2024-09-02_e8336d8b6da870b3e0b5e6aa57b209a9_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-09-02_e8336d8b6da870b3e0b5e6aa57b209a9_mafia
Size

768KB
MD5

e8336d8b6da870b3e0b5e6aa57b209a9
SHA1

61bed1261b35ef152d779751bae337a360c7c3b4
SHA256

344cf6fb1bda192ab43d38fac984953356391022022365fbfaeb2eb8cb235ad8
SHA512

d35255b92353838a4eac57cd4b8096824af6847181b87512895afc902d5bd93b4f5ab750dcdf1b400d6e9b68682506862645bfa9b8b02cf1102001c9ee07e8f3
SSDEEP

12288:+HHxAU+NGyUV7D+aCV+B/jo3xAGxOac2m+bZ4qPqZBghaylGCexxUTgYyb:CHxsGr5cV2/jo31AacPshPq3ZkGBnMyb

Score

1^/10

Malware Config

Signatures

Files

2024-09-02_e8336d8b6da870b3e0b5e6aa57b209a9_mafia
.exe windows:5 windows x86 arch:x86

a0d8816b5bf102aa369152b3d42e0381

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

40:4b:da:d0:a1:1e:76:83:8b:11:55:6f:af:5c:c2:5b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

19/02/2014, 00:00

Not After

19/04/2017, 23:59

Subject

CN=Zhuhai Kingsoft Office Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RD Department,O=Zhuhai Kingsoft Office Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

92:0c:49:c6:29:47:e3:9e:24:fc:01:4e:43:a0:d3:0f:44:ae:84:5b
Signer

Actual PE Digest

92:0c:49:c6:29:47:e3:9e:24:fc:01:4e:43:a0:d3:0f:44:ae:84:5b

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\wpsservice_trunk\Build\Release\WPSAddins\office6\KUninstall.pdb

Imports

kernel32

FreeLibrary
LoadLibraryW
lstrlenA
GetCurrentThreadId
FreeResource
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
WritePrivateProfileStringW
GetPrivateProfileStringW
Process32NextW
GetCurrentProcessId
Process32FirstW
CreateToolhelp32Snapshot
SetCurrentDirectoryW
GetModuleFileNameW
GetLongPathNameW
OpenProcess
QueryDosDeviceW
TerminateProcess
ProcessIdToSessionId
lstrcmpW
FileTimeToSystemTime
FileTimeToLocalFileTime
CreateThread
GetLocalTime
Sleep
InitializeCriticalSectionAndSpinCount
MapViewOfFileEx
CreateMutexW
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
LoadLibraryExW
TerminateThread
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedCompareExchange
SetEnvironmentVariableA
CompareStringW
GetProcessHeap
GetDriveTypeW
WriteConsoleW
FlushFileBuffers
SetStdHandle
CreateFileA
GetFullPathNameA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
FlushInstructionCache
GetTimeZoneInformation
GetStringTypeW
GetConsoleMode
GetConsoleCP
HeapSize
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetLocaleInfoW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
QueryPerformanceCounter
HeapDestroy
HeapCreate
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetUnhandledExceptionFilter
FindFirstFileExA
GetDriveTypeA
ExitProcess
GetSystemTimeAsFileTime
HeapReAlloc
RtlUnwind
EncodePointer
DecodePointer
ExitThread
HeapFree
HeapAlloc
GetStartupInfoW
HeapSetInformation
GetCommandLineW
FormatMessageA
ExpandEnvironmentStringsA
LoadLibraryA
GetFileType
PeekNamedPipe
GetExitCodeThread
CreateMutexA
CreateEventA
ReleaseMutex
DuplicateHandle
SleepEx
RaiseException
GetVersion
SetLastError
GetCurrentProcess
GetModuleHandleW
GetProcAddress
GetSystemInfo
SetEndOfFile
SetFilePointer
GetTempFileNameW
GetTempPathW
GetCurrentDirectoryW
GetWindowsDirectoryW
MoveFileW
RemoveDirectoryW
SetFileAttributesW
WideCharToMultiByte
MultiByteToWideChar
WaitForMultipleObjects
GetStdHandle
ReadFile
CreateDirectoryW
GetTickCount
DeleteFileW
MoveFileExW
CopyFileW
GetSystemDirectoryW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
WriteFile
GetFileSize
FindResourceExW
VirtualAlloc
FindResourceW
LoadResource
LockResource
SizeofResource
lstrlenW
FindNextFileW
GetFileAttributesW
FindFirstFileW
FindClose
CreateFileW
GetFileInformationByHandle
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
WaitForSingleObject
CloseHandle
GetLastError
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetVersionExW
VirtualFree
InterlockedExchange

user32

SetWindowsHookExW
GetSystemMetrics
KillTimer
SetTimer
PostMessageW
RemoveMenu
ReleaseCapture
GetNextDlgTabItem
SetFocus
SetCapture
GetKeyState
WindowFromPoint
GetScrollPos
SetWindowRgn
GetClassInfoExW
LoadCursorW
CopyRect
SetRect
GetParent
GetWindow
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
IsWindow
IsChild
InvalidateRect
GetKeyNameTextW
ClientToScreen
OffsetRect
SetCursor
CallNextHookEx
CallWindowProcW
InflateRect
GetDlgItem
ShowWindow
IsDialogMessageW
GetFocus
ReleaseDC
GetDC
DispatchMessageW
UnregisterClassA
CharUpperW
CharLowerW
SetWindowLongW
CreateWindowExW
DestroyWindow
GetWindowLongW
SendMessageW
MoveWindow
SetWindowPos
GetWindowRect
TranslateMessage
GetMessageW
DrawIconEx
LoadIconW
DrawFrameControl
EqualRect
DestroyIcon
GetDlgCtrlID
PtInRect
PostThreadMessageW
SetRectEmpty
GetSystemMenu
EndPaint
BeginPaint
DrawTextW
IsWindowVisible
PostQuitMessage
PeekMessageW
MessageBoxW
DefWindowProcW
CharNextW
FindWindowW
GetActiveWindow
GetDesktopWindow
IsWindowEnabled
EnableWindow
GetForegroundWindow
GetWindowThreadProcessId
SystemParametersInfoW
AttachThreadInput
SetForegroundWindow
SetActiveWindow
LoadImageW
LoadBitmapW
RegisterClassExW
GetClientRect

gdi32

GetObjectW
CreateCompatibleDC
CreateDIBSection
BitBlt
DeleteDC
DeleteObject
CreateRectRgn
CreatePen
SetBkColor
ExtTextOutW
Rectangle
SelectClipRgn
SelectObject
RestoreDC
SaveDC
StretchBlt
CreateBitmap
CreateCompatibleBitmap
SetStretchBltMode
GetStockObject
CreateFontIndirectW
SetBkMode
CreateRectRgnIndirect
RectInRegion
RoundRect
GetClipRgn
MoveToEx
LineTo
TextOutW
GetTextExtentPoint32W
SetRectRgn
OffsetRgn
CreateSolidBrush
SetTextColor
CombineRgn

shell32

ord680
SHGetSpecialFolderPathW
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderLocation
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFolderPathW

ole32

CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
CreateStreamOnHGlobal
CoInitializeEx
CoTaskMemAlloc
CoTaskMemRealloc

oleaut32

VariantClear
SysAllocString
VarUI4FromStr
VariantCopy
SysFreeString

advapi32

OpenProcessToken
IsValidSid
GetTokenInformation
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
AdjustTokenPrivileges
RegSetValueExW
RegQueryInfoKeyW
ImpersonateLoggedOnUser
RegOpenCurrentUser
RevertToSelf
RegOpenKeyW
RegEnumValueW
RegDeleteValueW
EqualSid
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegEnumKeyExW
LookupPrivilegeValueW

shlwapi

PathAddBackslashW
ord176
StrToIntA
PathFileExistsW
StrToIntW

comctl32

InitCommonControlsEx
_TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdipDrawImageRectI
GdipDrawImageRectRectI
GdipCloneImage
GdipCreateBitmapFromStream
GdipCreateHBITMAPFromBitmap
GdiplusShutdown
GdiplusStartup
GdipLoadImageFromFile
GdipLoadImageFromFileICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCreateFromHDC
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipDeleteGraphics
GdipAlloc
GdipFree

ws2_32

ioctlsocket
select
__WSAFDIsSet
listen
accept
recvfrom
sendto
WSASetLastError
gethostbyname
socket
connect
setsockopt
WSACleanup
WSAStartup
closesocket
WSAGetLastError
recv
send
getsockname
ntohs
bind
htons
getsockopt

wldap32

ord33
ord200
ord79
ord35
ord301
ord27
ord41
ord46
ord32
ord30
ord26
ord50
ord60
ord143
ord211
ord22

Sections

.text
Size: 498KB - Virtual size: 498KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a0d8816b5bf102aa369152b3d42e0381

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

40:4b:da:d0:a1:1e:76:83:8b:11:55:6f:af:5c:c2:5bCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

92:0c:49:c6:29:47:e3:9e:24:fc:01:4e:43:a0:d3:0f:44:ae:84:5bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

shlwapi

comctl32

msimg32

gdiplus

ws2_32

wldap32

Sections

.text Size: 498KB - Virtual size: 498KB

.rdata Size: 105KB - Virtual size: 105KB

.data Size: 16KB - Virtual size: 34KB

.rsrc Size: 33KB - Virtual size: 32KB

.reloc Size: 114KB - Virtual size: 114KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

40:4b:da:d0:a1:1e:76:83:8b:11:55:6f:af:5c:c2:5b
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

92:0c:49:c6:29:47:e3:9e:24:fc:01:4e:43:a0:d3:0f:44:ae:84:5b
Signer

.text
Size: 498KB - Virtual size: 498KB

.rdata
Size: 105KB - Virtual size: 105KB

.data
Size: 16KB - Virtual size: 34KB

.rsrc
Size: 33KB - Virtual size: 32KB

.reloc
Size: 114KB - Virtual size: 114KB