2024-08-24_1eb3369760bd20cb5f272453e93da690_mafia_virut

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-24_1eb3369760bd20cb5f272453e93da690_mafia_virut
Size

1.6MB
MD5

1eb3369760bd20cb5f272453e93da690
SHA1

df839c1175f9f36c139f26abfff33da3abb4795a
SHA256

6a5e4ad8b585bffe4ce256e8b62652d618921fcbe572ea84234d670e124751ef
SHA512

b686e2b4e286c18fb83c2b72f28bd0645a5334ae2085f54df069b8f87c8e241cc22b3e062e51467ea70f6f99f8b7f544a85ad74229d1ac7f814cf835e1691f12
SSDEEP

12288:Psuj1ulT8VCpGXLjvet4RbMtFDvSyJDDy5soDXC9xwsDhldwyBj64kGWsMBu3D9Y:LyY7l0JC5sl3qavaH1QOehwKHL7T+

Score

1^/10

Malware Config

Signatures

Files

2024-08-24_1eb3369760bd20cb5f272453e93da690_mafia_virut
.exe windows:5 windows x86 arch:x86

963dc120184075745deb8ea105b3ab78

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

07/06/2012, 00:00

Not After

06/06/2022, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7a:a3:c9:8f:d9:67:40:97:2f:cf:87:25:37:3f:3e:50
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

17/07/2014, 00:00

Not After

17/07/2015, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems\, Incorporated,OU=Acrobat XI,O=Adobe Systems\, Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ef:c8:e1:fa:0a:19:28:42:de:55:49:d1:64:55:75:a8:7e:20:f4:9e
Signer

Actual PE Digest

ef:c8:e1:fa:0a:19:28:42:de:55:49:d1:64:55:75:a8:7e:20:f4:9e

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\CB\11X_MainQ\BuildResults\bin\Release\AcroExt\AcroExt.exe.pdb

Imports

kernel32

GetProcAddress
GetModuleHandleA
Sleep
LocalFree
FormatMessageA
GlobalAddAtomW
SetEvent
CreateSemaphoreA
CreateEventA
HeapAlloc
WaitForSingleObject
ReleaseSemaphore
HeapFree
SetDllDirectoryW
GetCommandLineW
CreateFileW
WaitNamedPipeW
GetLastError
CreateNamedPipeW
GetTickCount64
HeapSetInformation
GetVersionExW
GetProcessHeap
GetSystemTimeAsFileTime
GetSystemInfo
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
OpenProcess
DuplicateHandle
CloseHandle
GetCurrentProcessId
GetCurrentProcess
IsProcessInJob
InterlockedDecrement
InterlockedIncrement
SetEnvironmentVariableA
CreateFileA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
FlushFileBuffers
GetTimeZoneInformation
SetStdHandle
LocalAlloc
FreeLibrary
InterlockedExchange
LoadLibraryA
RaiseException
VirtualAllocEx
VirtualQueryEx
GetModuleHandleW
InterlockedCompareExchange
GetNativeSystemInfo
WriteProcessMemory
VirtualProtectEx
GetFileAttributesW
QueryDosDeviceW
GetLongPathNameW
GetTickCount
TerminateProcess
SetInformationJobObject
PostQueuedCompletionStatus
SetLastError
TerminateJobObject
GetCurrentThreadId
UnregisterWaitEx
GetQueuedCompletionStatus
ResetEvent
CreateThread
CreateEventW
CreateIoCompletionPort
RegisterWaitForSingleObject
GetProcessId
ReleaseMutex
CreateProcessW
GetModuleFileNameW
CreateMutexW
SetFilePointer
WriteFile
OutputDebugStringA
SignalObjectAndWait
SetHandleInformation
GetProcessHandleCount
VirtualFree
ResumeThread
LoadLibraryW
GetThreadContext
AssignProcessToJobObject
GetExitCodeProcess
MapViewOfFile
CreateFileMappingW
GetFileType
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
lstrlenW
VirtualFreeEx
CreateJobObjectW
GetModuleHandleExW
ProcessIdToSessionId
SearchPathW
QueryPerformanceCounter
QueryPerformanceFrequency
SystemTimeToFileTime
GetCurrentDirectoryW
DebugBreak
ReadProcessMemory
SuspendThread
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
InterlockedExchangeAdd
SetEndOfFile
DeviceIoControl
CreateDirectoryW
MultiByteToWideChar
AreFileApisANSI
WideCharToMultiByte
OpenEventA
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerA
DisconnectNamedPipe
ConnectNamedPipe
ReadFile
GetStringTypeW
EncodePointer
DecodePointer
GetLocaleInfoW
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlUnwind
HeapCreate
GetConsoleCP
GetConsoleMode
ExitProcess
HeapReAlloc
WriteConsoleW
GetStdHandle
GetCPInfo
ExitThread
LCMapStringW
GetTimeFormatA
GetDateFormatA
CompareStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
IsProcessorFeaturePresent
HeapSize
GetACP
GetOEMCP
IsValidCodePage

advapi32

RegCreateKeyExW
RevertToSelf
SetTokenInformation
GetLengthSid
ConvertStringSidToSidW
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
SetThreadToken
CreateProcessAsUserW
CreateRestrictedToken
DuplicateTokenEx
DuplicateToken
EqualSid
GetTokenInformation
LookupPrivilegeValueW
CopySid
CreateWellKnownSid
GetSecurityInfo
SetEntriesInAclW
RegOpenKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegDisablePredefinedCache

user32

GetUserObjectInformationW
GetThreadDesktop
SetProcessWindowStation
CreateDesktopW
GetProcessWindowStation
CreateWindowStationW
wsprintfW
CloseDesktop
CloseWindowStation
GetWindowThreadProcessId
GetClientRect
CreateWindowExW
LoadCursorW
RegisterClassExW
GetWindowLongW
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
FindWindowExW
SetPropW
BeginPaint
EndPaint
GetPropW
AllowSetForegroundWindow
GetParent
CallWindowProcW
DefWindowProcW
SetWindowLongW
SendMessageW
SetWindowPos
ShowWindow
PostMessageW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
MessageBoxW

libcef

cef_string_wide_to_utf8
cef_string_utf8_cmp
cef_string_utf8_set
cef_string_utf8_to_wide
cef_string_wide_clear
cef_string_utf8_clear
cef_string_userfree_utf8_free
cef_shutdown
cef_run_message_loop
cef_quit_message_loop
cef_currently_on
cef_add_cross_origin_whitelist_entry
cef_parse_url
cef_execute_process
cef_api_hash
cef_initialize
cef_get_path
cef_post_task
cef_register_extension
cef_string_list_free
cef_string_list_alloc
cef_cookie_manager_get_global_manager
cef_v8value_create_undefined
cef_v8value_create_null
cef_v8value_create_bool
cef_v8value_create_double
cef_v8value_create_string
cef_v8value_create_object_with_interceptor
cef_v8value_create_array
cef_v8value_create_function
cef_xml_reader_create
cef_stream_reader_create_for_file
cef_stream_reader_create_for_handler
cef_command_line_create
cef_command_line_get_global
cef_string_map_free
cef_string_map_alloc
cef_v8context_get_current_context
cef_browser_host_create_browser
cef_string_list_append
cef_string_map_append
cef_string_multimap_append
cef_string_list_value
cef_string_list_size
cef_string_map_value
cef_string_map_key
cef_string_map_size
cef_string_multimap_value
cef_string_multimap_key
cef_string_multimap_size
cef_zip_reader_create
cef_string_multimap_free
cef_string_multimap_alloc
cef_string_list_copy

winmm

timeGetTime

Sections

.text
Size: 764KB - Virtual size: 763KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 674KB - Virtual size: 674KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

963dc120184075745deb8ea105b3ab78

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59Certificate

Extended Key Usages

Key Usages

7a:a3:c9:8f:d9:67:40:97:2f:cf:87:25:37:3f:3e:50Certificate

Extended Key Usages

Key Usages

ef:c8:e1:fa:0a:19:28:42:de:55:49:d1:64:55:75:a8:7e:20:f4:9eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

user32

libcef

winmm

Sections

.text Size: 764KB - Virtual size: 763KB

.rdata Size: 180KB - Virtual size: 180KB

.data Size: 25KB - Virtual size: 39KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 674KB - Virtual size: 674KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

7a:a3:c9:8f:d9:67:40:97:2f:cf:87:25:37:3f:3e:50
Certificate

ef:c8:e1:fa:0a:19:28:42:de:55:49:d1:64:55:75:a8:7e:20:f4:9e
Signer

.text
Size: 764KB - Virtual size: 763KB

.rdata
Size: 180KB - Virtual size: 180KB

.data
Size: 25KB - Virtual size: 39KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 674KB - Virtual size: 674KB