2024-08-16_6324f5821646d4f77e0074d7f84e1a64_floxif_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2024-08-16_6324f5821646d4f77e0074d7f84e1a64_floxif_mafia
Size 3.9MB
Sample240816-w6f9cstbpm
SHA256 211aa3b521e8d4a5eb1148c7c47752e002ddfe364aba3472606a7704634aaf9b
MD5 6324f5821646d4f77e0074d7f84e1a64
SHA1 2edc2ff51efdcebbf1bb2d9d471224f155b1e724
SHA512 e93e613ce31121f3dcfab61d87799fa35fb8127d6869ea8a628a3ef49dd86978426bcde02e2181b213ed0b588441d5af353da5713306696ef4c2912690c191f7
SSDEEP 98304:1g+ESjoa9kZ6DRwcEtzCyQWvKglLgeQ/Pn9rj+De0nzQUyk:1g+ESJ9k6bOvTgRn9rj+DoUb
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-08-16_6324f5821646d4f77e0074d7f84e1a64_floxif_mafia

.exe 3.9MB

2024-08-16_6324f5821646d4f77e0074d7f84e1a64_floxif_mafia

IMPHASH e0080e77b1ec1e40e0a4d23fb7045fbc
SHA256 211aa3b521e8d4a5eb1148c7c47752e002ddfe364aba3472606a7704634aaf9b
MD5 6324f5821646d4f77e0074d7f84e1a64
SHA1 2edc2ff51efdcebbf1bb2d9d471224f155b1e724
SHA512 e93e613ce31121f3dcfab61d87799fa35fb8127d6869ea8a628a3ef49dd86978426bcde02e2181b213ed0b588441d5af353da5713306696ef4c2912690c191f7
SSDEEP 98304:1g+ESjoa9kZ6DRwcEtzCyQWvKglLgeQ/Pn9rj+De0nzQUyk:1g+ESJ9k6bOvTgRn9rj+DoUb
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

31:a5:cf:16:76:89:66:7c:45:ad:da:f7:a6:26:ea:89:43:02:5c:2b

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Foxit Software Incorporated,O=Foxit Software Incorporated,L=Fremont,ST=California,C=US

Chains

Apr 9, 2018

CN=Foxit Software Incorporated,O=Foxit Software Incorporated,L=Fremont,ST=California,C=US

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Foxit Software Incorporated,O=Foxit Software Incorporated,L=Fremont,ST=California,C=US

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

1b:e7:15

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2014 - May 30, 2031

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 3, 2011 - May 3, 2031

Subject

CN=Foxit Software Incorporated,O=Foxit Software Incorporated,L=Fremont,ST=California,C=US

Serial Number

36:ac:03:7a:a8:1d:63:fd

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 28, 2017 - Aug 25, 2020

Minor OS version

Major OS version

Entry point

1333661

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

kernel32

UnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCPInfo GetOEMCP IsValidCodePage GetStringTypeW LCMapStringW GetConsoleCP GetConsoleMode GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleW GetDriveTypeW GetProcessHeap SetEnvironmentVariableA GetStdHandle lstrcpynW IsProcessorFeaturePresent SetFilePointerEx LoadLibraryA QueryPerformanceCounter HeapCreate SetHandleCount SizeofResource LockResource LoadResource FindResourceW GetEnvironmentStringsW FreeEnvironmentStringsW MultiByteToWideChar SetUnhandledExceptionFilter GetModuleFileNameW GetTimeZoneInformation lstrcmpW GetModuleHandleW Sleep FindClose SetFileAttributesW CreateDirectoryW FindFirstFileW CloseHandle Process32NextW Process32FirstW CreateToolhelp32Snapshot RemoveDirectoryW DeleteFileW CopyFileW GetVersion FreeLibrary GetProcAddress LoadLibraryW GetCurrentThreadId GlobalAlloc GetTempPathW ReleaseMutex WaitForSingleObject GetLastError SetLastError CreateMutexW ResumeThread SuspendThread CreateEventW SetEvent GetExitCodeThread GetTickCount CreateFileA CreateFileW ReadFile WriteFile SetFilePointer GetFileSize VirtualAlloc VirtualFree GetVersionExW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ResetEvent CreateSemaphoreW ReleaseSemaphore InitializeCriticalSection VirtualQuery GetSystemInfo HeapQueryInformation HeapSize GetFileType SetStdHandle HeapReAlloc ExitProcess GetDateFormatW GetTimeFormatW TerminateThread GetShortPathNameW lstrlenW CreateThread GetCurrentProcess GetTempFileNameW GetACP GetExitCodeProcess GetFileAttributesW WideCharToMultiByte FileTimeToSystemTime FileTimeToLocalFileTime GetWindowsDirectoryW CreateProcessW lstrcpyW ExitThread HeapFree HeapAlloc DecodePointer EncodePointer GetSystemTimeAsFileTime RaiseException RtlUnwind GetStartupInfoW HeapSetInformation GetCommandLineW FindResourceExW GetUserDefaultLCID VirtualProtect SearchPathW GetProfileIntW GetNumberFormatW SetErrorMode GetModuleHandleA OutputDebugStringW GetPrivateProfileStringW GetCurrentDirectoryW GetSystemDirectoryW GlobalFlags GetFileTime GetFileSizeEx GetFileAttributesExW GlobalGetAtomNameW InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue GetCurrentProcessId GetFullPathNameW GetVolumeInformationW DuplicateHandle SetEndOfFile UnlockFile LockFile FlushFileBuffers lstrcmpiW GetThreadLocale FindNextFileW WritePrivateProfileStringW GetPrivateProfileIntW GetCurrentThread GetUserDefaultUILanguage ConvertDefaultLocale GetSystemDefaultUILanguage GetLocaleInfoW LoadLibraryExW InterlockedExchange InterlockedDecrement ReleaseActCtx CreateActCtxW FreeResource GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW InitializeCriticalSectionAndSpinCount ActivateActCtx DeactivateActCtx SetThreadPriority lstrlenA lstrcmpA GlobalFree GlobalSize GlobalLock GlobalUnlock FormatMessageW MulDiv LocalAlloc LocalFree

user32

EnumChildWindows GetWindowRgn DrawIcon SubtractRect MapVirtualKeyExW IsCharLowerW GetDoubleClickTime CharUpperBuffW EmptyClipboard CloseClipboard SetClipboardData OpenClipboard GetUpdateRect FrameRect IsClipboardFormatAvailable PostThreadMessageW CreateMenu TranslateMDISysAccel DrawMenuBar DefMDIChildProcW DefFrameProcW RegisterClipboardFormatW UnpackDDElParam ReuseDDElParam InsertMenuItemW TranslateAcceleratorW SetMenuDefaultItem IsMenu MonitorFromPoint UpdateLayeredWindow UnionRect GetIconInfo EnableScrollBar HideCaret InvertRect GetMenuDefaultItem LockWindowUpdate SetCursorPos CreateAcceleratorTableW LoadAcceleratorsW GetKeyboardState GetKeyboardLayout ToUnicodeEx DrawFocusRect DrawFrameControl DrawEdge DrawIconEx SetClassLongW GetAsyncKeyState NotifyWinEvent CreatePopupMenu DestroyAcceleratorTable SetParent SetWindowRgn IsZoomed GetNextDlgGroupItem InvalidateRgn SetRect IsRectEmpty CopyAcceleratorTableW OffsetRect CharNextW DestroyIcon IsIconic WaitMessage KillTimer SetTimer DeleteMenu UnregisterClassW SetLayeredWindowAttributes EnumDisplayMonitors SetRectEmpty CopyImage RealChildWindowFromPoint GetSysColorBrush WindowFromPoint IntersectRect DestroyMenu GetMenuItemInfoW CharUpperW MapVirtualKeyW GetKeyNameTextW SetWindowContextHelpId MapDialogRect ShowOwnedPopups PostQuitMessage DrawStateW GetDesktopWindow CreateDialogIndirectParamW GetNextDlgTabItem EndDialog IsWindowEnabled ShowWindow MoveWindow SetWindowTextW CallWindowProcW DefWindowProcW GetDlgCtrlID EnableWindow LoadStringW IsDialogMessageW CheckRadioButton CheckDlgButton SetMenuItemBitmaps GetMenuCheckMarkDimensions ModifyMenuW CheckMenuItem RegisterWindowMessageW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetFocus SetFocus GetWindowTextLengthW GetWindowTextW GetLastActivePopup BeginDeferWindowPos EndDeferWindowPos GetDlgItem GetTopWindow DestroyWindow GetMessageTime MonitorFromWindow GetMonitorInfoW MapWindowPoints ScrollWindow TrackPopupMenu SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos ShowScrollBar CreateWindowExW GetClassInfoExW RegisterClassW AdjustWindowRectEx EqualRect DeferWindowPos GetScrollInfo SetScrollInfo SetWindowPlacement wsprintfW SetMenuItemInfoW SendMessageW GetClientRect UpdateWindow SetActiveWindow SetForegroundWindow LoadIconW PostMessageW LoadImageW GetSystemMetrics GetCursorPos GetDC FindWindowW UnhookWindowsHookEx SetDlgItemTextW MessageBoxW SetWindowsHookExW IsWindow GetClassInfoW EnableMenuItem GetSystemMenu GetWindowRect GetMenuStringW GetSubMenu LoadMenuW ReleaseDC SystemParametersInfoW GetMessagePos AttachThreadInput GetWindowThreadProcessId GetForegroundWindow LoadBitmapW ScreenToClient GetSysColor IsWindowVisible BringWindowToTop PtInRect InflateRect InvalidateRect RedrawWindow SetCapture GetParent ReleaseCapture SetCursor GetWindowPlacement CopyIcon LoadCursorW SetWindowLongW DestroyCursor MessageBeep RemoveMenu GetMenuItemCount InsertMenuW GetMenuItemID AppendMenuW GetMenuState ValidateRect PeekMessageW GetKeyState GetActiveWindow DispatchMessageW TranslateMessage GetMessageW CallNextHookEx FillRect TabbedTextOutW DrawTextW DrawTextExW GrayStringW ClientToScreen GetWindowDC BeginPaint EndPaint GetWindow CopyRect SetWindowPos GetWindowLongW GetMenu

gdi32

CreateRectRgnIndirect CreateCompatibleBitmap CreateFontW SelectObject GetTextExtentPoint32W DeleteObject GetDeviceCaps CreateFontIndirectW SelectClipRgn CreateRectRgn GetViewportExtEx GetWindowExtEx GetPixel PtVisible RectVisible TextOutW ExtTextOutW Escape SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn DeleteDC CreatePatternBrush CreateBitmap SelectPalette GetObjectType CreatePen CreateSolidBrush CreateHatchBrush PatBlt SetRectRgn CombineRgn BitBlt DPtoLP CreateCompatibleDC GetTextMetricsW EnumFontFamiliesW GetTextCharsetInfo GetTextColor GetRgnBox CreateDIBSection CreateRoundRectRgn CreatePolygonRgn CreateEllipticRgn Polyline Ellipse Polygon CreatePalette GetPaletteEntries GetNearestPaletteIndex RealizePalette GetSystemPaletteEntries OffsetRgn SetDIBColorTable SetPixel Rectangle EnumFontFamiliesExW LPtoDP GetWindowOrgEx GetViewportOrgEx PtInRegion FillRgn FrameRgn GetBoundsRect ExtFloodFill SetPaletteEntries GetTextFaceW SetPixelV CreateDIBitmap GetBkColor StretchBlt GetStockObject CopyMetaFileW CreateDCW SaveDC RestoreDC SetBkColor SetBkMode SetPolyFillMode SetROP2 SetTextColor SetMapMode GetClipBox ExcludeClipRect IntersectClipRect LineTo MoveToEx SetTextAlign GetLayout SetLayout GetMapMode GetObjectW

msimg32

TransparentBlt AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

RegCloseKey RegOpenKeyExA RegOpenKeyExW RegEnumKeyExA RegDeleteValueW RegDeleteKeyW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW RegQueryValueW RegEnumKeyW RegOpenKeyW RegSetValueExW RegQueryValueExW RegCreateKeyExW RegQueryValueExA

shell32

SHBrowseForFolderW ShellExecuteW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetFileInfoW Shell_NotifyIconW SHGetDesktopFolder DragFinish DragQueryFileW ShellExecuteExW SHAppBarMessage

comctl32

ImageList_GetIconSize

shlwapi

PathFileExistsW UrlUnescapeW PathRemoveFileSpecW PathFindExtensionW PathFindFileNameW PathStripToRootW PathIsUNCW StrCmpW

ole32

OleLockRunning RevokeDragDrop OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor IsAccelerator CoLockObjectExternal RegisterDragDrop OleGetClipboard CoRegisterMessageFilter CoRevokeClassObject DoDragDrop OleFlushClipboard OleIsCurrentClipboard CreateStreamOnHGlobal OleInitialize CoFreeUnusedLibraries OleUninitialize CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CLSIDFromString CLSIDFromProgID CoInitializeEx CoCreateInstance OleDuplicateData CoTaskMemAlloc ReleaseStgMedium CoTaskMemFree CoInitialize CoCreateGuid CoUninitialize

oleaut32

OleCreateFontIndirect VarBstrFromDate SysStringLen SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy SysFreeString SysAllocStringLen VariantClear VariantChangeType VariantInit SysAllocString VariantCopy

oledlg

OleUIBusyW

wininet

InternetQueryDataAvailable InternetSetFilePointer InternetSetStatusCallbackW InternetGetLastResponseInfoW InternetSetOptionExW InternetAttemptConnect InternetConnectW InternetOpenW InternetCloseHandle HttpSendRequestW HttpAddRequestHeadersW HttpOpenRequestW InternetReadFile HttpQueryInfoW HttpEndRequestW InternetWriteFile HttpSendRequestExW InternetCrackUrlW InternetCanonicalizeUrlW

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpSetTimeouts WinHttpConnect WinHttpCloseHandle WinHttpOpenRequest WinHttpSetOption WinHttpSendRequest WinHttpQueryHeaders WinHttpReadData WinHttpGetIEProxyConfigForCurrentUser WinHttpCrackUrl

dbghelp

MakeSureDirectoryPathExists

iphlpapi

GetAdaptersInfo GetNetworkParams

msi

ord205

oleacc

LresultFromObject AccessibleObjectFromWindow CreateStdAccessibleObject

gdiplus

GdipGetImageGraphicsContext GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipDrawImageI GdipGetImageWidth GdipCloneImage GdipDrawImageRectI GdipSetInterpolationMode GdiplusShutdown GdiplusStartup GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipDeleteGraphics GdipAlloc GdipFree GdipCreateFromHDC GdipGetImageHeight

imm32

ImmGetContext ImmReleaseContext ImmGetOpenStatus

winmm

PlaySoundW

Sharing

General

Malware Config

Signatures

File Explorer

2024-08-16_6324f5821646d4f77e0074d7f84e1a64_floxif_mafia

PE Signature issue

version

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

wininet

winhttp

dbghelp

iphlpapi

msi

oleacc

gdiplus

imm32

winmm

generic