2024-12-18_2f2d6e9fa93c51a1246e5fada7311f8b_floxif_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2024-12-18_2f2d6e9fa93c51a1246e5fada7311f8b_floxif_mafia
Size 3.9MB
Sample241218-me4e5swmck
SHA256 d8f75a64170054810fe0f7333ba1afee2ecf82b551a26045bad008cd69e51c43
MD5 2f2d6e9fa93c51a1246e5fada7311f8b
SHA1 569e666e2048beedd9d81df83768a8494f62388b
SHA512 60353d081eaead8bc9431cead6f5fb48771079024e4478a128d8412ed69ee9bf226eabe2213914403bdb9ec4a49d677bc29885d24cd4cc6b42a60a689a4ab5c3
SSDEEP 98304:1g+Esjoa9kZ6DRwcEtzCyQWuKglLgyQ/Pn9rj+De0nzQUyH:1g+EsJ9k6bOuTgln9rj+DoUw
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-12-18_2f2d6e9fa93c51a1246e5fada7311f8b_floxif_mafia

.exe 3.9MB

2024-12-18_2f2d6e9fa93c51a1246e5fada7311f8b_floxif_mafia

IMPHASH e0080e77b1ec1e40e0a4d23fb7045fbc
SHA256 d8f75a64170054810fe0f7333ba1afee2ecf82b551a26045bad008cd69e51c43
MD5 2f2d6e9fa93c51a1246e5fada7311f8b
SHA1 569e666e2048beedd9d81df83768a8494f62388b
SHA512 60353d081eaead8bc9431cead6f5fb48771079024e4478a128d8412ed69ee9bf226eabe2213914403bdb9ec4a49d677bc29885d24cd4cc6b42a60a689a4ab5c3
SSDEEP 98304:1g+Esjoa9kZ6DRwcEtzCyQWuKglLgyQ/Pn9rj+De0nzQUyH:1g+EsJ9k6bOuTgln9rj+DoUw
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

5e:16:cf:29:63:49:96:6c:45:43:ba:e3:da:37:eb:fa:4c:73:0e:49

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Foxit Software Incorporated,O=Foxit Software Incorporated,L=Fremont,ST=California,C=US

Chains

Apr 9, 2018

CN=Foxit Software Incorporated,O=Foxit Software Incorporated,L=Fremont,ST=California,C=US

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Foxit Software Incorporated,O=Foxit Software Incorporated,L=Fremont,ST=California,C=US

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

1b:e7:15

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2014 - May 30, 2031

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 3, 2011 - May 3, 2031

Subject

CN=Foxit Software Incorporated,O=Foxit Software Incorporated,L=Fremont,ST=California,C=US

Serial Number

36:ac:03:7a:a8:1d:63:fd

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 28, 2017 - Aug 25, 2020

Minor OS version

Major OS version

Entry point

1333661

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

kernel32

UnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCPInfo GetOEMCP IsValidCodePage GetStringTypeW LCMapStringW GetConsoleCP GetConsoleMode GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleW GetDriveTypeW GetProcessHeap SetEnvironmentVariableA GetStdHandle lstrcpynW IsProcessorFeaturePresent SetFilePointerEx LoadLibraryA QueryPerformanceCounter HeapCreate SetHandleCount SizeofResource LockResource LoadResource FindResourceW GetEnvironmentStringsW FreeEnvironmentStringsW MultiByteToWideChar SetUnhandledExceptionFilter GetModuleFileNameW GetTimeZoneInformation lstrcmpW GetModuleHandleW Sleep FindClose SetFileAttributesW CreateDirectoryW FindFirstFileW CloseHandle Process32NextW Process32FirstW CreateToolhelp32Snapshot RemoveDirectoryW DeleteFileW CopyFileW GetVersion FreeLibrary GetProcAddress LoadLibraryW GetCurrentThreadId GlobalAlloc GetTempPathW ReleaseMutex WaitForSingleObject GetLastError SetLastError CreateMutexW ResumeThread SuspendThread CreateEventW SetEvent GetExitCodeThread GetTickCount CreateFileA CreateFileW ReadFile WriteFile SetFilePointer GetFileSize VirtualAlloc VirtualFree GetVersionExW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ResetEvent CreateSemaphoreW ReleaseSemaphore InitializeCriticalSection VirtualQuery GetSystemInfo HeapQueryInformation HeapSize GetFileType SetStdHandle HeapReAlloc ExitProcess GetDateFormatW GetTimeFormatW TerminateThread GetShortPathNameW lstrlenW CreateThread GetCurrentProcess GetTempFileNameW GetACP GetExitCodeProcess GetFileAttributesW WideCharToMultiByte FileTimeToSystemTime FileTimeToLocalFileTime GetWindowsDirectoryW CreateProcessW lstrcpyW ExitThread HeapFree HeapAlloc DecodePointer EncodePointer GetSystemTimeAsFileTime RaiseException RtlUnwind GetStartupInfoW HeapSetInformation GetCommandLineW FindResourceExW GetUserDefaultLCID VirtualProtect SearchPathW GetProfileIntW GetNumberFormatW SetErrorMode GetModuleHandleA OutputDebugStringW GetPrivateProfileStringW GetCurrentDirectoryW GetSystemDirectoryW GlobalFlags GetFileTime GetFileSizeEx GetFileAttributesExW GlobalGetAtomNameW InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue GetCurrentProcessId GetFullPathNameW GetVolumeInformationW DuplicateHandle SetEndOfFile UnlockFile LockFile FlushFileBuffers lstrcmpiW GetThreadLocale FindNextFileW WritePrivateProfileStringW GetPrivateProfileIntW GetCurrentThread GetUserDefaultUILanguage ConvertDefaultLocale GetSystemDefaultUILanguage GetLocaleInfoW LoadLibraryExW InterlockedExchange InterlockedDecrement ReleaseActCtx CreateActCtxW FreeResource GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW InitializeCriticalSectionAndSpinCount ActivateActCtx DeactivateActCtx SetThreadPriority lstrlenA lstrcmpA GlobalFree GlobalSize GlobalLock GlobalUnlock FormatMessageW MulDiv LocalAlloc LocalFree

user32

EnumChildWindows GetWindowRgn DrawIcon SubtractRect MapVirtualKeyExW IsCharLowerW GetDoubleClickTime CharUpperBuffW EmptyClipboard CloseClipboard SetClipboardData OpenClipboard GetUpdateRect FrameRect IsClipboardFormatAvailable PostThreadMessageW CreateMenu TranslateMDISysAccel DrawMenuBar DefMDIChildProcW DefFrameProcW RegisterClipboardFormatW UnpackDDElParam ReuseDDElParam InsertMenuItemW TranslateAcceleratorW SetMenuDefaultItem IsMenu MonitorFromPoint UpdateLayeredWindow UnionRect GetIconInfo EnableScrollBar HideCaret InvertRect GetMenuDefaultItem LockWindowUpdate SetCursorPos CreateAcceleratorTableW LoadAcceleratorsW GetKeyboardState GetKeyboardLayout ToUnicodeEx DrawFocusRect DrawFrameControl DrawEdge DrawIconEx SetClassLongW GetAsyncKeyState NotifyWinEvent CreatePopupMenu DestroyAcceleratorTable SetParent SetWindowRgn IsZoomed GetNextDlgGroupItem InvalidateRgn SetRect IsRectEmpty CopyAcceleratorTableW OffsetRect CharNextW DestroyIcon IsIconic WaitMessage KillTimer SetTimer DeleteMenu UnregisterClassW SetLayeredWindowAttributes EnumDisplayMonitors SetRectEmpty CopyImage RealChildWindowFromPoint GetSysColorBrush WindowFromPoint IntersectRect DestroyMenu GetMenuItemInfoW CharUpperW MapVirtualKeyW GetKeyNameTextW SetWindowContextHelpId MapDialogRect ShowOwnedPopups PostQuitMessage DrawStateW GetDesktopWindow CreateDialogIndirectParamW GetNextDlgTabItem EndDialog IsWindowEnabled ShowWindow MoveWindow SetWindowTextW CallWindowProcW DefWindowProcW GetDlgCtrlID EnableWindow LoadStringW IsDialogMessageW CheckRadioButton CheckDlgButton SetMenuItemBitmaps GetMenuCheckMarkDimensions ModifyMenuW CheckMenuItem RegisterWindowMessageW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetFocus SetFocus GetWindowTextLengthW GetWindowTextW GetLastActivePopup BeginDeferWindowPos EndDeferWindowPos GetDlgItem GetTopWindow DestroyWindow GetMessageTime MonitorFromWindow GetMonitorInfoW MapWindowPoints ScrollWindow TrackPopupMenu SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos ShowScrollBar CreateWindowExW GetClassInfoExW RegisterClassW AdjustWindowRectEx EqualRect DeferWindowPos GetScrollInfo SetScrollInfo SetWindowPlacement wsprintfW SetMenuItemInfoW SendMessageW GetClientRect UpdateWindow SetActiveWindow SetForegroundWindow LoadIconW PostMessageW LoadImageW GetSystemMetrics GetCursorPos GetDC FindWindowW UnhookWindowsHookEx SetDlgItemTextW MessageBoxW SetWindowsHookExW IsWindow GetClassInfoW EnableMenuItem GetSystemMenu GetWindowRect GetMenuStringW GetSubMenu LoadMenuW ReleaseDC SystemParametersInfoW GetMessagePos AttachThreadInput GetWindowThreadProcessId GetForegroundWindow LoadBitmapW ScreenToClient GetSysColor IsWindowVisible BringWindowToTop PtInRect InflateRect InvalidateRect RedrawWindow SetCapture GetParent ReleaseCapture SetCursor GetWindowPlacement CopyIcon LoadCursorW SetWindowLongW DestroyCursor MessageBeep RemoveMenu GetMenuItemCount InsertMenuW GetMenuItemID AppendMenuW GetMenuState ValidateRect PeekMessageW GetKeyState GetActiveWindow DispatchMessageW TranslateMessage GetMessageW CallNextHookEx FillRect TabbedTextOutW DrawTextW DrawTextExW GrayStringW ClientToScreen GetWindowDC BeginPaint EndPaint GetWindow CopyRect SetWindowPos GetWindowLongW GetMenu

gdi32

CreateRectRgnIndirect CreateCompatibleBitmap CreateFontW SelectObject GetTextExtentPoint32W DeleteObject GetDeviceCaps CreateFontIndirectW SelectClipRgn CreateRectRgn GetViewportExtEx GetWindowExtEx GetPixel PtVisible RectVisible TextOutW ExtTextOutW Escape SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn DeleteDC CreatePatternBrush CreateBitmap SelectPalette GetObjectType CreatePen CreateSolidBrush CreateHatchBrush PatBlt SetRectRgn CombineRgn BitBlt DPtoLP CreateCompatibleDC GetTextMetricsW EnumFontFamiliesW GetTextCharsetInfo GetTextColor GetRgnBox CreateDIBSection CreateRoundRectRgn CreatePolygonRgn CreateEllipticRgn Polyline Ellipse Polygon CreatePalette GetPaletteEntries GetNearestPaletteIndex RealizePalette GetSystemPaletteEntries OffsetRgn SetDIBColorTable SetPixel Rectangle EnumFontFamiliesExW LPtoDP GetWindowOrgEx GetViewportOrgEx PtInRegion FillRgn FrameRgn GetBoundsRect ExtFloodFill SetPaletteEntries GetTextFaceW SetPixelV CreateDIBitmap GetBkColor StretchBlt GetStockObject CopyMetaFileW CreateDCW SaveDC RestoreDC SetBkColor SetBkMode SetPolyFillMode SetROP2 SetTextColor SetMapMode GetClipBox ExcludeClipRect IntersectClipRect LineTo MoveToEx SetTextAlign GetLayout SetLayout GetMapMode GetObjectW

msimg32

TransparentBlt AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

RegCloseKey RegOpenKeyExA RegOpenKeyExW RegEnumKeyExA RegDeleteValueW RegDeleteKeyW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW RegQueryValueW RegEnumKeyW RegOpenKeyW RegSetValueExW RegQueryValueExW RegCreateKeyExW RegQueryValueExA

shell32

SHBrowseForFolderW ShellExecuteW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetFileInfoW Shell_NotifyIconW SHGetDesktopFolder DragFinish DragQueryFileW ShellExecuteExW SHAppBarMessage

comctl32

ImageList_GetIconSize

shlwapi

PathFileExistsW UrlUnescapeW PathRemoveFileSpecW PathFindExtensionW PathFindFileNameW PathStripToRootW PathIsUNCW StrCmpW

ole32

OleLockRunning RevokeDragDrop OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor IsAccelerator CoLockObjectExternal RegisterDragDrop OleGetClipboard CoRegisterMessageFilter CoRevokeClassObject DoDragDrop OleFlushClipboard OleIsCurrentClipboard CreateStreamOnHGlobal OleInitialize CoFreeUnusedLibraries OleUninitialize CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CLSIDFromString CLSIDFromProgID CoInitializeEx CoCreateInstance OleDuplicateData CoTaskMemAlloc ReleaseStgMedium CoTaskMemFree CoInitialize CoCreateGuid CoUninitialize

oleaut32

OleCreateFontIndirect VarBstrFromDate SysStringLen SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy SysFreeString SysAllocStringLen VariantClear VariantChangeType VariantInit SysAllocString VariantCopy

oledlg

OleUIBusyW

wininet

InternetQueryDataAvailable InternetSetFilePointer InternetSetStatusCallbackW InternetGetLastResponseInfoW InternetSetOptionExW InternetAttemptConnect InternetConnectW InternetOpenW InternetCloseHandle HttpSendRequestW HttpAddRequestHeadersW HttpOpenRequestW InternetReadFile HttpQueryInfoW HttpEndRequestW InternetWriteFile HttpSendRequestExW InternetCrackUrlW InternetCanonicalizeUrlW

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpSetTimeouts WinHttpConnect WinHttpCloseHandle WinHttpOpenRequest WinHttpSetOption WinHttpSendRequest WinHttpQueryHeaders WinHttpReadData WinHttpGetIEProxyConfigForCurrentUser WinHttpCrackUrl

dbghelp

MakeSureDirectoryPathExists

iphlpapi

GetAdaptersInfo GetNetworkParams

msi

ord205

oleacc

LresultFromObject AccessibleObjectFromWindow CreateStdAccessibleObject

gdiplus

GdipGetImageGraphicsContext GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipDrawImageI GdipGetImageWidth GdipCloneImage GdipDrawImageRectI GdipSetInterpolationMode GdiplusShutdown GdiplusStartup GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipDeleteGraphics GdipAlloc GdipFree GdipCreateFromHDC GdipGetImageHeight

imm32

ImmGetContext ImmReleaseContext ImmGetOpenStatus

winmm

PlaySoundW

Sharing

General

Malware Config

Signatures

File Explorer

2024-12-18_2f2d6e9fa93c51a1246e5fada7311f8b_floxif_mafia

PE Signature issue

version

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

wininet

winhttp

dbghelp

iphlpapi

msi

oleacc

gdiplus

imm32

winmm

generic