2024-06-03_93fc4d6390de567469728fa50b355cd9_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-03_93fc4d6390de567469728fa50b355cd9_mafia
Size

10.8MB
MD5

93fc4d6390de567469728fa50b355cd9
SHA1

0e9cfbf2e8e5d40f04e79fb85da2ff0906214f32
SHA256

2aa7df51e3e93ad2540b29c74d83bb52e9883aeb636431ccc2c7b5f27350f236
SHA512

1d20f43d09d130660270f15c3360a4346dac7bcb55dc384332ca667076d3197ffc7733b476555a5c6a0398d8b0fc09ffc04a04efe0af6afc3261c8c2121ef3e1
SSDEEP

196608:Vvwr3+Pqh47PonEZDguoWbenyaxbU5nIvubjORmTxlCBB1An:VPquEnEjCnyaxbUWubjORkxlCBbAn

Score

1^/10

Malware Config

Signatures

Files

2024-06-03_93fc4d6390de567469728fa50b355cd9_mafia
.exe windows:5 windows x86 arch:x86

972f3b53d423accb5bfc1837bef3d6e4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

71:c0:b8:f7:f8:e7:ae:5d:d0:0b:f1:01:67:94:a6:ef
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/03/2014, 00:00

Not After

02/03/2017, 23:59

Subject

CN=Beijing AmazGame Age Internet Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech Dept.,O=Beijing AmazGame Age Internet Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4b:13:9e:96:db:72:90:d2:3c:3f:54:28:56:0b:b0:b5:fc:8e:74:fa
Signer

Actual PE Digest

4b:13:9e:96:db:72:90:d2:3c:3f:54:28:56:0b:b0:b5:fc:8e:74:fa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\Svn\CyPlatformV6\Prj_CyLauncher\trunk\CyLauncher\EOSRelease\CyLauncher.pdb

Imports

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
GetLocaleInfoW
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
SetStdHandle
VirtualQuery
WriteConsoleW
GetStringTypeW
CompareStringW
GetDriveTypeW
EnumSystemLocalesA
IsValidLocale
SetEnvironmentVariableA
GetExitCodeProcess
CreateFileW
GetDateFormatA
GetTimeFormatA
InterlockedCompareExchange
HeapSize
HeapQueryInformation
GetCurrentDirectoryW
ExitProcess
GetSystemInfo
RaiseException
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
RtlUnwind
FindFirstFileExA
GetDriveTypeA
GetSystemTimeAsFileTime
HeapReAlloc
GetStartupInfoW
HeapSetInformation
CreateThread
ExitThread
DecodePointer
EncodePointer
FindResourceExW
GetUserDefaultLCID
VirtualProtect
SearchPathA
GetProfileIntA
GetTempFileNameA
SetErrorMode
GetNumberFormatA
GetWindowsDirectoryA
FindNextFileA
GetFileTime
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
MoveFileA
lstrcmpiA
GetACP
GetOEMCP
GetCPInfo
GlobalFlags
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
InitializeCriticalSectionAndSpinCount
FileTimeToLocalFileTime
GetThreadLocale
InterlockedIncrement
SetThreadPriority
GetCurrentThread
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoA
InterlockedExchange
lstrcmpA
GetModuleHandleW
GetModuleFileNameW
ReleaseActCtx
CreateActCtxW
GlobalFree
GlobalSize
LocalFree
lstrlenW
MulDiv
lstrlenA
FindResourceA
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GetVersionExA
CompareStringA
LoadLibraryW
ActivateActCtx
DeactivateActCtx
lstrcmpW
CreatePipe
DeviceIoControl
GetVersionExW
GetCurrentProcessId
GetProcessHeap
HeapFree
HeapAlloc
GetStartupInfoA
GetFileSizeEx
SetFilePointerEx
GetFileInformationByHandle
DuplicateHandle
FileTimeToSystemTime
WriteFile
GetCurrentProcess
SystemTimeToFileTime
SetFilePointer
ReleaseSemaphore
CreateSemaphoreA
TerminateThread
VirtualAlloc
CreateToolhelp32Snapshot
Process32Next
GetLocalTime
RemoveDirectoryA
CreateDirectoryA
GetFileAttributesA
OpenProcess
Process32First
GetFileSize
CreateFileA
FormatMessageA
ExpandEnvironmentStringsA
WaitForMultipleObjects
GetFileType
GetStdHandle
ReadFile
PeekNamedPipe
DeleteCriticalSection
EnterCriticalSection
SetLastError
LeaveCriticalSection
InitializeCriticalSection
VerifyVersionInfoA
SleepEx
VerSetConditionMask
GetFullPathNameW
InterlockedDecrement
GetFileAttributesExA
ResetEvent
GetDiskFreeSpaceExA
SetEvent
ResumeThread
GetModuleHandleA
CreateEventA
CloseHandle
WaitForSingleObject
TerminateProcess
GetTickCount
lstrcpyA
FreeResource
GlobalUnlock
GlobalLock
GlobalAlloc
CreateProcessW
GetPrivateProfileStringA
MultiByteToWideChar
GetCommandLineA
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryA
CreateProcessA
CopyFileA
Sleep
SetFileAttributesA
FindResourceW
LoadResource
LockResource
SizeofResource
GetTempPathA
WideCharToMultiByte
GetModuleFileNameA
DeleteFileA
GetCurrentDirectoryA
WritePrivateProfileStringA
GetPrivateProfileIntA

user32

DeleteMenu
UnregisterClassA
LoadCursorA
GetSysColorBrush
RealChildWindowFromPoint
SystemParametersInfoA
DestroyMenu
GetMenuItemInfoA
IntersectRect
CharNextA
MapVirtualKeyA
GetKeyNameTextA
DrawStateA
ShowOwnedPopups
SetCursor
GetMessageA
ValidateRect
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
SetWindowContextHelpId
MapDialogRect
SetTimer
WaitMessage
PostQuitMessage
GetMenuStringA
AppendMenuA
InsertMenuA
RemoveMenu
GetWindowThreadProcessId
EndPaint
BeginPaint
GetWindowDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
MoveWindow
SetWindowTextA
IsDialogMessageA
CheckDlgButton
RegisterWindowMessageA
LoadIconA
SendDlgItemMessageA
WinHelpA
IsChild
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
IsWindow
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
UnhookWindowsHookEx
SetRectEmpty
GetMessagePos
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
GetMenuDefaultItem
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
IsWindowVisible
GetSubMenu
GetMenuItemID
GetMenuItemCount
MessageBoxA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
CopyRect
PtInRect
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
CallWindowProcA
GetMenu
GetWindow
InvertRect
IsCharAlphaNumericW
FindWindowA
EnableWindow
InvalidateRect
GetClientRect
MsgWaitForMultipleObjects
TranslateMessage
PeekMessageA
DispatchMessageA
GetNextDlgGroupItem
GetParent
ReleaseCapture
ClientToScreen
DrawFocusRect
OffsetRect
DrawEdge
WindowFromPoint
GetCursorPos
GetCapture
GetSysColor
IsWindowEnabled
ShowWindow
GetDesktopWindow
LoadImageA
IsRectEmpty
InflateRect
FrameRect
EnumDisplayMonitors
SetLayeredWindowAttributes
LoadCursorW
CharUpperA
CopyAcceleratorTableA
SetRect
InvalidateRgn
SetCapture
MessageBeep
DestroyIcon
LoadMenuW
GetSystemMenu
RedrawWindow
FillRect
DefWindowProcA
GetWindowLongA
SetWindowLongA
UpdateWindow
CreateWindowExA
RegisterClassExA
DestroyWindow
GetActiveWindow
SetForegroundWindow
WindowFromDC
PostMessageA
NotifyWinEvent
GetAsyncKeyState
IsZoomed
UnionRect
EnableScrollBar
UpdateLayeredWindow
MonitorFromPoint
IsMenu
CreatePopupMenu
GetMessageTime
SetMenuDefaultItem
LoadBitmapW
GetDC
HideCaret
ReleaseDC
SetWindowRgn
GetWindowRgn
DestroyCursor
SubtractRect
LoadIconW
SendMessageA
SetWindowTextW
IsIconic
GetSystemMetrics
DrawIcon
KillTimer
SetWindowPos
GetWindowRect
GetDoubleClickTime
GetUpdateRect
IsClipboardFormatAvailable
CreateMenu
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcA
DefFrameProcA
MapVirtualKeyExA
IsCharLowerA
PostThreadMessageA
CharUpperBuffA
CopyIcon
UnpackDDElParam
ReuseDDElParam
LoadMenuA
LoadAcceleratorsA
InsertMenuItemA
TranslateAcceleratorA
LoadImageW
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
RegisterClipboardFormatA
LockWindowUpdate
BringWindowToTop
SetCursorPos
CreateAcceleratorTableA
LoadAcceleratorsW
GetKeyboardState
GetKeyboardLayout
ToAsciiEx
DrawFrameControl
SetClassLongA
DestroyAcceleratorTable
SetParent
DrawIconEx
CopyImage
GetIconInfo
ScrollWindow

gdi32

GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
CreatePatternBrush
SelectPalette
GetObjectType
CreatePen
CreateHatchBrush
CopyMetaFileA
CreateDCA
CreateRectRgnIndirect
PatBlt
GetBkColor
GetTextColor
SetRectRgn
GetMapMode
DPtoLP
CreateDIBitmap
GetTextMetricsA
EnumFontFamiliesA
GetTextCharsetInfo
GetRgnBox
CreateRoundRectRgn
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
CreatePolygonRgn
CreateEllipticRgn
Ellipse
Polygon
OffsetRgn
SetDIBColorTable
SetPixel
Rectangle
EnumFontFamiliesExA
ExtFloodFill
SetPaletteEntries
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
SetPixelV
GetTextFaceA
GetClipBox
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CreateBitmap
SetBkColor
SetTextColor
SelectClipRgn
CreateDIBSection
DeleteDC
CreateSolidBrush
DeleteObject
GetTextExtentPoint32A
GetStockObject
CreateFontIndirectA
GetDeviceCaps
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
Polyline
ExcludeClipRect
CombineRgn
CreateRectRgn
BitBlt
StretchBlt
CreateCompatibleBitmap
SelectObject
GetObjectA
GetPixel
CreateCompatibleDC

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

RegDeleteKeyA
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptHashData
RegOpenKeyExA
RegQueryValueA
RegEnumKeyExA
RegEnumValueA
RegEnumKeyA
CryptGetHashParam
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey

shell32

DragQueryFileA
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHAppBarMessage
ShellExecuteA
DragFinish

comctl32

ImageList_GetIconSize
_TrackMouseEvent
InitCommonControlsEx

shlwapi

PathAppendA
PathFindFileNameA
PathFileExistsA
PathRemoveFileSpecA
PathFindExtensionA
UrlUnescapeA
PathStripToRootA
PathIsUNCA
PathRemoveFileSpecW

ole32

OleDuplicateData
CoCreateGuid
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoInitializeEx
OleIsCurrentClipboard
OleFlushClipboard
DoDragDrop
OleCreateMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleLockRunning
CoRevokeClassObject
CoRegisterMessageFilter
OleGetClipboard
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
CoTaskMemAlloc
ReleaseStgMedium
CoTaskMemFree
OleDraw
CoUninitialize
OleSetContainedObject
CoInitialize
CreateStreamOnHGlobal
OleDestroyMenuDescriptor
OleCreate

oleaut32

VariantInit
SysAllocStringLen
OleCreateFontIndirect
VariantCopy
VariantChangeType
VariantClear
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
VarBstrFromDate
SysAllocString
SysAllocStringByteLen
GetErrorInfo
SysFreeString
OleLoadPicture

oledlg

ord8

gdiplus

GdipDrawImageI
GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree

ws2_32

inet_ntoa
gethostbyname
inet_addr
WSASocketA
gethostname
getaddrinfo
freeaddrinfo
ioctlsocket
listen
accept
recvfrom
sendto
send
select
__WSAFDIsSet
getpeername
connect
WSAGetLastError
htons
ntohs
WSACleanup
WSAStartup
getsockopt
closesocket
WSASetLastError
socket
bind
recv
setsockopt
getsockname
WSAIoctl

wininet

HttpQueryInfoA
InternetConnectA
InternetCrackUrlA
InternetReadFile
HttpOpenRequestA
HttpAddRequestHeadersA
InternetSetStatusCallback
HttpSendRequestA
InternetOpenA
InternetCloseHandle
InternetQueryOptionA
InternetSetOptionA
InternetOpenUrlA
InternetCanonicalizeUrlA

winmm

PlaySoundA
timeGetTime

wldap32

ord143
ord41
ord26
ord60
ord50
ord79
ord33
ord27
ord301
ord211
ord46
ord22
ord35
ord32
ord200
ord30

bugtrap

BT_SetAppName
BT_SetAppVersion
BT_SetFlags
BT_SetActivityType
BT_AddLogFile
BT_SetPreErrHandler
BT_InstallSehFilter
BT_SetSupportServer

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 430KB - Virtual size: 429KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8.1MB - Virtual size: 8.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 244KB - Virtual size: 243KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

972f3b53d423accb5bfc1837bef3d6e4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

71:c0:b8:f7:f8:e7:ae:5d:d0:0b:f1:01:67:94:a6:efCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

4b:13:9e:96:db:72:90:d2:3c:3f:54:28:56:0b:b0:b5:fc:8e:74:faSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

gdiplus

ws2_32

wininet

winmm

wldap32

bugtrap

oleacc

imm32

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 430KB - Virtual size: 429KB

.data Size: 38KB - Virtual size: 147KB

.rsrc Size: 8.1MB - Virtual size: 8.1MB

.reloc Size: 244KB - Virtual size: 243KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

71:c0:b8:f7:f8:e7:ae:5d:d0:0b:f1:01:67:94:a6:ef
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

4b:13:9e:96:db:72:90:d2:3c:3f:54:28:56:0b:b0:b5:fc:8e:74:fa
Signer

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 430KB - Virtual size: 429KB

.data
Size: 38KB - Virtual size: 147KB

.rsrc
Size: 8.1MB - Virtual size: 8.1MB

.reloc
Size: 244KB - Virtual size: 243KB