2024-08-21_e5448208688b7fd33163ddbad9320f90_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-21_e5448208688b7fd33163ddbad9320f90_mafia
Size

5.1MB
MD5

e5448208688b7fd33163ddbad9320f90
SHA1

aed471d76b1121df840750f9b3308bfd8c100715
SHA256

1cd3de8583ba69733862174ccef3885669005905b984b4173ee376b04fd3e5c0
SHA512

829c34b6e05a222b8deb7bb080fd7c8fc67ae8ea4d5632cf7e11fd4f8a79e1bc8ee84f518b41b53e81caa8de5180d4a7b740e471e962be3eae211c0dd7477e84
SSDEEP

98304:L7m9xU1PYsqigLBOxtCagafBahPaWWPCXRLPR0Lapp:L7m9oM85caWWPCXjcc

Score

1^/10

Malware Config

Signatures

Files

2024-08-21_e5448208688b7fd33163ddbad9320f90_mafia
.exe windows:5 windows x86 arch:x86

1d499c58107076d0bb52148350919619

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:04:87:2b:6c:6c:c2:41:a7:bd:a2:63:b7:a5:02:95
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

14/06/2012, 00:00

Not After

14/06/2014, 23:59

Subject

CN=SpectorSoft Corp.,OU=SECURE APPLICATION DEVELOPMENT,O=SpectorSoft Corp.,L=Vero Beach,ST=Florida,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:62:ea:79:09:10:60:09:7e:dc:2c:73:7e:fe:16:78:1e:70:fa:31
Signer

Actual PE Digest

69:62:ea:79:09:10:60:09:7e:dc:2c:73:7e:fe:16:78:1e:70:fa:31

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

ebsetup.pdb

Imports

comctl32

InitCommonControlsEx
PropertySheetA

wininet

InternetGetConnectedState
InternetAttemptConnect
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetGetLastResponseInfoA
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCloseHandle

kernel32

GetTimeZoneInformation
MulDiv
ResumeThread
GetCommandLineA
GetCurrentThreadId
SetFileAttributesA
GetFileAttributesA
ReleaseSemaphore
CreateSemaphoreA
OpenSemaphoreA
FileTimeToDosDateTime
FlushFileBuffers
InterlockedCompareExchange
InterlockedIncrement
OutputDebugStringA
HeapAlloc
HeapFree
HeapCreate
HeapDestroy
GetCurrentProcessId
ResetEvent
GetDiskFreeSpaceA
SetLastError
FormatMessageA
GetNumberFormatA
GetLocaleInfoA
IsBadWritePtr
IsBadReadPtr
IsBadStringPtrA
FindNextFileW
FindFirstFileW
ExpandEnvironmentStringsW
GetComputerNameW
LocalFree
GetSystemInfo
LocalAlloc
GetFullPathNameA
GetProcessHeap
GetThreadPriority
GetShortPathNameA
GetExitCodeProcess
VirtualProtect
GlobalFree
LocalFileTimeToFileTime
SystemTimeToTzSpecificLocalTime
RaiseException
InitializeCriticalSectionAndSpinCount
Process32Next
Process32First
CreateToolhelp32Snapshot
GlobalSize
CreateEventW
lstrlenW
lstrcmpiA
IsDBCSLeadByte
FlushInstructionCache
lstrcmpA
LoadLibraryExA
GetUserDefaultLCID
HeapReAlloc
SetCurrentDirectoryW
SetErrorMode
PeekNamedPipe
GetFileInformationByHandle
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryW
InterlockedExchange
SetConsoleCtrlHandler
FatalAppExitA
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
HeapSize
GetStringTypeW
LCMapStringW
GetLocaleInfoW
IsValidCodePage
GetOEMCP
GetCPInfo
GetModuleFileNameW
GetStdHandle
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
FindFirstFileExA
GetDateFormatA
GetTimeFormatA
GetStartupInfoW
HeapSetInformation
ExitProcess
CreateThread
ExitThread
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
VirtualQuery
GetModuleHandleW
RtlUnwind
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
RemoveDirectoryA
ExpandEnvironmentStringsA
SetEnvironmentVariableA
CompareStringW
CreateFileW
GetDriveTypeW
SetStdHandle
WriteConsoleW
IsValidLocale
EnumSystemLocalesA
MultiByteToWideChar
lstrlenA
LockResource
SizeofResource
LoadResource
CreateMutexA
OpenMutexA
ReleaseMutex
GetLocalTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetCurrentProcess
TerminateThread
CreateDirectoryA
SetEndOfFile
GetFileTime
LeaveCriticalSection
EnterCriticalSection
MoveFileA
GetTickCount
GetWindowsDirectoryA
FindFirstFileA
FindNextFileA
FindClose
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetComputerNameA
GetACP
DeleteCriticalSection
CreateEventA
WaitForMultipleObjects
SetEvent
WaitForSingleObject
DeviceIoControl
InitializeCriticalSection
WideCharToMultiByte
GetPrivateProfileStringA
GlobalAlloc
GlobalLock
GlobalUnlock
CreateProcessA
GetDiskFreeSpaceExA
GetSystemDirectoryA
SetFilePointer
CopyFileA
BeginUpdateResourceA
UpdateResourceA
EndUpdateResourceA
GetVersion
GetCurrentDirectoryA
SetCurrentDirectoryA
GetDriveTypeA
FindResourceA
GetVersionExA
GetTempFileNameA
GetSystemTime
SystemTimeToFileTime
SetFileTime
CreateFileA
ReadFile
GetModuleFileNameA
GetFileSize
WriteFile
GetTempPathA
DeleteFileA
GetModuleHandleA
Sleep
OpenProcess
CloseHandle
TerminateProcess
GetLastError
LoadLibraryA
GetProcAddress
FreeLibrary
InterlockedDecrement
GetCurrentDirectoryW

user32

SetProcessWindowStation
CloseWindowStation
SetCapture
GetCapture
ReleaseCapture
RedrawWindow
DeferWindowPos
LoadBitmapA
RegisterClassExA
GetFocus
BeginDeferWindowPos
EndDeferWindowPos
LoadMenuA
GetSubMenu
RemoveMenu
TrackPopupMenuEx
CreateDesktopA
CloseDesktop
ExitWindowsEx
CharPrevA
CharNextA
MapVirtualKeyExA
GetWindow
CreateWindowExW
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMenu
EnableMenuItem
ClientToScreen
CloseWindow
PeekMessageA
LoadStringA
CharToOemA
UnregisterClassA
SetWindowsHookExA
GetMessageA
TranslateMessage
DispatchMessageA
IsDialogMessageA
UnhookWindowsHookEx
LoadIconA
RegisterClassA
PostQuitMessage
DefWindowProcA
EnumThreadWindows
CallNextHookEx
GetDlgCtrlID
DrawFrameControl
DrawFocusRect
UpdateWindow
PtInRect
SetScrollRange
GetScrollPos
GetScrollInfo
SetScrollPos
SetThreadDesktop
ShowCursor
AdjustWindowRectEx
ActivateKeyboardLayout
CharLowerA
EnumChildWindows
CreateWindowExA
SendMessageW
InvalidateRect
GetWindowTextLengthA
FrameRect
InflateRect
DrawEdge
GetSysColor
SetRect
IsWindow
BeginPaint
EndPaint
CreateDialogParamA
SetParent
GetSystemMetrics
LoadCursorA
SetCursor
RemovePropA
GetSysColorBrush
GetUserObjectInformationA
OpenWindowStationA
GetThreadDesktop
GetProcessWindowStation
OpenInputDesktop
OpenDesktopA
WinHelpA
SendMessageA
GetWindowThreadProcessId
GetClassNameA
OemToCharA
FindWindowA
EnumWindows
MessageBoxA
GetForegroundWindow
OffsetRect
DrawTextA
GetClientRect
CheckDlgButton
IsDlgButtonChecked
EnableWindow
GetDlgItem
SetDlgItemTextA
GetDlgItemTextA
ShowWindow
GetAsyncKeyState
DestroyMenu
DestroyWindow
FillRect
ReleaseDC
LoadImageA
GetParent
GetClipboardData
MessageBeep
SetPropA
SetTimer
GetPropA
GetKeyState
GetDC
MoveWindow
EndDialog
RegisterWindowMessageA
GetClassLongA
CreateAcceleratorTableA
GetClassInfoExA
GetDesktopWindow
DestroyAcceleratorTable
IsChild
SetWindowTextW
InvalidateRgn
CloseClipboard
RegisterClipboardFormatA
GetWindowTextA
LoadKeyboardLayoutA
GetTopWindow
SetClipboardData
EmptyClipboard
SetForegroundWindow
KillTimer
IsWindowVisible
SetDlgItemInt
IsWindowEnabled
GetDlgItemInt
GetWindowRect
ScreenToClient
SetWindowPos
DialogBoxParamA
SendDlgItemMessageA
GetKeyboardLayout
ToAsciiEx
MapVirtualKeyA
EnumDisplaySettingsA
GetKeyNameTextA
wsprintfW
wsprintfA
CheckRadioButton
SetFocus
PostMessageA
GetWindowLongA
SetWindowLongA
SetWindowTextA
CallWindowProcA
CreatePopupMenu
AppendMenuA
GetCursorPos
TrackPopupMenu
OpenClipboard

gdi32

GetTextMetricsA
GetClipBox
GetDCOrgEx
TranslateCharsetInfo
CreateBitmap
StartDocA
StartPage
SetWindowExtEx
SetViewportExtEx
EndPage
EndDoc
CreateFontA
PatBlt
Ellipse
Pie
GetTextExtentPointA
TextOutA
CreateDCA
CreateDIBSection
CreatePen
MoveToEx
LineTo
CreateCompatibleBitmap
GetStockObject
BitBlt
CreateBrushIndirect
GetDeviceCaps
CreatePatternBrush
CreateCompatibleDC
DPtoLP
GetMapMode
SetMapMode
StretchBlt
DeleteDC
GetObjectA
CreateSolidBrush
GetTextExtentPoint32A
CreateFontIndirectA
SelectObject
SetBkColor
SetBkMode
SetTextColor
DeleteObject

comdlg32

GetSaveFileNameA
PrintDlgA
GetOpenFileNameA

advapi32

InitiateSystemShutdownA
RegSetValueExA
RegQueryInfoKeyW
RegSetKeySecurity
RegGetKeySecurity
RevertToSelf
CreateProcessAsUserA
GetSidLengthRequired
LookupAccountSidA
ImpersonateLoggedOnUser
DuplicateToken
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSecurityInfo
SetEntriesInAclA
RegConnectRegistryA
RegDeleteKeyA
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCloseKey
OpenProcessToken
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenServiceA
DeleteService
GetUserNameA
OpenSCManagerA
EnumServicesStatusW
CloseServiceHandle
RegEnumKeyExA
RegCreateKeyExA
RegQueryInfoKeyA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegOpenKeyExA
RegEnumValueA
RegQueryValueExA
RegDeleteValueA

shell32

SHGetMalloc
ShellExecuteExA
SHBrowseForFolderA
ShellExecuteA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ShellExecuteW

ole32

CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
StringFromCLSID
CoCreateGuid
CoInitializeEx
CoInitialize
CoUninitialize
CoCreateInstance
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoInitializeSecurity
CoSetProxyBlanket
CoTaskMemFree

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantInit
SysAllocStringLen
SysStringLen
VarUI4FromStr
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo

shlwapi

PathFileExistsA

rpcrt4

RpcMgmtStopServerListening
RpcServerUnregisterIf
RpcServerUseProtseqEpA
RpcServerRegisterIf
RpcServerListen
NdrServerCall2

userenv

ExpandEnvironmentStringsForUserW

psapi

GetModuleFileNameExA

urlmon

URLDownloadToFileA

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 430KB - Virtual size: 430KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1d499c58107076d0bb52148350919619

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

56:04:87:2b:6c:6c:c2:41:a7:bd:a2:63:b7:a5:02:95Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

69:62:ea:79:09:10:60:09:7e:dc:2c:73:7e:fe:16:78:1e:70:fa:31Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

rpcrt4

userenv

psapi

urlmon

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 430KB - Virtual size: 430KB

.data Size: 15KB - Virtual size: 43KB

.rsrc Size: 3.3MB - Virtual size: 3.3MB

.reloc Size: 95KB - Virtual size: 94KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

56:04:87:2b:6c:6c:c2:41:a7:bd:a2:63:b7:a5:02:95
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

69:62:ea:79:09:10:60:09:7e:dc:2c:73:7e:fe:16:78:1e:70:fa:31
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 430KB - Virtual size: 430KB

.data
Size: 15KB - Virtual size: 43KB

.rsrc
Size: 3.3MB - Virtual size: 3.3MB

.reloc
Size: 95KB - Virtual size: 94KB