General

Malware Config

Signatures

Files

• 2024-07-01_ca45be2336753d11259ba69b70c1759c_mafia

  .exe windows:5 windows x86 arch:x86

  4d808e8a6a404d9896cc9faa531b322e

  
  

  Code Sign

  13:91:5e:42:3b:f9:f5:17:53:99:a6:33:ca:46:4d:fd

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  03-07-2013 00:00

  Not After

  02-08-2014 23:59

  Subject

  CN=US Tech Support LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=US Tech Support LLC,L=Santa Monica,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  17:56:21:5c:17:7b:af:cc:47:9e:e8:7e:32:a0:e6:7b:9f:7d:7e:d2

  Signer

  Actual PE Digest

  17:56:21:5c:17:7b:af:cc:47:9e:e8:7e:32:a0:e6:7b:9f:7d:7e:d2

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetVersionExA

  GetNativeSystemInfo

  SetUnhandledExceptionFilter

  GetModuleFileNameA

  GetCurrentProcessId

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  LocalFree

  GlobalAlloc

  GlobalLock

  GlobalUnlock

  InterlockedDecrement

  InterlockedIncrement

  GetModuleFileNameW

  MulDiv

  lstrcmpW

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  CreateMutexA

  SetEvent

  CloseHandle

  CreateEventA

  lstrlenA

  MultiByteToWideChar

  GetLastError

  VirtualUnlock

  VirtualLock

  SetEnvironmentVariableA

  SetEndOfFile

  SetStdHandle

  GetLocaleInfoA

  IsValidLocale

  EnumSystemLocalesA

  InterlockedExchange

  IsValidCodePage

  GetOEMCP

  GetACP

  QueryPerformanceCounter

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  PeekNamedPipe

  SetFilePointer

  FlushFileBuffers

  GetConsoleCP

  SetHandleCount

  GetLocaleInfoW

  IsDebuggerPresent

  UnhandledExceptionFilter

  TerminateProcess

  HeapCreate

  GetDateFormatA

  GetTimeFormatA

  CreateThread

  ExitThread

  GetCPInfo

  LCMapStringW

  GetDriveTypeW

  ReadFile

  GetStartupInfoW

  HeapSetInformation

  GetCommandLineW

  FindFirstFileExA

  GetDriveTypeA

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  ExitProcess

  VirtualQuery

  VirtualProtect

  RtlUnwind

  GetStdHandle

  GetFileType

  GetConsoleMode

  CreateWaitableTimerA

  SetWaitableTimer

  GetTimeZoneInformation

  GetExitCodeProcess

  DeleteFileA

  GetTickCount

  HeapAlloc

  DuplicateHandle

  CreateSemaphoreA

  LoadLibraryExW

  FreeLibrary

  WideCharToMultiByte

  WaitForSingleObject

  ReleaseSemaphore

  GetProcessHeap

  HeapFree

  GetSystemTimeAsFileTime

  FormatMessageW

  WriteConsoleW

  FindResourceExW

  GetVersionExW

  SetLastError

  lstrcmpiW

  lstrlenW

  CompareStringW

  GetModuleHandleW

  GetProcAddress

  GetCurrentThreadId

  FlushInstructionCache

  LeaveCriticalSection

  EnterCriticalSection

  RaiseException

  WaitForMultipleObjects

  SystemTimeToFileTime

  TlsSetValue

  ResetEvent

  OpenEventA

  GetSystemInfo

  TlsGetValue

  TlsFree

  TlsAlloc

  FormatMessageA

  GetFileInformationByHandle

  OutputDebugStringA

  ResumeThread

  GetComputerNameA

  FindResourceA

  WriteFile

  CreateFileW

  GetCurrentProcess

  GetUserDefaultLCID

  IsWow64Process

  GetTempPathA

  GlobalFree

  InterlockedCompareExchange

  MoveFileA

  CreateDirectoryA

  GetFullPathNameA

  FindClose

  InterlockedPushEntrySList

  CreateFileA

  GetCurrentDirectoryW

  GetFileAttributesA

  DecodePointer

  EncodePointer

  InitializeCriticalSection

  Sleep

  GetStringTypeW

  HeapSize

  HeapReAlloc

  HeapDestroy

  InterlockedPopEntrySList

  VirtualAlloc

  VirtualFree

  IsProcessorFeaturePresent

  LoadLibraryW

  user32

  DestroyWindow

  SetWindowLongW

  GetWindowLongW

  GetMenu

  SetWindowPos

  TranslateAcceleratorW

  TrackPopupMenuEx

  GetClientRect

  ShowWindow

  SetFocus

  CheckMenuRadioItem

  MessageBeep

  PeekMessageW

  SetWindowTextW

  EnableWindow

  IsChild

  GetDlgItem

  MessageBoxW

  IsDialogMessageW

  DispatchMessageW

  TranslateMessage

  GetMessageW

  MoveWindow

  ClientToScreen

  InvalidateRgn

  RedrawWindow

  GetMenuItemCount

  AppendMenuW

  AdjustWindowRectEx

  MapWindowPoints

  GetMonitorInfoW

  MonitorFromWindow

  GetWindowRect

  GetWindow

  GetParent

  DefWindowProcW

  GetDesktopWindow

  SetRectEmpty

  SystemParametersInfoW

  DestroyMenu

  GetWindowTextW

  GetWindowTextLengthW

  ScreenToClient

  UpdateWindow

  InvalidateRect

  IsWindowEnabled

  SetCapture

  UnregisterClassA

  GetDlgCtrlID

  IsWindow

  CallWindowProcW

  PtInRect

  SendMessageW

  DrawTextW

  FillRect

  DrawFocusRect

  SetCursor

  GetCursorPos

  CharNextW

  BeginPaint

  EndPaint

  GetDC

  ReleaseDC

  ReleaseCapture

  GetCapture

  OffsetRect

  GetFocus

  GetSysColor

  LoadCursorW

  GetClassNameW

  CreateDialogParamW

  CreatePopupMenu

  RemoveMenu

  MonitorFromPoint

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetMenuDefaultItem

  LoadStringW

  PostQuitMessage

  CreateWindowExW

  MessageBoxExW

  GetWindowThreadProcessId

  PostThreadMessageW

  LoadMenuW

  LoadAcceleratorsW

  LoadImageW

  DestroyAcceleratorTable

  IsDlgButtonChecked

  CheckDlgButton

  RegisterWindowMessageW

  CreateAcceleratorTableW

  RegisterClassExW

  GetClassInfoExW

  LoadStringA

  gdi32

  GetDeviceCaps

  BitBlt

  CreateCompatibleBitmap

  CreateDIBSection

  StretchBlt

  GetDIBColorTable

  SetDIBColorTable

  CreateCompatibleDC

  GetStockObject

  DeleteDC

  SetTextColor

  SetBkMode

  GetObjectW

  SelectObject

  CreateFontIndirectW

  DeleteObject

  CreateSolidBrush

  advapi32

  SetEntriesInAclA

  RegQueryInfoKeyW

  RegSetValueExW

  RegDeleteValueW

  RegDeleteKeyW

  RegCreateKeyExW

  RegCreateKeyExA

  RegSetValueExA

  RegEnumKeyExW

  RegQueryValueExW

  RegCloseKey

  RegOpenKeyExW

  RegQueryValueExA

  OpenProcessToken

  GetKernelObjectSecurity

  CreateProcessAsUserW

  SetSecurityDescriptorDacl

  DuplicateTokenEx

  ImpersonateLoggedOnUser

  MakeAbsoluteSD

  SetKernelObjectSecurity

  BuildExplicitAccessWithNameA

  GetSecurityDescriptorDacl

  shell32

  ShellExecuteW

  SHGetFolderPathW

  SHGetFolderPathA

  ole32

  CLSIDFromProgID

  CLSIDFromString

  OleLockRunning

  CoCreateInstance

  CoTaskMemAlloc

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoCreateGuid

  CoInitialize

  CoTaskMemRealloc

  CoTaskMemFree

  CoInitializeEx

  CoGetClassObject

  StringFromGUID2

  oleaut32

  VarUI4FromStr

  LoadTypeLi

  LoadRegTypeLi

  OleCreateFontIndirect

  VariantClear

  VariantInit

  SysAllocString

  SysAllocStringLen

  SysStringLen

  SysFreeString

  comctl32

  _TrackMouseEvent

  InitCommonControlsEx

  msimg32

  AlphaBlend

  TransparentBlt

  gdiplus

  GdipGetImageHeight

  GdipGetImagePixelFormat

  GdipGetImagePaletteSize

  GdipGetImagePalette

  GdipCreateBitmapFromStream

  GdipCreateBitmapFromScan0

  GdipBitmapLockBits

  GdipBitmapUnlockBits

  GdiplusStartup

  GdipGetImageGraphicsContext

  GdipDrawImageI

  GdipCloneImage

  GdipDisposeImage

  GdipDeleteGraphics

  GdipAlloc

  GdipFree

  GdiplusShutdown

  GdipGetImageWidth

  ws2_32

  gethostname

  gethostbyname

  WSAGetLastError

  WSACleanup

  psapi

  GetPerformanceInfo

  winhttp

  WinHttpCrackUrl

  WinHttpReceiveResponse

  WinHttpSetTimeouts

  WinHttpSetOption

  WinHttpGetIEProxyConfigForCurrentUser

  WinHttpSendRequest

  WinHttpWriteData

  WinHttpConnect

  WinHttpCloseHandle

  WinHttpQueryHeaders

  WinHttpQueryDataAvailable

  WinHttpOpen

  WinHttpAddRequestHeaders

  WinHttpReadData

  WinHttpGetProxyForUrl

  WinHttpOpenRequest

  msi

  ord87

  ord112

  ord91

  ord117

  ord160

  ord158

  ord159

  ord8

  ord32

  ord141

  Sections

  .text

  Size: 938KB - Virtual size: 937KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 278KB - Virtual size: 278KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 23KB - Virtual size: 34KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 2B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1.4MB - Virtual size: 1.4MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 83KB - Virtual size: 83KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ