2024-08-23_87df280b5f5f3025c045d997f71a1b0d_floxif_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2024-08-23_87df280b5f5f3025c045d997f71a1b0d_floxif_mafia
Size 1.3MB
Sample240823-19vclssdml
SHA256 f512e8c89f5ec4ad09dea104d188114a3cca59ad0bba65584f235cdd4c18c1cb
MD5 87df280b5f5f3025c045d997f71a1b0d
SHA1 1040f08e9ee697706d577c880e12f5608c490758
SHA512 ff55ae5d2aaa4f5917b89b1e99c6d5a77eb05ddaff9f6e02a3f27053fdbb0bb7e20c14a6e35212a35f0c959d47703cef1700f479e1ee6b7264b2f5571cac9044
SSDEEP 24576:1N3fdbAW7ccXOrWGegpJ6q5kFetRIC5fYoPGrEH7t:1NvdgbWGeOJxj5fYoPH
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-08-23_87df280b5f5f3025c045d997f71a1b0d_floxif_mafia

.exe 1.3MB

2024-08-23_87df280b5f5f3025c045d997f71a1b0d_floxif_mafia

IMPHASH 86003c972530424ba3b36b02f93ed7bb
SHA256 f512e8c89f5ec4ad09dea104d188114a3cca59ad0bba65584f235cdd4c18c1cb
MD5 87df280b5f5f3025c045d997f71a1b0d
SHA1 1040f08e9ee697706d577c880e12f5608c490758
SHA512 ff55ae5d2aaa4f5917b89b1e99c6d5a77eb05ddaff9f6e02a3f27053fdbb0bb7e20c14a6e35212a35f0c959d47703cef1700f479e1ee6b7264b2f5571cac9044
SSDEEP 24576:1N3fdbAW7ccXOrWGegpJ6q5kFetRIC5fYoPGrEH7t:1NvdgbWGeOJxj5fYoPH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

62:ab:e1:b3:02:ef:51:32:0e:c3:43:2d:23:be:a7:05:1f:21:82:40:73:9b:af:87:b9:52:5a:c7:23:09:8c:ec

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Piriform Ltd,O=Piriform Ltd,L=London,C=GB

Chains

Aug 22, 2024

PE Signature issue

Digest

18:7a:e7:0c:b5:35:d4:1b:44:5a:85:4e:a1:1a:b0:48:a9:3a:7c:57

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Piriform Ltd,O=Piriform Ltd,L=London,C=GB

Chains

May 2, 2018

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=Piriform Ltd,O=Piriform Ltd,L=London,C=GB

Serial Number

3d:3c:45:5a:5c:7b:7b:26:66:91:5e:b2:18:57:d7:ea

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 20, 2017 - Oct 11, 2018

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Piriform Ltd,O=Piriform Ltd,L=London,C=GB

Serial Number

52:b6:a8:14:74:e8:04:89:20:f1:90:9e:45:4d:7f:c0

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 20, 2017 - Oct 11, 2018

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Serial Number

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 4, 2017 - Jan 18, 2028

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

353676

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\BUILD\work\01\cde5c69121bcb0b1\bin\DefragglerCmd\Release\df.pdb

kernel32

GetCurrentThreadId WideCharToMultiByte GetLocalTime GetStdHandle WriteConsoleW SetConsoleTextAttribute DeleteCriticalSection GlobalMemoryStatusEx GetVersionExW GetSystemInfo GetComputerNameExW GetCommandLineW GetHandleInformation WaitForMultipleObjects ResetEvent LoadLibraryW CreateFileW GetTempPathW InitializeCriticalSectionAndSpinCount LocalFree FindClose SetEvent lstrlenW FindNextFileW CreateProcessW GetExitCodeProcess GetCurrentDirectoryW MultiByteToWideChar GetCurrentProcessId SetUnhandledExceptionFilter FormatMessageW LeaveCriticalSection EnterCriticalSection WritePrivateProfileStringW GetPrivateProfileStringW WritePrivateProfileStructW GetPrivateProfileStructW SetEnvironmentVariableA GetTimeZoneInformation WriteFile FlushFileBuffers WaitForSingleObject FindResourceExW FindResourceW LoadResource LockResource SizeofResource FreeLibrary GetLastError CreateEventW SetLastError GetCurrentThread CompareStringW GetDateFormatA GetTimeFormatA GetModuleFileNameW GetFullPathNameW GetModuleHandleW GetProcAddress GetCurrentProcess TerminateProcess FindFirstFileW CloseHandle LoadLibraryA SetStdHandle GetConsoleMode GetConsoleCP HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetStartupInfoW GetFileType SetHandleCount IsValidLocale EnumSystemLocalesA OpenEventW GetLocaleInfoW GetNumberFormatW InitializeCriticalSection GetTickCount DeviceIoControl GetFileInformationByHandle GetFileAttributesW VirtualAlloc VirtualFree GetDriveTypeW GetVolumePathNamesForVolumeNameW GetVolumePathNameW SetErrorMode FindFirstVolumeW FindNextVolumeW FindVolumeClose GetLogicalDrives GetDiskFreeSpaceExW GetVolumeInformationW QueryDosDeviceW GetVolumeNameForVolumeMountPointW QueryPerformanceCounter QueryPerformanceFrequency CreateMutexW GetDiskFreeSpaceW SetThreadPriority Sleep DeleteFileW InterlockedIncrement GetFileAttributesExW GetEnvironmentVariableW GetThreadContext ReadProcessMemory GetEnvironmentVariableA GetModuleFileNameA GetCurrentDirectoryA OutputDebugStringA GetVersionExA SuspendThread ResumeThread OpenProcess OpenMutexW SystemTimeToFileTime ReadFile SetFilePointer GetFileSize GetFileSizeEx SetFilePointerEx CreatePipe DuplicateHandle GetOverlappedResult GetSystemTime HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap RaiseException InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW GetModuleHandleA AreFileApisANSI FormatMessageA ExitThread CreateThread HeapSetInformation GetSystemTimeAsFileTime RtlUnwind GetCPInfo LCMapStringW UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetUserDefaultLCID GetLocaleInfoA

user32

DestroyIcon GetSystemMetrics

advapi32

InitializeSecurityDescriptor LookupPrivilegeValueW AdjustTokenPrivileges GetUserNameA RegSetValueExW RegCreateKeyExW RegDeleteValueW RegQueryValueExW RegQueryInfoKeyW OpenProcessToken InitiateSystemShutdownW RegEnumKeyExW RegDeleteKeyW RegOpenKeyExW RegCloseKey GetUserNameW SetSecurityDescriptorDacl

shell32

CommandLineToArgvW SHGetFileInfoW ord680

ole32

CoCreateInstance CoInitializeEx CoUninitialize

shlwapi

PathRemoveFileSpecW PathCombineW PathMatchSpecW PathIsDirectoryW PathIsRootW PathRemoveExtensionW PathStripPathW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeA GetFileVersionInfoA

psapi

EnumProcessModules GetProcessImageFileNameW GetModuleFileNameExW EnumProcesses

Sharing

General

Malware Config

Signatures

File Explorer

2024-08-23_87df280b5f5f3025c045d997f71a1b0d_floxif_mafia

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

shlwapi

version

psapi

generic