2024-07-06_83341ad7e1c851e4a98616e4b8763248_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-07-06_83341ad7e1c851e4a98616e4b8763248_mafia
Size

1.2MB
MD5

83341ad7e1c851e4a98616e4b8763248
SHA1

3cc9cd176ce0d5b2cd9c5f8513530795f0602053
SHA256

0a59f575e8efded561d920fe175c9e35f6957921aac4b637a342884bb84a40b8
SHA512

ee80dca3a27b4f64175c17ec30ad73a3c201a6a21578f036ac15db5e63d9cfe9ebd551b49103aa938c945ea1ff3b44b3c6ec34775149b7bacdc9e5c3edfb23e1
SSDEEP

12288:gBAXDW1p9QIcUhUkOdbL93JG2liQWcxYgCXgTzYmOnZTnRSjgG59N3fTseKWxkNs:SL4cNDnlkkG59N3fT/aJ6

Score

1^/10

Malware Config

Signatures

Files

2024-07-06_83341ad7e1c851e4a98616e4b8763248_mafia
.exe windows:5 windows x86 arch:x86

b2ace991b1d64582324c8c77b91b276b

Code Sign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:a6:a2:62:6f:72:48:24:5f:3a:61:5a:8c:e7:da:de
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

04-07-2014 00:00

Not After

01-08-2016 23:59

Subject

CN=Beijing Funshion Online Technologies Ltd.,OU=SECURE APPLICATION DEVELOPMENT,O=Beijing Funshion Online Technologies Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2024 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

52:9b:9e:e4:00:5f:26:c6:b0:93:47:f3:70:97:00:91:b6:c5:41:b7
Signer

Actual PE Digest

52:9b:9e:e4:00:5f:26:c6:b0:93:47:f3:70:97:00:91:b6:c5:41:b7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

I:\build4.0.2\Funshion\Rel\bin\Release\FunshionUpgrade.pdb

Imports

shlwapi

PathFileExistsW
PathAppendW
PathRemoveFileSpecW
PathIsDirectoryW

kernel32

MultiByteToWideChar
InterlockedExchangeAdd
FreeLibrary
GetTickCount
LoadLibraryW
GetUserDefaultUILanguage
FreeResource
FindResourceW
LoadResource
InterlockedCompareExchange
SizeofResource
LockResource
GetCurrentThreadId
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
SetFilePointer
SystemTimeToFileTime
CreateDirectoryW
GetCurrentDirectoryW
LocalFileTimeToFileTime
InterlockedIncrement
InterlockedDecrement
ExitProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetNativeSystemInfo
OutputDebugStringA
GetProcessHeap
SetEndOfFile
WriteConsoleW
SetStdHandle
IsValidLocale
lstrlenA
GetLocaleInfoA
GetUserDefaultLCID
FlushFileBuffers
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
GetCurrentProcessId
HeapCreate
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
GetStdHandle
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LCMapStringW
GetCPInfo
RaiseException
RtlUnwind
HeapReAlloc
HeapAlloc
GetSystemTimeAsFileTime
HeapFree
GetStartupInfoW
HeapSetInformation
GetCommandLineW
DecodePointer
EncodePointer
GetStringTypeW
InterlockedExchange
ExpandEnvironmentStringsW
GetProcAddress
WriteFile
MoveFileExW
CreateFileW
GetModuleFileNameW
GetFileSize
WideCharToMultiByte
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteFileW
CloseHandle
MoveFileW
Sleep
GetModuleHandleW
CreateEventW
GetLastError
GetVersionExW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
EnumSystemLocalesA

user32

ReleaseCapture
DefWindowProcW
GetMonitorInfoW
SendMessageW
CreateWindowExW
IsWindow
ShowWindow
SetWindowPos
SetWindowLongW
MonitorFromWindow
GetWindowLongW
InvalidateRect
RegisterClassExW
GetClassInfoExW
PtInRect
BeginPaint
SetFocus
GetClientRect
LoadCursorW
HideCaret
GetFocus
ShowCaret
GetSysColor
CreateCaret
SetCaretPos
GetSystemMetrics
SetRectEmpty
SystemParametersInfoW
GetDC
ReleaseDC
SetTimer
KillTimer
DrawTextW
DrawFocusRect
ClientToScreen
SetWindowRgn
ScreenToClient
SetActiveWindow
SetCapture
IsZoomed
GetKeyState
IsWindowEnabled
OffsetRect
BringWindowToTop
GetDesktopWindow
GetCursorPos
GetActiveWindow
PostThreadMessageW
RegisterWindowMessageW
MapWindowPoints
UpdateWindow
EnableWindow
SetWindowTextW
CallWindowProcW
GetWindow
IntersectRect
GetMessageW
TranslateMessage
PeekMessageW
DispatchMessageW
SetCursor
PostQuitMessage
PostMessageW
FindWindowW
IsWindowVisible
LoadImageW
EndPaint
DestroyWindow
UpdateLayeredWindow
GetWindowRect
GetParent

gdi32

ExtSelectClipRgn
GetTextColor
BitBlt
SelectClipRgn
CombineRgn
CreateCompatibleBitmap
OffsetRgn
GetClipBox
DeleteDC
CreateDIBSection
DeleteObject
SelectObject
CreateCompatibleDC
SetBkMode
ExtTextOutW
SetBkColor
CreateRectRgn
CreateRectRgnIndirect
SetTextColor
GetObjectW
CreateFontIndirectW
GetDeviceCaps
SetRectRgn

advapi32

InitializeSecurityDescriptor
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
RegCreateKeyExW
SetSecurityDescriptorDacl

shell32

Shell_NotifyIconW
ord165
SHGetSpecialFolderPathW
SHFileOperationW
ShellExecuteW

ole32

CoSetProxyBlanket
CoInitialize
CoUninitialize
CoCreateInstance
OleInitialize

oleaut32

SysFreeString

winhttp

WinHttpReadData
WinHttpCrackUrl
WinHttpOpenRequest
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpSetStatusCallback
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpReceiveResponse

comctl32

ord17
_TrackMouseEvent

msimg32

GradientFill
AlphaBlend

riched20

ord4

Sections

.text
Size: 394KB - Virtual size: 393KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 726KB - Virtual size: 725KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b2ace991b1d64582324c8c77b91b276b

Code Sign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

33:a6:a2:62:6f:72:48:24:5f:3a:61:5a:8c:e7:da:deCertificate

Extended Key Usages

Key Usages

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

52:9b:9e:e4:00:5f:26:c6:b0:93:47:f3:70:97:00:91:b6:c5:41:b7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

winhttp

comctl32

msimg32

riched20

Sections

.text Size: 394KB - Virtual size: 393KB

.rdata Size: 96KB - Virtual size: 96KB

.data Size: 9KB - Virtual size: 17KB

.rsrc Size: 726KB - Virtual size: 725KB

.reloc Size: 29KB - Virtual size: 28KB

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

33:a6:a2:62:6f:72:48:24:5f:3a:61:5a:8c:e7:da:de
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

52:9b:9e:e4:00:5f:26:c6:b0:93:47:f3:70:97:00:91:b6:c5:41:b7
Signer

.text
Size: 394KB - Virtual size: 393KB

.rdata
Size: 96KB - Virtual size: 96KB

.data
Size: 9KB - Virtual size: 17KB

.rsrc
Size: 726KB - Virtual size: 725KB

.reloc
Size: 29KB - Virtual size: 28KB