2024-09-04_ffa206ea1594d11b3537bfb1f2bb8d60_floxif_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2024-09-04_ffa206ea1594d11b3537bfb1f2bb8d60_floxif_mafia
Size 2.5MB
Sample240904-pnwsrs1eqa
SHA256 0b51efc00bf7f85d324fbd1f5507891d81e0c580e22d0f960571498aecefe2f6
MD5 ffa206ea1594d11b3537bfb1f2bb8d60
SHA1 da4cf7a2e28b8b33ec4c6aad34bbfbfd05fd379b
SHA512 e8f55f2f1866327ebaddf7703e7eb8d756e5fef21568e578b01847163b864ab5b32f43e51b2df019cf35e707a79f8d15b4ac8a9a247c8739764f0a8b832518f7
SSDEEP 49152:XuIIKpofs2hPd2l177BTK2VbDsar1YDjI:Xjkfs2hPIl1/b
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-09-04_ffa206ea1594d11b3537bfb1f2bb8d60_floxif_mafia

.exe 2.5MB

2024-09-04_ffa206ea1594d11b3537bfb1f2bb8d60_floxif_mafia

IMPHASH 97f5c5cdc5e80758b7adff3a733244ad
SHA256 0b51efc00bf7f85d324fbd1f5507891d81e0c580e22d0f960571498aecefe2f6
MD5 ffa206ea1594d11b3537bfb1f2bb8d60
SHA1 da4cf7a2e28b8b33ec4c6aad34bbfbfd05fd379b
SHA512 e8f55f2f1866327ebaddf7703e7eb8d756e5fef21568e578b01847163b864ab5b32f43e51b2df019cf35e707a79f8d15b4ac8a9a247c8739764f0a8b832518f7
SSDEEP 49152:XuIIKpofs2hPd2l177BTK2VbDsar1YDjI:Xjkfs2hPIl1/b
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

ac:ae:2c:9f:d4:b6:74:13:01:70:e6:cc:8e:53:f8:77:3a:dc:4c:cb

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Chains

Oct 10, 2012

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Sep 30, 2010 - Jan 1, 2014

Subject

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Serial Number

09:e2:8b:26:db:59:3e:c4:e7:32:86:b6:64:99:c3:70

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 14, 2011 - Nov 13, 2014

Minor OS version

Major OS version

Entry point

1349317

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

p:\p\agents\hpam2.eem\recipes\201152726\base\branches\inputtools_win_release_branch\googleclient\ime\goopy\scons-out\opt\obj\components\win_frontend\ipc_console.pdb

advapi32

RegDeleteKeyW RegCloseKey RegQueryInfoKeyW RegEnumKeyExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegDeleteValueW ConvertSidToStringSidW GetLengthSid GetSecurityInfo CopySid GetUserNameW GetTokenInformation OpenProcessToken SetSecurityInfo GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenCurrentUser RegQueryValueExW RegNotifyChangeKeyValue GetSidSubAuthority GetSidSubAuthorityCount SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce InitializeAcl IsValidSid

kernel32

TerminateProcess GetModuleFileNameA IsDebuggerPresent GetCurrentThreadId OutputDebugStringA ReleaseMutex CloseHandle DebugBreak GetTempPathA GlobalAlloc LocalFree ResetEvent SetEvent WaitForMultipleObjects CreateThread Sleep GetVersionExW InterlockedCompareExchange GetSystemTimeAsFileTime SystemTimeToFileTime FileTimeToLocalFileTime FileTimeToSystemTime QueryPerformanceCounter FindFirstFileW FindNextFileW GetFullPathNameW DeleteFileW RemoveDirectoryW GetSystemTime LockResource FindResourceExW FindClose MulDiv SetProcessWorkingSetSize CreateTimerQueueTimer DeleteTimerQueueTimer CreateFileW GetTickCount WriteFile ExitThread LoadLibraryW GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile HeapAlloc HeapFree GetProcessHeap ConnectNamedPipe CreateNamedPipeW CancelIo ReadFile GetOverlappedResult FlushInstructionCache SetLastError InterlockedExchange EncodePointer DecodePointer HeapDestroy HeapReAlloc HeapSize InterlockedPushEntrySList IsProcessorFeaturePresent VirtualFree VirtualAlloc InterlockedPopEntrySList UnhandledExceptionFilter SetUnhandledExceptionFilter WideCharToMultiByte HeapSetInformation GetStartupInfoW ExitProcess VirtualProtect VirtualQuery RtlUnwind GetCPInfo LCMapStringW GetStdHandle HeapCreate GetLocaleInfoW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree GetACP GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode FlushFileBuffers GetTimeZoneInformation SetFilePointer GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleW SetStdHandle CreateFileA CompareStringW SetEnvironmentVariableA SetEndOfFile GetThreadLocale CopyFileW SetFileAttributesW GetTempPathW GetFileSizeEx CreateDirectoryW GetFileAttributesW GetCurrentDirectoryW CreateMutexW WaitForSingleObject GetCurrentProcess CreateProcessW GlobalFree GlobalLock GlobalUnlock SetThreadPriority ResumeThread OpenThread FormatMessageA GetModuleHandleA AllocConsole LoadLibraryA GetLongPathNameW GetTempFileNameW MoveFileW GetFileAttributesExW GetDiskFreeSpaceExW GetDriveTypeW GetUserDefaultUILanguage VerSetConditionMask VerifyVersionInfoW FindFirstFileExW GetFileInformationByHandle PeekNamedPipe GetDriveTypeA FindFirstFileExA GetFullPathNameA GetCommandLineW InitializeCriticalSection CreateEventW GetCurrentProcessId ProcessIdToSessionId InitializeCriticalSectionAndSpinCount LoadLibraryExW FindResourceW LoadResource GetFileSize SizeofResource RaiseException lstrcmpiW lstrlenW FreeLibrary GetModuleFileNameW GetProcAddress GetModuleHandleW GetLastError InterlockedDecrement InterlockedIncrement LeaveCriticalSection EnterCriticalSection DeleteCriticalSection MultiByteToWideChar

user32

SetWindowPos LoadCursorW DestroyMenu CreatePopupMenu TrackPopupMenu TrackPopupMenuEx GetShellWindow GetDC ReleaseDC AppendMenuW SetMenuItemBitmaps SendMessageW UnregisterClassA MoveWindow GetWindowRect BeginPaint EndPaint InvalidateRect InvalidateRgn ShowWindow IsWindowVisible CharNextW IsWindowEnabled SetCapture SetWindowRgn GetClassInfoExW SetRect TrackMouseEvent GetKeyState ReleaseCapture UpdateLayeredWindow OffsetRect SetCursor IntersectRect MessageBoxA wvsprintfW wsprintfW MessageBoxW IsWindow DispatchMessageW DefWindowProcW CreateWindowExW SetWindowLongW PeekMessageW GetWindowLongW RegisterClassExW TranslateMessage KillTimer PostMessageW PostQuitMessage GetMessageW SetTimer DestroyWindow GetMonitorInfoW SetWindowTextW GetCursorPos EndDialog GetDlgItem SetCursorPos GetForegroundWindow SetFocus DialogBoxParamW MonitorFromPoint ScreenToClient ClientToScreen

ole32

CoInitializeEx CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoInitialize CoUninitialize CoCreateGuid CreateStreamOnHGlobal

oleaut32

SysFreeString SysStringLen SysAllocString VarUI4FromStr

gdi32

EnumEnhMetaFile CloseEnhMetaFile CreateEnhMetaFileW GetCurrentObject GetFontUnicodeRanges GetTextMetricsW GetOutlineTextMetricsW GetObjectA AddFontMemResourceEx DeleteEnhMetaFile CreateFontIndirectW CreateRectRgn BitBlt CreateCompatibleDC DeleteDC CombineRgn ExtCreateRegion GetDIBits CreateDCW GetObjectW DeleteObject RemoveFontMemResourceEx SelectObject GetDeviceCaps CreateDIBSection

gdiplus

GdipCreateFromHDC GdipGraphicsClear GdiplusStartup GdipCloneImage GdipGetImageEncoders GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipGetImageEncodersSize GdipAlloc GdipCreateBitmapFromScan0 GdipFree GdipRestoreGraphics GdiplusShutdown GdipBitmapGetPixel GdipGetImagePixelFormat GdipDrawImageRectRectI GdipPrivateAddFontFile GdipDrawImageI GdipSetClipGraphics GdipCloneFontFamily GdipCreateRegion GdipDeleteRegion GdipSetEmpty GdipCombineRegionRect GdipDeleteGraphics GdipGetImageGraphicsContext GdipSetImageAttributesRemapTable GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipBitmapUnlockBits GdipBitmapLockBits GdipImageRotateFlip GdipGetImageHeight GdipGetImageWidth GdipDeleteFont GdipCreateBitmapFromStream GdipGetFontCollectionFamilyCount GdipGetFontCollectionFamilyList GdipNewPrivateFontCollection GdipDeletePrivateFontCollection GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawDriverString GdipFillRectangleI GdipCreateFontFamilyFromName GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipDeleteBrush GdipCloneBrush GdipCreateSolidFill GdipCreateTextureIAI GdipSetTextureWrapMode GdipCreatePen1 GdipDeletePen GdipGetPenWidth GdipSetCompositingQuality GdipSetTextRenderingHint GdipSetSmoothingMode GdipResetWorldTransform GdipTranslateWorldTransform GdipScaleWorldTransform GdipRotateWorldTransform GdipDrawLine GdipFillRectangle GdipDrawImageRectRect GdipSetClipRect GdipSetClipRegion GdipResetClip GdipSaveGraphics GdipCreateTextureIA GdipGetFamilyName GdipSaveImageToStream

winmm

timeGetTime

crypt32

CryptFindOIDInfo

shell32

SHCreateDirectoryExW ShellExecuteW SHGetFolderPathW SHFileOperationW SHGetSpecialFolderPathW

shlwapi

PathCanonicalizeW PathCombineW PathFileExistsW StrDupW PathFindExtensionW PathRemoveFileSpecW PathRemoveBackslashW PathIsDirectoryW PathIsRelativeW

secur32

CompleteAuthToken FreeCredentialsHandle AcquireCredentialsHandleA InitializeSecurityContextA DeleteSecurityContext QueryCredentialsAttributesW FreeContextBuffer QueryContextAttributesW DecryptMessage EncryptMessage ApplyControlToken AcquireCredentialsHandleW

usp10

ScriptItemize ScriptBreak ScriptShape ScriptStringFree ScriptStringOut ScriptStringAnalyse ScriptCPtoX ScriptLayout ScriptPlace ScriptFreeCache

ws2_32

getsockopt socket getsockname getpeername bind connect setsockopt send sendto recv recvfrom listen WSACloseEvent closesocket ioctlsocket WSAEnumNetworkEvents WSAGetLastError WSAWaitForMultipleEvents WSAEventSelect WSAStartup WSACleanup WSACreateEvent getaddrinfo freeaddrinfo WSAResetEvent WSASetEvent accept WSCEnumProtocols

wininet

InternetQueryOptionW

Sharing

General

Malware Config

Signatures

File Explorer

2024-09-04_ffa206ea1594d11b3537bfb1f2bb8d60_floxif_mafia

PE Signature issue

advapi32

kernel32

user32

ole32

oleaut32

gdi32

gdiplus

winmm

crypt32

shell32

shlwapi

secur32

usp10

ws2_32

wininet

generic