202409139b6fefe7d02e65fe8f6d5d3ea77c6cccfloxifmafia

Sharing

Copy URL Twitter E-mail

General

Target
202409139b6fefe7d02e65fe8f6d5d3ea77c6cccfloxifmafia
Size 2.5MB
Sample240913-v8sjqszeph
SHA256 12df5e552088d5b5eef4ea8cfdaea756b70f0c34c528df70dea977b6eb0e9b33
MD5 9b6fefe7d02e65fe8f6d5d3ea77c6ccc
SHA1 0572728234572764ec942907075340297573d959
SHA512 de6f21f89d2b5dde09ca8ddf2e4973d3a3fc89b8556c71855270243b3e7fce762cfaadd97d2f44d7235d45d795273d9f7bf78645709619548d4e368da1afb084
SSDEEP 49152:CuIIKjofs2hPd2l177BTK2VbDsar1YDj5:Cjmfs2hPIl1/G
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

202409139b6fefe7d02e65fe8f6d5d3ea77c6cccfloxifmafia

.exe 2.5MB

202409139b6fefe7d02e65fe8f6d5d3ea77c6cccfloxifmafia

IMPHASH 97f5c5cdc5e80758b7adff3a733244ad
SHA256 12df5e552088d5b5eef4ea8cfdaea756b70f0c34c528df70dea977b6eb0e9b33
MD5 9b6fefe7d02e65fe8f6d5d3ea77c6ccc
SHA1 0572728234572764ec942907075340297573d959
SHA512 de6f21f89d2b5dde09ca8ddf2e4973d3a3fc89b8556c71855270243b3e7fce762cfaadd97d2f44d7235d45d795273d9f7bf78645709619548d4e368da1afb084
SSDEEP 49152:CuIIKjofs2hPd2l177BTK2VbDsar1YDj5:Cjmfs2hPIl1/G
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

9e:5c:a3:67:5e:eb:bc:0c:4c:9f:2d:1e:c6:68:9e:29:12:f7:77:29

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Chains

Oct 10, 2012

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Sep 30, 2010 - Jan 1, 2014

Subject

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Serial Number

09:e2:8b:26:db:59:3e:c4:e7:32:86:b6:64:99:c3:70

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 14, 2011 - Nov 13, 2014

Minor OS version

Major OS version

Entry point

1349317

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

p:\p\agents\hpam2.eem\recipes\201152726\base\branches\inputtools_win_release_branch\googleclient\ime\goopy\scons-out\opt\obj\components\win_frontend\ipc_console.pdb

advapi32

RegDeleteKeyW RegCloseKey RegQueryInfoKeyW RegEnumKeyExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegDeleteValueW ConvertSidToStringSidW GetLengthSid GetSecurityInfo CopySid GetUserNameW GetTokenInformation OpenProcessToken SetSecurityInfo GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenCurrentUser RegQueryValueExW RegNotifyChangeKeyValue GetSidSubAuthority GetSidSubAuthorityCount SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce InitializeAcl IsValidSid

kernel32

TerminateProcess GetModuleFileNameA IsDebuggerPresent GetCurrentThreadId OutputDebugStringA ReleaseMutex CloseHandle DebugBreak GetTempPathA GlobalAlloc LocalFree ResetEvent SetEvent WaitForMultipleObjects CreateThread Sleep GetVersionExW InterlockedCompareExchange GetSystemTimeAsFileTime SystemTimeToFileTime FileTimeToLocalFileTime FileTimeToSystemTime QueryPerformanceCounter FindFirstFileW FindNextFileW GetFullPathNameW DeleteFileW RemoveDirectoryW GetSystemTime LockResource FindResourceExW FindClose MulDiv SetProcessWorkingSetSize CreateTimerQueueTimer DeleteTimerQueueTimer CreateFileW GetTickCount WriteFile ExitThread LoadLibraryW GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile HeapAlloc HeapFree GetProcessHeap ConnectNamedPipe CreateNamedPipeW CancelIo ReadFile GetOverlappedResult FlushInstructionCache SetLastError InterlockedExchange EncodePointer DecodePointer HeapDestroy HeapReAlloc HeapSize InterlockedPushEntrySList IsProcessorFeaturePresent VirtualFree VirtualAlloc InterlockedPopEntrySList UnhandledExceptionFilter SetUnhandledExceptionFilter WideCharToMultiByte HeapSetInformation GetStartupInfoW ExitProcess VirtualProtect VirtualQuery RtlUnwind GetCPInfo LCMapStringW GetStdHandle HeapCreate GetLocaleInfoW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree GetACP GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode FlushFileBuffers GetTimeZoneInformation SetFilePointer GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleW SetStdHandle CreateFileA CompareStringW SetEnvironmentVariableA SetEndOfFile GetThreadLocale CopyFileW SetFileAttributesW GetTempPathW GetFileSizeEx CreateDirectoryW GetFileAttributesW GetCurrentDirectoryW CreateMutexW WaitForSingleObject GetCurrentProcess CreateProcessW GlobalFree GlobalLock GlobalUnlock SetThreadPriority ResumeThread OpenThread FormatMessageA GetModuleHandleA AllocConsole LoadLibraryA GetLongPathNameW GetTempFileNameW MoveFileW GetFileAttributesExW GetDiskFreeSpaceExW GetDriveTypeW GetUserDefaultUILanguage VerSetConditionMask VerifyVersionInfoW FindFirstFileExW GetFileInformationByHandle PeekNamedPipe GetDriveTypeA FindFirstFileExA GetFullPathNameA GetCommandLineW InitializeCriticalSection CreateEventW GetCurrentProcessId ProcessIdToSessionId InitializeCriticalSectionAndSpinCount LoadLibraryExW FindResourceW LoadResource GetFileSize SizeofResource RaiseException lstrcmpiW lstrlenW FreeLibrary GetModuleFileNameW GetProcAddress GetModuleHandleW GetLastError InterlockedDecrement InterlockedIncrement LeaveCriticalSection EnterCriticalSection DeleteCriticalSection MultiByteToWideChar

user32

SetWindowPos LoadCursorW DestroyMenu CreatePopupMenu TrackPopupMenu TrackPopupMenuEx GetShellWindow GetDC ReleaseDC AppendMenuW SetMenuItemBitmaps SendMessageW UnregisterClassA MoveWindow GetWindowRect BeginPaint EndPaint InvalidateRect InvalidateRgn ShowWindow IsWindowVisible CharNextW IsWindowEnabled SetCapture SetWindowRgn GetClassInfoExW SetRect TrackMouseEvent GetKeyState ReleaseCapture UpdateLayeredWindow OffsetRect SetCursor IntersectRect MessageBoxA wvsprintfW wsprintfW MessageBoxW IsWindow DispatchMessageW DefWindowProcW CreateWindowExW SetWindowLongW PeekMessageW GetWindowLongW RegisterClassExW TranslateMessage KillTimer PostMessageW PostQuitMessage GetMessageW SetTimer DestroyWindow GetMonitorInfoW SetWindowTextW GetCursorPos EndDialog GetDlgItem SetCursorPos GetForegroundWindow SetFocus DialogBoxParamW MonitorFromPoint ScreenToClient ClientToScreen

ole32

CoInitializeEx CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoInitialize CoUninitialize CoCreateGuid CreateStreamOnHGlobal

oleaut32

SysFreeString SysStringLen SysAllocString VarUI4FromStr

gdi32

EnumEnhMetaFile CloseEnhMetaFile CreateEnhMetaFileW GetCurrentObject GetFontUnicodeRanges GetTextMetricsW GetOutlineTextMetricsW GetObjectA AddFontMemResourceEx DeleteEnhMetaFile CreateFontIndirectW CreateRectRgn BitBlt CreateCompatibleDC DeleteDC CombineRgn ExtCreateRegion GetDIBits CreateDCW GetObjectW DeleteObject RemoveFontMemResourceEx SelectObject GetDeviceCaps CreateDIBSection

gdiplus

GdipCreateFromHDC GdipGraphicsClear GdiplusStartup GdipCloneImage GdipGetImageEncoders GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipGetImageEncodersSize GdipAlloc GdipCreateBitmapFromScan0 GdipFree GdipRestoreGraphics GdiplusShutdown GdipBitmapGetPixel GdipGetImagePixelFormat GdipDrawImageRectRectI GdipPrivateAddFontFile GdipDrawImageI GdipSetClipGraphics GdipCloneFontFamily GdipCreateRegion GdipDeleteRegion GdipSetEmpty GdipCombineRegionRect GdipDeleteGraphics GdipGetImageGraphicsContext GdipSetImageAttributesRemapTable GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipBitmapUnlockBits GdipBitmapLockBits GdipImageRotateFlip GdipGetImageHeight GdipGetImageWidth GdipDeleteFont GdipCreateBitmapFromStream GdipGetFontCollectionFamilyCount GdipGetFontCollectionFamilyList GdipNewPrivateFontCollection GdipDeletePrivateFontCollection GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawDriverString GdipFillRectangleI GdipCreateFontFamilyFromName GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipDeleteBrush GdipCloneBrush GdipCreateSolidFill GdipCreateTextureIAI GdipSetTextureWrapMode GdipCreatePen1 GdipDeletePen GdipGetPenWidth GdipSetCompositingQuality GdipSetTextRenderingHint GdipSetSmoothingMode GdipResetWorldTransform GdipTranslateWorldTransform GdipScaleWorldTransform GdipRotateWorldTransform GdipDrawLine GdipFillRectangle GdipDrawImageRectRect GdipSetClipRect GdipSetClipRegion GdipResetClip GdipSaveGraphics GdipCreateTextureIA GdipGetFamilyName GdipSaveImageToStream

winmm

timeGetTime

crypt32

CryptFindOIDInfo

shell32

SHCreateDirectoryExW ShellExecuteW SHGetFolderPathW SHFileOperationW SHGetSpecialFolderPathW

shlwapi

PathCanonicalizeW PathCombineW PathFileExistsW StrDupW PathFindExtensionW PathRemoveFileSpecW PathRemoveBackslashW PathIsDirectoryW PathIsRelativeW

secur32

CompleteAuthToken FreeCredentialsHandle AcquireCredentialsHandleA InitializeSecurityContextA DeleteSecurityContext QueryCredentialsAttributesW FreeContextBuffer QueryContextAttributesW DecryptMessage EncryptMessage ApplyControlToken AcquireCredentialsHandleW

usp10

ScriptItemize ScriptBreak ScriptShape ScriptStringFree ScriptStringOut ScriptStringAnalyse ScriptCPtoX ScriptLayout ScriptPlace ScriptFreeCache

ws2_32

getsockopt socket getsockname getpeername bind connect setsockopt send sendto recv recvfrom listen WSACloseEvent closesocket ioctlsocket WSAEnumNetworkEvents WSAGetLastError WSAWaitForMultipleEvents WSAEventSelect WSAStartup WSACleanup WSACreateEvent getaddrinfo freeaddrinfo WSAResetEvent WSASetEvent accept WSCEnumProtocols

wininet

InternetQueryOptionW

Sharing

General

Malware Config

Signatures

File Explorer

202409139b6fefe7d02e65fe8f6d5d3ea77c6cccfloxifmafia

PE Signature issue

advapi32

kernel32

user32

ole32

oleaut32

gdi32

gdiplus

winmm

crypt32

shell32

shlwapi

secur32

usp10

ws2_32

wininet

generic