20240913d021388bf8754434de0812317823c9befloxifmafia

Sharing

Copy URL Twitter E-mail

General

Target
20240913d021388bf8754434de0812317823c9befloxifmafia
Size 2.5MB
Sample240913-wedddszcll
SHA256 6f5ca0b2ba98d0eb1f83ccdff8808b29c6b424f9da146b1c8cf3a6b9c99c8228
MD5 d021388bf8754434de0812317823c9be
SHA1 da273e224092e0066b35cdbfd02e6dacdf3638ea
SHA512 43ed970efa2b36b0bfda7c19e2c832809ebf907f6a72de5451e8192f5e95a52ff1577d9711f9fbc54bd655de3fcdba242c39d67af1af3bf2ef891b39c40bb63d
SSDEEP 49152:quIIKkofs2hPd2l177BTK2VbDsar1YDj8:qj5fs2hPIl1/b
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

20240913d021388bf8754434de0812317823c9befloxifmafia

.exe 2.5MB

20240913d021388bf8754434de0812317823c9befloxifmafia

IMPHASH 97f5c5cdc5e80758b7adff3a733244ad
SHA256 6f5ca0b2ba98d0eb1f83ccdff8808b29c6b424f9da146b1c8cf3a6b9c99c8228
MD5 d021388bf8754434de0812317823c9be
SHA1 da273e224092e0066b35cdbfd02e6dacdf3638ea
SHA512 43ed970efa2b36b0bfda7c19e2c832809ebf907f6a72de5451e8192f5e95a52ff1577d9711f9fbc54bd655de3fcdba242c39d67af1af3bf2ef891b39c40bb63d
SSDEEP 49152:quIIKkofs2hPd2l177BTK2VbDsar1YDj8:qj5fs2hPIl1/b
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

7e:bc:2c:e2:11:d9:0d:fb:c2:91:19:2e:c7:fe:ac:1a:26:c2:77:d7

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Chains

Oct 10, 2012

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Sep 30, 2010 - Jan 1, 2014

Subject

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Serial Number

09:e2:8b:26:db:59:3e:c4:e7:32:86:b6:64:99:c3:70

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 14, 2011 - Nov 13, 2014

Minor OS version

Major OS version

Entry point

1349317

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

p:\p\agents\hpam2.eem\recipes\201152726\base\branches\inputtools_win_release_branch\googleclient\ime\goopy\scons-out\opt\obj\components\win_frontend\ipc_console.pdb

advapi32

RegDeleteKeyW RegCloseKey RegQueryInfoKeyW RegEnumKeyExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegDeleteValueW ConvertSidToStringSidW GetLengthSid GetSecurityInfo CopySid GetUserNameW GetTokenInformation OpenProcessToken SetSecurityInfo GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenCurrentUser RegQueryValueExW RegNotifyChangeKeyValue GetSidSubAuthority GetSidSubAuthorityCount SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce InitializeAcl IsValidSid

kernel32

TerminateProcess GetModuleFileNameA IsDebuggerPresent GetCurrentThreadId OutputDebugStringA ReleaseMutex CloseHandle DebugBreak GetTempPathA GlobalAlloc LocalFree ResetEvent SetEvent WaitForMultipleObjects CreateThread Sleep GetVersionExW InterlockedCompareExchange GetSystemTimeAsFileTime SystemTimeToFileTime FileTimeToLocalFileTime FileTimeToSystemTime QueryPerformanceCounter FindFirstFileW FindNextFileW GetFullPathNameW DeleteFileW RemoveDirectoryW GetSystemTime LockResource FindResourceExW FindClose MulDiv SetProcessWorkingSetSize CreateTimerQueueTimer DeleteTimerQueueTimer CreateFileW GetTickCount WriteFile ExitThread LoadLibraryW GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile HeapAlloc HeapFree GetProcessHeap ConnectNamedPipe CreateNamedPipeW CancelIo ReadFile GetOverlappedResult FlushInstructionCache SetLastError InterlockedExchange EncodePointer DecodePointer HeapDestroy HeapReAlloc HeapSize InterlockedPushEntrySList IsProcessorFeaturePresent VirtualFree VirtualAlloc InterlockedPopEntrySList UnhandledExceptionFilter SetUnhandledExceptionFilter WideCharToMultiByte HeapSetInformation GetStartupInfoW ExitProcess VirtualProtect VirtualQuery RtlUnwind GetCPInfo LCMapStringW GetStdHandle HeapCreate GetLocaleInfoW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree GetACP GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode FlushFileBuffers GetTimeZoneInformation SetFilePointer GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleW SetStdHandle CreateFileA CompareStringW SetEnvironmentVariableA SetEndOfFile GetThreadLocale CopyFileW SetFileAttributesW GetTempPathW GetFileSizeEx CreateDirectoryW GetFileAttributesW GetCurrentDirectoryW CreateMutexW WaitForSingleObject GetCurrentProcess CreateProcessW GlobalFree GlobalLock GlobalUnlock SetThreadPriority ResumeThread OpenThread FormatMessageA GetModuleHandleA AllocConsole LoadLibraryA GetLongPathNameW GetTempFileNameW MoveFileW GetFileAttributesExW GetDiskFreeSpaceExW GetDriveTypeW GetUserDefaultUILanguage VerSetConditionMask VerifyVersionInfoW FindFirstFileExW GetFileInformationByHandle PeekNamedPipe GetDriveTypeA FindFirstFileExA GetFullPathNameA GetCommandLineW InitializeCriticalSection CreateEventW GetCurrentProcessId ProcessIdToSessionId InitializeCriticalSectionAndSpinCount LoadLibraryExW FindResourceW LoadResource GetFileSize SizeofResource RaiseException lstrcmpiW lstrlenW FreeLibrary GetModuleFileNameW GetProcAddress GetModuleHandleW GetLastError InterlockedDecrement InterlockedIncrement LeaveCriticalSection EnterCriticalSection DeleteCriticalSection MultiByteToWideChar

user32

SetWindowPos LoadCursorW DestroyMenu CreatePopupMenu TrackPopupMenu TrackPopupMenuEx GetShellWindow GetDC ReleaseDC AppendMenuW SetMenuItemBitmaps SendMessageW UnregisterClassA MoveWindow GetWindowRect BeginPaint EndPaint InvalidateRect InvalidateRgn ShowWindow IsWindowVisible CharNextW IsWindowEnabled SetCapture SetWindowRgn GetClassInfoExW SetRect TrackMouseEvent GetKeyState ReleaseCapture UpdateLayeredWindow OffsetRect SetCursor IntersectRect MessageBoxA wvsprintfW wsprintfW MessageBoxW IsWindow DispatchMessageW DefWindowProcW CreateWindowExW SetWindowLongW PeekMessageW GetWindowLongW RegisterClassExW TranslateMessage KillTimer PostMessageW PostQuitMessage GetMessageW SetTimer DestroyWindow GetMonitorInfoW SetWindowTextW GetCursorPos EndDialog GetDlgItem SetCursorPos GetForegroundWindow SetFocus DialogBoxParamW MonitorFromPoint ScreenToClient ClientToScreen

ole32

CoInitializeEx CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoInitialize CoUninitialize CoCreateGuid CreateStreamOnHGlobal

oleaut32

SysFreeString SysStringLen SysAllocString VarUI4FromStr

gdi32

EnumEnhMetaFile CloseEnhMetaFile CreateEnhMetaFileW GetCurrentObject GetFontUnicodeRanges GetTextMetricsW GetOutlineTextMetricsW GetObjectA AddFontMemResourceEx DeleteEnhMetaFile CreateFontIndirectW CreateRectRgn BitBlt CreateCompatibleDC DeleteDC CombineRgn ExtCreateRegion GetDIBits CreateDCW GetObjectW DeleteObject RemoveFontMemResourceEx SelectObject GetDeviceCaps CreateDIBSection

gdiplus

GdipCreateFromHDC GdipGraphicsClear GdiplusStartup GdipCloneImage GdipGetImageEncoders GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipGetImageEncodersSize GdipAlloc GdipCreateBitmapFromScan0 GdipFree GdipRestoreGraphics GdiplusShutdown GdipBitmapGetPixel GdipGetImagePixelFormat GdipDrawImageRectRectI GdipPrivateAddFontFile GdipDrawImageI GdipSetClipGraphics GdipCloneFontFamily GdipCreateRegion GdipDeleteRegion GdipSetEmpty GdipCombineRegionRect GdipDeleteGraphics GdipGetImageGraphicsContext GdipSetImageAttributesRemapTable GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipBitmapUnlockBits GdipBitmapLockBits GdipImageRotateFlip GdipGetImageHeight GdipGetImageWidth GdipDeleteFont GdipCreateBitmapFromStream GdipGetFontCollectionFamilyCount GdipGetFontCollectionFamilyList GdipNewPrivateFontCollection GdipDeletePrivateFontCollection GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawDriverString GdipFillRectangleI GdipCreateFontFamilyFromName GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipDeleteBrush GdipCloneBrush GdipCreateSolidFill GdipCreateTextureIAI GdipSetTextureWrapMode GdipCreatePen1 GdipDeletePen GdipGetPenWidth GdipSetCompositingQuality GdipSetTextRenderingHint GdipSetSmoothingMode GdipResetWorldTransform GdipTranslateWorldTransform GdipScaleWorldTransform GdipRotateWorldTransform GdipDrawLine GdipFillRectangle GdipDrawImageRectRect GdipSetClipRect GdipSetClipRegion GdipResetClip GdipSaveGraphics GdipCreateTextureIA GdipGetFamilyName GdipSaveImageToStream

winmm

timeGetTime

crypt32

CryptFindOIDInfo

shell32

SHCreateDirectoryExW ShellExecuteW SHGetFolderPathW SHFileOperationW SHGetSpecialFolderPathW

shlwapi

PathCanonicalizeW PathCombineW PathFileExistsW StrDupW PathFindExtensionW PathRemoveFileSpecW PathRemoveBackslashW PathIsDirectoryW PathIsRelativeW

secur32

CompleteAuthToken FreeCredentialsHandle AcquireCredentialsHandleA InitializeSecurityContextA DeleteSecurityContext QueryCredentialsAttributesW FreeContextBuffer QueryContextAttributesW DecryptMessage EncryptMessage ApplyControlToken AcquireCredentialsHandleW

usp10

ScriptItemize ScriptBreak ScriptShape ScriptStringFree ScriptStringOut ScriptStringAnalyse ScriptCPtoX ScriptLayout ScriptPlace ScriptFreeCache

ws2_32

getsockopt socket getsockname getpeername bind connect setsockopt send sendto recv recvfrom listen WSACloseEvent closesocket ioctlsocket WSAEnumNetworkEvents WSAGetLastError WSAWaitForMultipleEvents WSAEventSelect WSAStartup WSACleanup WSACreateEvent getaddrinfo freeaddrinfo WSAResetEvent WSASetEvent accept WSCEnumProtocols

wininet

InternetQueryOptionW

Sharing

General

Malware Config

Signatures

File Explorer

20240913d021388bf8754434de0812317823c9befloxifmafia

PE Signature issue

advapi32

kernel32

user32

ole32

oleaut32

gdi32

gdiplus

winmm

crypt32

shell32

shlwapi

secur32

usp10

ws2_32

wininet

generic