2024-06-17_0710af1611a80fd1630e245d45290223_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-17_0710af1611a80fd1630e245d45290223_mafia
Size

1.6MB
MD5

0710af1611a80fd1630e245d45290223
SHA1

1b39fe8fe5c7ba6ec5b5fdb1adfefa79dfe28e88
SHA256

aeb9cfb3330a5affc2abee88f676d071026df62cb1bdb367759180cf2914c54a
SHA512

3152cce5f848f670b4820690ec20db81ba02ed3ace3dc3209d987b24fbfe2f6185effc18196a91f6d59e81c6a5cf7d210f8c447aeff8cff68fa5ae27b2b886c5
SSDEEP

24576:q1XSwGEjkpHTY5W4B8HQvEKtApZAt13yeRTrvtrzoEbioCFeTRw:qjouUG8KtApZSCOTztrzoEbioCFeTRw

Score

1^/10

Malware Config

Signatures

Files

2024-06-17_0710af1611a80fd1630e245d45290223_mafia
.exe windows:5 windows x86 arch:x86

c20a93346cc480a4332975d6fb37f430

Code Sign

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/04/2012, 00:00

Not After

24/04/2015, 23:59

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fb:ea:42:f5:41:4a:40:f7:ae:c3:db:a4:97:94:2c:4b:52:a9:b2:52
Signer

Actual PE Digest

fb:ea:42:f5:41:4a:40:f7:ae:c3:db:a4:97:94:2c:4b:52:a9:b2:52

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\cleintci\workspace\safebrowser_bdupdate_m2_branch\bdupdate\output\SparkUpdate.pdb

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ws2_32

WSAGetLastError
getaddrinfo
getnameinfo
WSAStartup
gethostname
freeaddrinfo

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WinVerifyTrust

crypt32

CertGetNameStringW

imm32

ImmDisableIME

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory
WTSQueryUserToken

psapi

GetModuleFileNameExW
EnumProcessModules
GetModuleInformation
EnumProcesses

kernel32

GetTempPathW
GetCurrentProcess
GetModuleFileNameW
lstrcpyW
lstrlenW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetLastError
GetFullPathNameW
SetCurrentDirectoryW
CreateMutexW
OutputDebugStringW
GetSystemTime
GetCommandLineW
FreeConsole
GetConsoleScreenBufferInfo
GetStdHandle
AllocConsole
WriteConsoleW
SetConsoleTextAttribute
GetCurrentProcessId
GetPrivateProfileIntW
Sleep
ReleaseMutex
GetModuleHandleW
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
TerminateProcess
SetProcessAffinityMask
InterlockedIncrement
lstrcmpiW
LoadLibraryExW
OpenFileMappingW
GetPrivateProfileStringW
VirtualQuery
WritePrivateProfileStringW
CreateProcessW
ExitProcess
OpenEventW
HeapAlloc
GetProcessHeap
HeapFree
OpenMutexW
GetExitCodeProcess
WTSGetActiveConsoleSessionId
DeviceIoControl
FlushInstructionCache
CopyFileW
FindFirstFileW
GetVolumeInformationA
GlobalFree
GlobalAlloc
SetThreadPriority
GetFileAttributesExW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
CompareStringW
lstrlenA
VirtualProtect
IsWow64Process
HeapCreate
AddVectoredExceptionHandler
SetUnhandledExceptionFilter
RemoveVectoredExceptionHandler
ProcessIdToSessionId
InterlockedExchange
InterlockedCompareExchange
GetFileSizeEx
ReadProcessMemory
VirtualQueryEx
QueueUserWorkItem
InterlockedExchangeAdd
GetSystemTimeAsFileTime
QueryPerformanceFrequency
QueryPerformanceCounter
CreateEventW
SetFileValidData
GetModuleFileNameA
GetModuleHandleA
ExpandEnvironmentStringsW
CreateFileA
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
GetTempFileNameW
GetDiskFreeSpaceExW
GetVolumeInformationW
GetDriveTypeW
GetLogicalDrives
InterlockedPopEntrySList
FindNextFileW
FindClose
MoveFileExW
GetVersionExW
SetEvent
ResetEvent
WaitForSingleObject
TerminateThread
EncodePointer
DecodePointer
OpenProcess
LocalFree
FormatMessageW
DeleteFileW
FreeLibrary
SetEndOfFile
GetLastError
TlsFree
DosDateTimeToFileTime
SetFileAttributesW
TlsSetValue
RtlUnwind
GetConsoleCP
GetConsoleMode
ExitThread
CreateThread
GetTimeFormatW
GetDateFormatW
TlsGetValue
ResumeThread
GetCommandLineA
HeapSetInformation
GetStartupInfoW
LCMapStringW
GetCPInfo
UnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetFileType
GetCurrentThreadId
TlsAlloc
GetTickCount
UnmapViewOfFile
GetLocalTime
CreateFileMappingW
MapViewOfFile
GetFileSize
WriteFile
SetFileTime
GetFileAttributesW
CreateDirectoryW
GetCurrentDirectoryW
WideCharToMultiByte
LocalFileTimeToFileTime
SystemTimeToFileTime
ReadFile
CloseHandle
CreateFileW
SetFilePointer
MultiByteToWideChar
LoadLibraryW
GetProcAddress
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
RaiseException
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
HeapSize
FlushFileBuffers
GetACP
SetFilePointerEx
WaitForMultipleObjects
GetOEMCP
IsValidCodePage
SetStdHandle
GetLocaleInfoW
GetTimeZoneInformation
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetEnvironmentVariableA
HeapReAlloc
RemoveDirectoryW
HeapDestroy

user32

UpdateWindow
AttachThreadInput
SetActiveWindow
IsIconic
BringWindowToTop
MessageBoxW
PeekMessageW
LoadIconW
SetFocus
GetAsyncKeyState
GetForegroundWindow
CreateWindowExW
CallWindowProcW
RegisterClassExW
DefWindowProcW
DestroyWindow
LoadCursorW
GetClassInfoExW
CreatePopupMenu
InsertMenuW
DialogBoxParamW
KillTimer
GetCursorPos
SetForegroundWindow
TrackPopupMenu
DestroyMenu
RegisterWindowMessageW
CharNextW
SetWindowTextW
SetWindowLongW
GetWindowLongW
ShowWindow
PostMessageW
GetWindowThreadProcessId
SetTimer
AllowSetForegroundWindow
IsWindow
SendMessageW
DestroyIcon
PostThreadMessageW
GetMessageW
TranslateMessage
DispatchMessageW
GetDesktopWindow
wsprintfW
UnregisterClassA
LoadImageW

gdi32

GetStockObject

advapi32

RegQueryValueExA
RegCloseKey
RegEnumValueW
RegOpenKeyExW
GetTokenInformation
OpenProcessToken
RegQueryValueExW
GetUserNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyW
RegDeleteKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExA
RegEnumKeyExA
LookupAccountSidW
GetExplicitEntriesFromAclW
SetSecurityInfo
SetEntriesInAclW
GetSecurityInfo
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
StartServiceW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
CreateProcessAsUserW
DuplicateTokenEx
QueryServiceStatusEx
CryptReleaseContext
CryptDecrypt
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptAcquireContextW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetServiceStatus
SetServiceObjectSecurity
BuildExplicitAccessWithNameW
GetSecurityDescriptorDacl
QueryServiceObjectSecurity
ChangeServiceConfig2W
CreateServiceW
RegCreateKeyW
DeleteService
ControlService
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
RevertToSelf
SetTokenInformation

shell32

CommandLineToArgvW
Shell_NotifyIconW
SHFileOperationW
ShellExecuteExW
ord165
SHCreateDirectoryExW
ShellExecuteW
SHGetFolderPathW
SHGetSpecialFolderPathW

ole32

CoInitialize
CoUninitialize
CoInitializeEx
CoCreateInstance
OleInitialize
CoTaskMemAlloc
CoTaskMemFree
CoCreateGuid
CLSIDFromProgID
CoTaskMemRealloc

oleaut32

SysAllocStringLen
VariantClear
VariantInit
VarUI4FromStr
SysAllocString
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysFreeString
VarBstrCmp

shlwapi

PathFindFileNameW
PathRemoveExtensionW
PathStripPathW
PathGetDriveNumberW
PathFindExtensionW
PathIsDirectoryW
SHGetValueW
SHSetValueW
PathFileExistsW
PathAppendW
PathRemoveFileSpecW

iphlpapi

GetIpForwardTable
GetAdaptersAddresses
GetAdaptersInfo

rpcrt4

UuidToStringW
RpcStringFreeW

wininet

HttpAddRequestHeadersW
InternetErrorDlg
HttpEndRequestW
HttpQueryInfoW
InternetGetLastResponseInfoW
InternetReadFileExA
HttpOpenRequestW
InternetConnectW
InternetSetStatusCallbackW
InternetOpenW
InternetSetOptionW
InternetQueryOptionW
InternetOpenA
InternetSetOptionA
InternetCloseHandle
HttpEndRequestA
HttpSendRequestExA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetConnectA
InternetWriteFile

Exports

Exports

?ClearService@Com@Util@@YGJXZ
?CreateObjectByIID@Com@Util@@YGJABU_GUID@@PAPAX@Z
?GetService@Com@Util@@YGJABU_GUID@@PAPAX@Z
?RegObject@Com@Util@@YGJABU_GUID@@0PA_W1@Z
?RegService@Com@Util@@YGJABU_GUID@@0PA_W1@Z
?ResetPath@Com@Util@@YGJPA_W@Z
?XNetDownloadFile@@YAPAXPAXPAVIXNetDownloadStatusCallback@@PB_W2W4XnetMethodType@@22@Z
?XNetHttpRequest@@YAPAXPAXP6AX0H0KPB_W@Z1W4XnetMethodType@@11K@Z
?XNetInit@@YAHXZ
?XNetStop@@YAHPAX@Z
?XNetUninit@@YAHXZ
GetLogController

Sections

.text
Size: 661KB - Virtual size: 661KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 692KB - Virtual size: 692KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c20a93346cc480a4332975d6fb37f430

Code Sign

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5cCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

fb:ea:42:f5:41:4a:40:f7:ae:c3:db:a4:97:94:2c:4b:52:a9:b2:52Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

ws2_32

userenv

wintrust

crypt32

imm32

wtsapi32

psapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

iphlpapi

rpcrt4

wininet

Exports

Exports

Sections

.text Size: 661KB - Virtual size: 661KB

.rdata Size: 167KB - Virtual size: 166KB

.data Size: 19KB - Virtual size: 31KB

.rsrc Size: 692KB - Virtual size: 692KB

.reloc Size: 52KB - Virtual size: 51KB

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

fb:ea:42:f5:41:4a:40:f7:ae:c3:db:a4:97:94:2c:4b:52:a9:b2:52
Signer

.text
Size: 661KB - Virtual size: 661KB

.rdata
Size: 167KB - Virtual size: 166KB

.data
Size: 19KB - Virtual size: 31KB

.rsrc
Size: 692KB - Virtual size: 692KB

.reloc
Size: 52KB - Virtual size: 51KB