2025-01-01_3031801cf9b18bc549b21e9a245dec9a_floxif_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2025-01-01_3031801cf9b18bc549b21e9a245dec9a_floxif_mafia
Size 347KB
Sample250101-a1rl9azphr
SHA256 fcc2b5d543a9e7f91a5477944116783dfa3e91b84de94512af93242cd280f22c
MD5 3031801cf9b18bc549b21e9a245dec9a
SHA1 5f182bf2a9b73339e1744df485a33d9dce68a98c
SHA512 87a9885298ba09cd689c5961104217abb9d1698ed48cce45ed57d3581082270013ac72f3f7e62e3d777ff40d87d9d47539cd30d97cbbcf1142807e96c42129c6
SSDEEP 6144:vRhcgGeQa217K4+Ay6EtA5amw/zmIAkWU/EvfB3EWHpVBV+UdvrEFp7hKwe:fGPaG77+y11AzmIAtU/EvfB5TBjvrEHu
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2025-01-01_3031801cf9b18bc549b21e9a245dec9a_floxif_mafia

.exe 347KB

2025-01-01_3031801cf9b18bc549b21e9a245dec9a_floxif_mafia

IMPHASH 3b1d63da6290547c2b42c269c453fddc
SHA256 fcc2b5d543a9e7f91a5477944116783dfa3e91b84de94512af93242cd280f22c
MD5 3031801cf9b18bc549b21e9a245dec9a
SHA1 5f182bf2a9b73339e1744df485a33d9dce68a98c
SHA512 87a9885298ba09cd689c5961104217abb9d1698ed48cce45ed57d3581082270013ac72f3f7e62e3d777ff40d87d9d47539cd30d97cbbcf1142807e96c42129c6
SSDEEP 6144:vRhcgGeQa217K4+Ay6EtA5amw/zmIAkWU/EvfB3EWHpVBV+UdvrEFp7hKwe:fGPaG77+y11AzmIAtU/EvfB5TBjvrEHu
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

89:8c:85:70:ba:ee:32:38:03:24:61:43:91:f7:e3:64:b6:44:af:cb

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ISWQL,O=Intel Corporation,L=Folsom,ST=California,C=US

Chains

Dec 19, 2012

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

02:3a:64

Issuer

CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - May 20, 2022

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

7e:1f:df:72:99:e8:d2:45:a1:5d:0b:a8:e5:b1:59:ba

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - May 19, 2022

Subject

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ISWQL,O=Intel Corporation,L=Folsom,ST=California,C=US

Serial Number

10:02:1a:27:d2:83:12:88:5c:61:3a:a4:98:58:0f:6f

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 8, 2011 - Apr 22, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

123746

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\ccViews\autobuild1_BR-1210-0BKK_8.1_Snapshot\AMT_Development\SW\Src\Services\LMS\Release\LMS.pdb

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailA

ws2_32

connect select __WSAFDIsSet getaddrinfo freeaddrinfo bind listen recv send htons socket setsockopt shutdown closesocket getsockname WSAStartup ntohl htonl ntohs WSACreateEvent WSAGetLastError WSACloseEvent WSAResetEvent WSAAddressToStringA WSASetEvent WSAAccept accept getpeername ioctlsocket

iphlpapi

GetExtendedTcpTable GetAdaptersAddresses CancelIPChangeNotify NotifyAddrChange SetTcpEntry

dnsapi

DnsModifyRecordsInSet_A

crypt32

CryptUnprotectData

kernel32

IsDebuggerPresent HeapSize ExitProcess GetACP GetOEMCP IsValidCodePage SetUnhandledExceptionFilter GetLastError WaitForSingleObject FormatMessageA GetComputerNameExA CreateEventA GetCurrentProcess CloseHandle SetEvent ResetEvent GetProcAddress GetModuleHandleA SetHandleCount GetOverlappedResult ReadFile WriteFile DeviceIoControl CreateFileA FreeLibrary LoadLibraryA Sleep GetModuleFileNameA GetVersionExA LocalFree GetStdHandle AllocConsole SetConsoleCtrlHandler SetDllDirectoryA GetCurrentProcessId CreateSemaphoreA ReleaseSemaphore GetCurrentThreadId ResumeThread GetTickCount UnhandledExceptionFilter TerminateProcess SetLastError GetModuleHandleW TlsFree TlsSetValue GetStartupInfoW GetModuleFileNameW HeapCreate GetProcessHeap GetLocaleInfoW GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime GetStringTypeW HeapReAlloc GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale LoadLibraryW WriteConsoleW CompareStringW SetEnvironmentVariableA CreateFileW SetEndOfFile CancelIo WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedExchange MultiByteToWideChar InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer RtlUnwind RaiseException HeapAlloc HeapFree ExitThread CreateThread SetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteFileA GetCommandLineA HeapSetInformation LCMapStringW GetCPInfo IsProcessorFeaturePresent TlsAlloc TlsGetValue

user32

RegisterDeviceNotificationA DefWindowProcA CreateWindowExA RegisterClassA UnregisterDeviceNotification DestroyWindow

advapi32

SetServiceStatus RegOpenKeyExA RegQueryValueExA StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerExA StartServiceA RegDeleteValueA OpenServiceA ControlService QueryServiceStatus DeleteService OpenSCManagerA CreateServiceA CloseServiceHandle ChangeServiceConfig2A RegDeleteKeyA RegCreateKeyA RegSetValueExA RegCloseKey RegisterEventSourceA ReportEventA DeregisterEventSource GetUserNameA LookupAccountNameA IsValidSid GetLengthSid CopySid

Sharing

General

Malware Config

Signatures

File Explorer

2025-01-01_3031801cf9b18bc549b21e9a245dec9a_floxif_mafia

PE Signature issue

setupapi

ws2_32

iphlpapi

dnsapi

crypt32

kernel32

user32

advapi32

generic