-30_7cdcbdf441afbfedaf0d8ffe0912e3d0_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-30_7cdcbdf441afbfedaf0d8ffe0912e3d0_mafia
Size

3.5MB
MD5

7cdcbdf441afbfedaf0d8ffe0912e3d0
SHA1

c1e6c410e1dfa443407b8ec7331637cbe639e4f2
SHA256

27aa925d23f0aed6e0dc6a2411fe1e63175e00a315a8aba3747ee19971b6dde9
SHA512

fd53dbaedca9ebc6dc069f485eb32a9d3a275fdeb4c5f2aa15889ab7a394d1cae659fc2b1de578165eb4ca65507cf220fe8e508b6232ea6d11146b4521d74c40
SSDEEP

98304:Y9c1uxpN5AURBXqt69reDRPgEEmKCqAa51Zt8Qj:TgNm0eDWDmI51ZtVj

Score

1^/10

Malware Config

Signatures

Files

2024-05-30_7cdcbdf441afbfedaf0d8ffe0912e3d0_mafia
.exe windows:5 windows x86 arch:x86

34e22282e26b3d7ec85ad12dded80f83

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

72:ac:d7:95:46:c6:e0:b5:23:b1:23:d7:63:ef:e6:17
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

16/04/2012, 00:00

Not After

16/04/2013, 23:59

Subject

CN=Canon Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Inkjet System Development Center,O=Canon Inc.,L=Kawasaki-shi,ST=Kanagawa,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ff:7b:6e:44:ac:3a:6b:66:d3:c8:8b:f6:ee:7d:4e:96:f3:e2:87:92
Signer

Actual PE Digest

ff:7b:6e:44:ac:3a:6b:66:d3:c8:8b:f6:ee:7d:4e:96:f3:e2:87:92

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupGetInfFileListW
SetupGetLineTextW
SetupGetStringFieldW
SetupGetFieldCount
SetupGetLineByIndexW
SetupGetLineCountW
SetupCloseInfFile
SetupOpenInfFileW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

HeapCreate
QueryPerformanceCounter
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
SetHandleCount
GetConsoleCP
GetConsoleMode
LCMapStringW
GetTimeZoneInformation
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
SetEnvironmentVariableA
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetStdHandle
SizeofResource
LockResource
SetUnhandledExceptionFilter
LoadResource
FindResourceW
HeapAlloc
GetProcessHeap
HeapFree
CreateMutexW
GetLastError
CloseHandle
GetModuleFileNameW
LoadLibraryW
FreeLibrary
GetVersionExW
GetCurrentThread
GetCurrentProcess
LocalAlloc
LocalFree
GetUserDefaultUILanguage
MultiByteToWideChar
CreateEventW
ResumeThread
SetEvent
WaitForSingleObject
GetFileType
SetStdHandle
GetSystemTimeAsFileTime
HeapQueryInformation
CreateThread
ExitThread
ExitProcess
RaiseException
RtlUnwind
VirtualQuery
GetSystemInfo
VirtualAlloc
DecodePointer
EncodePointer
GetStartupInfoW
HeapSetInformation
GetCommandLineW
FindResourceExW
GetUserDefaultLCID
VirtualProtect
SearchPathW
GetProfileIntW
GetNumberFormatW
GetWindowsDirectoryW
GetFileTime
GetFileSizeEx
FileTimeToLocalFileTime
GetFileAttributesExW
GetTempPathW
GetTempFileNameW
SetErrorMode
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
UnlockFile
ResetEvent
lstrcmpiW
MulDiv
lstrcmpW
EnterCriticalSection
LeaveCriticalSection
InterlockedExchange
SetLastError
DeactivateActCtx
GetModuleHandleW
GetProcAddress
ActivateActCtx
lstrlenW
CreateFileW
lstrcpynW
WideCharToMultiByte
lstrcmpiA
LockFile
FlushFileBuffers
VerSetConditionMask
VerifyVersionInfoW
lstrlenA
SetFilePointer
DeleteFileW
GlobalFlags
lstrcpyW
GetSystemDirectoryW
GetCurrentDirectoryW
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
InterlockedIncrement
FileTimeToSystemTime
GetThreadLocale
GlobalGetAtomNameW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
SuspendThread
SetThreadPriority
GlobalAddAtomW
GlobalFindAtomW
CompareStringW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
ReleaseActCtx
CreateActCtxW
FreeResource
GlobalDeleteAtom
ConvertDefaultLocale
GetSystemDefaultUILanguage
CopyFileW
GlobalSize
GlobalLock
GlobalUnlock
FormatMessageW
GetModuleHandleA
GetTickCount
DeviceIoControl
GetOverlappedResult
ReadFile
CreateEventA
CreateFileA
OpenFileMappingA
ReleaseMutex
CreateMutexA
CreateFileMappingA
LoadLibraryA
GetSystemDirectoryA
GetVersionExA
GlobalFree
GlobalAlloc
lstrcpynA
GetSystemDefaultLangID
GetTimeFormatW
GetDateFormatW
GetLocaleInfoW
LoadLibraryExW
GetCurrentThreadId
GetCurrentProcessId
GetFileAttributesW
GetFileSize
WriteFile
SetFileAttributesW
HeapReAlloc
HeapSize
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
FindClose
FindFirstFileW
GetShortPathNameW
GetLocalTime
lstrcmpA
Sleep

user32

PostThreadMessageW
CreateMenu
IsMenu
UpdateLayeredWindow
UnionRect
MonitorFromPoint
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
UnpackDDElParam
ReuseDDElParam
InsertMenuItemW
TranslateAcceleratorW
GetIconInfo
EnableScrollBar
HideCaret
InvertRect
GetMenuDefaultItem
RegisterClipboardFormatW
LockWindowUpdate
BringWindowToTop
SetCursorPos
CreateAcceleratorTableW
LoadAcceleratorsW
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
DrawFocusRect
DrawFrameControl
DrawEdge
DrawIconEx
DrawStateW
SetClassLongW
GetAsyncKeyState
NotifyWinEvent
WindowFromPoint
CreatePopupMenu
DestroyAcceleratorTable
SetParent
SetWindowRgn
IsZoomed
LoadMenuW
CharUpperW
CopyImage
UnregisterClassW
MessageBeep
GetNextDlgGroupItem
ReleaseCapture
SetCapture
InvalidateRgn
IntersectRect
IsRectEmpty
CopyAcceleratorTableW
OffsetRect
CharNextW
RealChildWindowFromPoint
SetLayeredWindowAttributes
EnumDisplayMonitors
SetRectEmpty
DeleteMenu
LoadCursorW
GetSysColorBrush
MapVirtualKeyW
GetKeyNameTextW
DestroyMenu
GetMenuItemInfoW
InflateRect
EndPaint
BeginPaint
GetWindowDC
GetDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
FillRect
GetWindowThreadProcessId
ShowOwnedPopups
SetCursor
GetMessageW
GetCursorPos
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
CheckMenuItem
RegisterWindowMessageW
LoadIconW
WaitMessage
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
GetLastActivePopup
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
GetMessagePos
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
RedrawWindow
IsWindowVisible
ValidateRect
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
DefWindowProcW
CallWindowProcW
GetMenu
CopyRect
PtInRect
UnhookWindowsHookEx
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetNextDlgTabItem
EndDialog
SetWindowContextHelpId
MapDialogRect
GetMenuState
GetMenuStringW
AppendMenuW
GetMenuItemID
InsertMenuW
GetMenuItemCount
GetSubMenu
RemoveMenu
GetWindowTextLengthW
GetWindowTextW
GetFocus
SetFocus
SetWindowPos
IsWindowEnabled
ShowWindow
MoveWindow
GetDlgCtrlID
IsWindow
SetWindowTextW
IsDialogMessageW
SetMenuDefaultItem
IsClipboardFormatAvailable
FrameRect
GetUpdateRect
OpenClipboard
SetClipboardData
CloseClipboard
EmptyClipboard
CopyIcon
CharUpperBuffW
GetDoubleClickTime
IsCharLowerW
MapVirtualKeyExW
SubtractRect
DestroyCursor
SendDlgItemMessageW
GetDlgItem
CheckDlgButton
GetWindow
GetWindowRgn
SendDlgItemMessageA
DispatchMessageW
TranslateMessage
PeekMessageW
GetParent
GetWindowLongW
SetWindowLongW
DestroyIcon
EnableWindow
KillTimer
DrawIcon
GetClientRect
IsIconic
GetSystemMetrics
SendMessageW
EnableMenuItem
GetSystemMenu
UpdateWindow
InvalidateRect
SetTimer
LoadImageW
PostMessageW
LoadStringW
SetForegroundWindow
FindWindowW
MessageBoxW
PostQuitMessage
SetRect
SystemParametersInfoW
GetWindowRect
ReleaseDC

gdi32

CreateRectRgn
GetViewportExtEx
GetWindowExtEx
BitBlt
GetPixel
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
CreatePatternBrush
GetStockObject
SelectPalette
GetObjectType
CreatePen
CreateSolidBrush
CreateHatchBrush
CreateFontIndirectW
CreateRectRgnIndirect
PatBlt
CreateDIBitmap
CreateCompatibleBitmap
EnumFontFamiliesW
GetTextCharsetInfo
GetBkColor
GetTextColor
ExtEscape
SelectClipRgn
SetRectRgn
CombineRgn
GetMapMode
DPtoLP
CreateRoundRectRgn
CreatePolygonRgn
CreateEllipticRgn
Polyline
Ellipse
Polygon
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
OffsetRgn
StretchBlt
SetPixel
Rectangle
EnumFontFamiliesExW
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
GetTextFaceW
SetPixelV
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CreateBitmap
SetBkColor
SetTextColor
CopyMetaFileW
GetTextMetricsW
GetTextExtentPoint32W
GetDeviceCaps
EndDoc
EndPage
StartPage
CreateDCW
GetObjectW
SetDIBColorTable
SelectObject
DeleteObject
CreateDIBSection
CreateCompatibleDC
DeleteDC
GetRgnBox
CreateFontW
StartDocW

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
ClosePrinter
GetPrinterW
EnumPrintersW
AddPrinterW
SetPrinterW
DeletePrinter
ord203
EnumPortsA
EnumPrinterDriversW
DeviceCapabilitiesW
DocumentPropertiesW
GetPrinterDriverW

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegEnumKeyW
OpenThreadToken
OpenProcessToken
DuplicateToken
AllocateAndInitializeSid
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegDeleteKeyW
RegDeleteValueW
RegQueryValueExA
RegOpenKeyExW
FreeSid
AccessCheck
IsValidSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor

shell32

DragQueryFileW
SHGetFolderPathW
SHCreateDirectoryExW
SHGetFileInfoW
SHBrowseForFolderW
SHAppBarMessage
ShellExecuteW
DragFinish
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetDesktopFolder

comctl32

InitCommonControlsEx
ImageList_GetIconSize

shlwapi

PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathFindExtensionW
PathRemoveFileSpecW

ole32

OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoUninitialize
CoInitialize
CoCreateInstance
CLSIDFromString
OleDestroyMenuDescriptor
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CoInitializeEx
CoTaskMemFree
CoRegisterMessageFilter
CoRevokeClassObject
DoDragDrop
OleFlushClipboard
OleIsCurrentClipboard
CreateStreamOnHGlobal
OleCreateMenuDescriptor
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
OleLockRunning
IsAccelerator
CoCreateGuid
OleTranslateAccelerator
CLSIDFromProgID

oleaut32

OleCreateFontIndirect
VarBstrFromDate
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
VariantChangeType
VariantClear
SysAllocStringLen
SysAllocString
VariantInit
SysFreeString

oledlg

OleUIBusyW

gdiplus

GdipCreateBitmapFromStream
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdiplusShutdown
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDisposeImage
GdipAlloc
GdipFree

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundW

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 313KB - Virtual size: 312KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 183KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

34e22282e26b3d7ec85ad12dded80f83

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

72:ac:d7:95:46:c6:e0:b5:23:b1:23:d7:63:ef:e6:17Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

ff:7b:6e:44:ac:3a:6b:66:d3:c8:8b:f6:ee:7d:4e:96:f3:e2:87:92Signer

Headers

DLL Characteristics

File Characteristics

Imports

setupapi

version

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

gdiplus

oleacc

imm32

winmm

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 313KB - Virtual size: 312KB

.data Size: 28KB - Virtual size: 58KB

.rsrc Size: 1.7MB - Virtual size: 1.7MB

.reloc Size: 183KB - Virtual size: 182KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

72:ac:d7:95:46:c6:e0:b5:23:b1:23:d7:63:ef:e6:17
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

ff:7b:6e:44:ac:3a:6b:66:d3:c8:8b:f6:ee:7d:4e:96:f3:e2:87:92
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 313KB - Virtual size: 312KB

.data
Size: 28KB - Virtual size: 58KB

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

.reloc
Size: 183KB - Virtual size: 182KB