2024-06-19_e51b53064adc2a0c97553e57e35c4be0_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-19_e51b53064adc2a0c97553e57e35c4be0_mafia
Size

724KB
MD5

e51b53064adc2a0c97553e57e35c4be0
SHA1

5943702304684f8276e1a7185bae90d937c0158b
SHA256

0cb7718e1bf64927a16b45d5866c28e6d76c527b273d8c83aa164813658fc5f5
SHA512

5061ef5108eb03514f84567d550aaba2531cfff32656806ea7b82f95934a1a7e8d57aef18c36a23f04bdc8c3969c7fa754b60952690a7d3ee5aec8b6da0febbd
SSDEEP

12288:PxPF+RBhRbnTOXEeSOZWeojPwxjP0EiNR3zl55TePgKunWrHMy:Pgb2MzwTM3zl55T56My

Score

1^/10

Malware Config

Signatures

Files

2024-06-19_e51b53064adc2a0c97553e57e35c4be0_mafia
.exe windows:5 windows x86 arch:x86

c21e456f9993001ee86032d52e14ba29

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:d0:05:b1:b3:e0:1b:f9:cb:c3:c8:91:e5:e8:cd:09
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

30/07/2014, 00:00

Not After

27/09/2016, 23:59

Subject

CN=Gala Lab Corp.,O=Gala Lab Corp.,L=Gangnam-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:fb:c7:cf:6a:9e:25:fb:45:27:3d:24:6e:ba:3d:1a:34:75:f3:36
Signer

Actual PE Digest

7b:fb:c7:cf:6a:9e:25:fb:45:27:3d:24:6e:ba:3d:1a:34:75:f3:36

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\rappelz\server\PatchServer\Release\PatchServer.pdb

Imports

ws2_32

gethostbyname
WSAIoctl
inet_ntoa
WSARecv
WSASend
ntohs
setsockopt
socket
WSACleanup
htons
inet_addr
WSAStartup
WSASendTo
WSARecvFrom
send
__WSAFDIsSet
bind
listen
accept
connect
select
WSAGetLastError
recv
closesocket

kernel32

WaitForSingleObject
SetEvent
CreateEventA
GetLastError
ResetEvent
CreateMutexA
ReleaseMutex
CloseHandle
DeleteFileA
GetProcessTimes
DebugBreak
GetModuleHandleA
Sleep
VirtualQuery
GetComputerNameA
GetDriveTypeW
GetCurrentDirectoryW
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameA
FindFirstFileExA
GetDriveTypeA
CreateThread
ExitThread
GetDateFormatA
GetTimeFormatA
InitializeCriticalSectionAndSpinCount
GetTickCount
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
TryEnterCriticalSection
FileTimeToLocalFileTime
GetFileTime
GetCurrentDirectoryA
GetLocalTime
FileTimeToSystemTime
Beep
SystemTimeToFileTime
GetThreadTimes
OpenThread
WideCharToMultiByte
EncodePointer
DecodePointer
InterlockedExchange
MultiByteToWideChar
HeapFree
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
HeapAlloc
LCMapStringW
GetCPInfo
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapSize
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
SetHandleCount
GetFileType
HeapCreate
HeapDestroy
ReadFile
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetTimeZoneInformation
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
HeapReAlloc
LoadLibraryW
SetStdHandle
WriteConsoleW
CreateFileA
CreateFileW
SetEndOfFile
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
OutputDebugStringA
GetFileAttributesA
CreateDirectoryA
TerminateThread
InterlockedExchangeAdd
PostQueuedCompletionStatus
FormatMessageA
LocalFree
GetQueuedCompletionStatus
CreateIoCompletionPort
ResumeThread
GetNativeSystemInfo
OpenProcess
GetSystemInfo
FindFirstFileA
FindClose
FindNextFileA

user32

LoadCursorA
CallWindowProcA
UpdateWindow
DispatchMessageA
ShowWindow
SetWindowPos
DefWindowProcA
CreateWindowExA
SetWindowLongA
GetWindowTextA
TranslateMessage
BeginPaint
SendMessageA
SetFocus
LoadIconA
LoadBitmapA
FillRect
RegisterClassExA
GetWindowRect
GetMessageA
EndPaint
PostQuitMessage
SetTimer
KillTimer
InvalidateRect
SetWindowTextA

psapi

GetProcessMemoryInfo

mswsock

GetAcceptExSockaddrs
AcceptEx

gdi32

CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
DeleteObject
SetBkMode
CreateFontA
DeleteDC
SetTextColor
BitBlt
TextOutA

dbghelp

SymFromAddr
SymInitialize
StackWalk
MiniDumpWriteDump
SymGetModuleBase
SymFunctionTableAccess
SymCleanup
SymGetLineFromAddr
SymSetOptions

advapi32

GetUserNameA

Sections

.text
Size: 330KB - Virtual size: 330KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 633B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 283KB - Virtual size: 282KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c21e456f9993001ee86032d52e14ba29

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

0f:d0:05:b1:b3:e0:1b:f9:cb:c3:c8:91:e5:e8:cd:09Certificate

Extended Key Usages

Key Usages

7b:fb:c7:cf:6a:9e:25:fb:45:27:3d:24:6e:ba:3d:1a:34:75:f3:36Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

user32

psapi

mswsock

gdi32

dbghelp

advapi32

Sections

.text Size: 330KB - Virtual size: 330KB

.rdata Size: 67KB - Virtual size: 66KB

.data Size: 10KB - Virtual size: 22KB

.tls Size: 1024B - Virtual size: 633B

.rsrc Size: 283KB - Virtual size: 282KB

.reloc Size: 26KB - Virtual size: 25KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

0f:d0:05:b1:b3:e0:1b:f9:cb:c3:c8:91:e5:e8:cd:09
Certificate

7b:fb:c7:cf:6a:9e:25:fb:45:27:3d:24:6e:ba:3d:1a:34:75:f3:36
Signer

.text
Size: 330KB - Virtual size: 330KB

.rdata
Size: 67KB - Virtual size: 66KB

.data
Size: 10KB - Virtual size: 22KB

.tls
Size: 1024B - Virtual size: 633B

.rsrc
Size: 283KB - Virtual size: 282KB

.reloc
Size: 26KB - Virtual size: 25KB