686c3ef22a421551e83f64e6bed933b5_mafia_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

686c3ef22a421551e83f64e6bed933b5_mafia_JC.exe
Size

6.4MB
MD5

686c3ef22a421551e83f64e6bed933b5
SHA1

e546060f2f6ea864842e250758c3b8e81f4d7308
SHA256

a68b819d221f63c233679bc4aec3dfe7939e4f0ac2d8d3972ad6347258ef2dba
SHA512

52036adffa9a7ba04215f48a428e05576adec6aca3c1c6bde4fff2bfdd78b9238b47135d05d30f37ee1ce8723283519d163bdd4dd185adfe3363966a8153917c
SSDEEP

98304:BO/2ybR57U8gJ7GcbEoTktQ66ugNxGpiGNHjPLOqlajvBIqfM:BEVR+hlGcb9Gf91hdla1xE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
686c3ef22a421551e83f64e6bed933b5_mafia_JC.exe

Files

686c3ef22a421551e83f64e6bed933b5_mafia_JC.exe
.exe windows x86

361f5df611b9342348aeb50774fe5a96

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

UuidFromStringA

kernel32

FormatMessageA
HeapDestroy
GetFileAttributesA
HeapCreate
HeapValidate
HeapSize
LockFileEx
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetFileAttributesExW
GetCurrentProcessId
GetTempPathA
AreFileApisANSI
DeleteFileA
SetFileTime
GetThreadTimes
GetThreadContext
RtlCaptureContext
SetUnhandledExceptionFilter
VirtualQueryEx
TerminateThread
ReleaseSemaphore
OpenThread
CreateSemaphoreW
SuspendThread
ResumeThread
CreateThread
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
WaitForMultipleObjects
VirtualQuery
VirtualFree
VirtualAlloc
VirtualProtectEx
GetThreadPriority
GetTimeFormatA
SetEnvironmentVariableA
UnlockFileEx
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
RtlUnwind
GetStdHandle
GetFileType
WriteConsoleW
IsDebuggerPresent
UnhandledExceptionFilter
GetLogicalDrives
HeapSetInformation
ExitProcess
ExitThread
VirtualProtect
GetModuleHandleA
CreateWaitableTimerA
SetWaitableTimer
TlsSetValue
OpenEventA
TlsGetValue
TlsFree
TlsAlloc
InterlockedPopEntrySList
IsProcessorFeaturePresent
InterlockedPushEntrySList
LockFile
OutputDebugStringW
UnlockFile
InterlockedCompareExchange
UnmapViewOfFile
MapViewOfFile
CreateFileA
HeapReAlloc
GetFullPathNameA
LocalUnlock
LocalLock
LocalAlloc
CompareFileTime
GetComputerNameW
SetProcessWorkingSetSize
lstrcmpA
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
WritePrivateProfileStringW
MoveFileExW
SystemTimeToFileTime
GetSystemTime
LoadLibraryA
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
SetThreadPriority
GetTickCount
IsBadStringPtrW
CopyFileW
GetTempFileNameW
GetTempPathW
SetFileAttributesW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
GetSystemDirectoryW
GetCurrentThread
GetFullPathNameW
GetUserDefaultLangID
FileTimeToSystemTime
FileTimeToLocalFileTime
GetShortPathNameW
FindNextFileW
BackupSeek
BackupRead
GetCompressedFileSizeW
GetDriveTypeW
CreateDirectoryW
RemoveDirectoryW
SetEndOfFile
SetFilePointerEx
GetVolumeInformationW
GetDiskFreeSpaceW
MoveFileW
FindClose
FindFirstFileW
DeviceIoControl
GetSystemTimeAsFileTime
OutputDebugStringA
InitializeCriticalSection
GetLocalTime
GetModuleFileNameA
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
GetLocaleInfoW
VerifyVersionInfoW
VerSetConditionMask
GlobalMemoryStatus
GetSystemInfo
GetVersionExA
lstrlenA
GlobalHandle
lstrcmpW
GetDiskFreeSpaceExW
GetWindowsDirectoryW
GetProcessTimes
GetLongPathNameW
SetFilePointer
GetFileSize
ReadFile
GetVersion
CompareStringW
Sleep
lstrcpyW
GetPrivateProfileStringW
DeleteFileW
LocalFree
FormatMessageW
lstrcpynW
GetVersionExW
LoadLibraryW
MulDiv
SetCurrentDirectoryW
GetCurrentDirectoryW
QueryPerformanceCounter
QueryPerformanceFrequency
GetCommandLineW
CreateProcessW
GetStartupInfoW
SetErrorMode
InterlockedIncrement
InterlockedDecrement
LoadLibraryExW
lstrcmpiW
FreeLibrary
WriteFile
FlushFileBuffers
CreateFileW
GetFileAttributesW
WideCharToMultiByte
CreateMutexW
lstrlenW
GetProcAddress
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetLastError
RaiseException
GetCurrentThreadId
GetModuleFileNameW
FindResourceExW
GetModuleHandleW
CreateEventA
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
InterlockedExchange
ResetEvent
SetEvent
CreateEventW
GetLastError
OpenProcess
TerminateProcess
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
FlushInstructionCache
GetCurrentProcess
FindResourceW
LoadResource
LockResource
SizeofResource
SetStdHandle
GetDateFormatA

user32

MapDialogRect
SetWindowContextHelpId
SendDlgItemMessageW
DestroyAcceleratorTable
wsprintfW
GetForegroundWindow
GetDlgItemInt
GetNextDlgTabItem
SetDlgItemTextW
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
GetShellWindow
GetWindowInfo
SetMenuDefaultItem
LockWindowUpdate
PostQuitMessage
IsDialogMessageW
FindWindowExW
LoadIconW
GetComboBoxInfo
AdjustWindowRectEx
CreateDialogIndirectParamW
InvalidateRgn
CreateAcceleratorTableW
GetSystemMetrics
GetWindowPlacement
SystemParametersInfoA
GetMenuItemID
GetWindowThreadProcessId
WaitForInputIdle
EnumDisplaySettingsW
ExitWindowsEx
GetLastInputInfo
EmptyClipboard
GetWindowRect
UnregisterClassA
SetWindowPos
GetWindowLongW
GetParent
GetWindow
GetDesktopWindow
GetClientRect
MapWindowPoints
SetWindowLongW
SendMessageW
GetDlgItem
ScreenToClient
MoveWindow
GetDC
ReleaseDC
GetWindowTextW
SetWindowTextW
DefWindowProcW
InvalidateRect
BeginPaint
EndPaint
DrawTextW
GetActiveWindow
GetMenu
DrawEdge
SetLayeredWindowAttributes
DeleteMenu
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
SetPropW
GetWindowTextLengthW
SetScrollPos
GetScrollInfo
ScrollWindowEx
SetScrollInfo
AppendMenuW
GetScrollPos
OffsetRect
SendMessageTimeoutW
GetMonitorInfoW
MonitorFromWindow
GetAsyncKeyState
GetNextDlgGroupItem
DestroyCursor
GetLastActivePopup
MessageBeep
DrawIcon
GetDialogBaseUnits
LoadStringW
WinHelpW
SetClipboardData
WaitMessage
DrawTextExW
UnregisterClassW
CharLowerW
CharLowerA
GetDlgItemTextW
LoadBitmapW
EnableScrollBar
GetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
RemovePropW
DrawFrameControl
GetClassLongW
DrawFocusRect
DestroyIcon
DrawStateW
GetKeyState
GetMessagePos
CreateDialogParamW
FrameRect
DialogBoxParamW
IsChild
ChildWindowFromPoint
GetSysColor
SetRectEmpty
SetCursorPos
InsertMenuW
GetCursorPos
CreatePopupMenu
EnableMenuItem
PostMessageW
IsWindow
EndDialog
GetDlgCtrlID
PtInRect
RedrawWindow
TrackMouseEvent
GetSystemMenu
TrackPopupMenu
SetForegroundWindow
IsZoomed
SystemParametersInfoW
InflateRect
LoadImageW
CallWindowProcW
ShowWindow
KillTimer
SetTimer
DestroyWindow
FillRect
GetSysColorBrush
ClientToScreen
RegisterWindowMessageW
RegisterClassExW
GetClassInfoExW
LoadCursorW
CreateWindowExW
DestroyMenu
CopyRect
IsWindowEnabled
CheckDlgButton
IsDlgButtonChecked
GetClassNameW
IsWindowVisible
OpenIcon
FindWindowW
EnumWindows
IsIconic
SetFocus
SetRect
GetCapture
SetCapture
WindowFromPoint
ReleaseCapture
SetCursor
CharNextW
GetClassInfoW
RegisterClassW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
MessageBoxW
GetWindowDC
GetFocus
MsgWaitForMultipleObjects
IsWindowUnicode
EnableWindow
BringWindowToTop
UpdateWindow
DispatchMessageA
GetMessageA

gdi32

CreateBitmap
PatBlt
GetStockObject
TextOutW
RestoreDC
SaveDC
SetDIBColorTable
CreateDIBSection
CreatePatternBrush
GetClipBox
GetTextExtentPoint32W
GetTextMetricsW
ExcludeClipRect
CombineRgn
CreateRectRgnIndirect
GetDIBColorTable
StretchBlt
CreateFontIndirectW
SetTextColor
ExtTextOutW
SetBkColor
CreateSolidBrush
GetObjectW
GetTextColor
GetBkColor
UnrealizeObject
CreateDCW
CreateRectRgn
StrokeAndFillPath
EndPath
BeginPath
GetClipRgn
PolylineTo
Ellipse
LineTo
MoveToEx
CreatePen
SetBkMode
DeleteDC
SelectObject
SetViewportOrgEx
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
BitBlt
SelectClipRgn
Rectangle
GetDeviceCaps

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
ConvertSidToStringSidW
CloseEventLog
ClearEventLogW
OpenEventLogW
LookupPrivilegeNameW
RegUnLoadKeyW
RegLoadKeyW
RegNotifyChangeKeyValue
GetUserNameW
LookupAccountNameW
CopySid
GetLengthSid
LookupAccountSidW
EqualSid
OpenThreadToken
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
RegCloseKey
RegOpenKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW
OpenProcessToken
GetTokenInformation
LookupPrivilegeValueW
AdjustTokenPrivileges
FreeSid
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
GetFileSecurityW
DuplicateToken
MapGenericMask
AccessCheck
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
DragQueryFileW
DragFinish
ShellExecuteExW
Shell_NotifyIconW
ExtractIconExW
SHGetFileInfoW
SHEmptyRecycleBinW
SHAddToRecentDocs
ShellExecuteW

ole32

CoSetProxyBlanket
CoInitializeEx
CoUninitialize
CoInitialize
PropVariantClear
OleLockRunning
StringFromGUID2
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CoInitializeSecurity
DoDragDrop
RegisterDragDrop
RevokeDragDrop
OleDuplicateData
ReleaseStgMedium
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
OleUninitialize
OleInitialize
CreateStreamOnHGlobal

oleaut32

LoadRegTypeLi
LoadTypeLi
DispCallFunc
OleCreateFontIndirect
SysAllocStringLen
VarBstrFromI4
VariantChangeType
VariantTimeToSystemTime
SysStringLen
VariantInit
VariantClear
SysAllocString
VarUI4FromStr
SysFreeString
VarBstrFromR8

shlwapi

PathFindExtensionW
PathCombineW
PathRemoveExtensionA
PathRemoveExtensionW
PathAddExtensionW
PathStripToRootW
PathSkipRootW
PathRemoveArgsW
PathGetDriveNumberW
PathCompactPathW
PathRemoveFileSpecW
PathIsDirectoryW
PathFileExistsW
PathAppendW
PathMatchSpecW
PathUnquoteSpacesW
SHStrDupW
PathStripPathW
PathIsURLW
PathCreateFromUrlW
PathStripPathA
PathIsUNCW
PathIsRelativeW
PathFindFileNameW
ord487
StrRetToStrW
PathIsDirectoryEmptyW
PathRemoveBackslashW

comctl32

ImageList_GetIcon
ImageList_LoadImageW
ImageList_Add
ImageList_ReplaceIcon
ImageList_GetImageCount
ImageList_GetIconSize
ImageList_Draw
ImageList_Destroy
InitCommonControlsEx
ImageList_Duplicate
ImageList_SetIconSize
ImageList_Remove
_TrackMouseEvent
ImageList_Create

msimg32

TransparentBlt
AlphaBlend

gdiplus

GdipCloneBrush
GdipCreateSolidFill
GdipFillRectangleI
GdipCreateFromHDC
GdipSetSmoothingMode
GdipAddPathPieI
GdipIsVisiblePathPointI
GdipCreatePen1
GdipDeletePen
GdipDrawRectangleI
GdipCreateHatchBrush
GdipFillPieI
GdipDrawPieI
GdipCreateBitmapFromFile
GdipDeleteBrush
GdipDeletePath
GdipCreatePath
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromStream
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImagePaletteSize
GdipGetImagePalette
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateBitmapFromScan0
GdipCloneImage
GdipAlloc
GdipFree
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageI
GdipDisposeImage

uxtheme

IsThemeActive
GetThemeInt
OpenThemeData
GetThemeColor
DrawThemeEdge
GetThemeBackgroundContentRect
DrawThemeBackground
CloseThemeData

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

netapi32

NetApiBufferFree
NetLocalGroupGetMembers

crypt32

CryptDecodeObject
CertFindCertificateInStore
CertGetNameStringW
CertFreeCertificateContext
CryptQueryObject
CryptMsgGetParam
CertCloseStore
CryptMsgClose

wintrust

WinVerifyTrust

esent

JetSetCurrentIndex4
JetRollback
JetCommitTransaction
JetDelete
JetRetrieveColumn
JetBeginTransaction
JetEnumerateColumns
JetMove
JetOpenTable
JetOpenDatabase
JetAttachDatabase2
JetCreateDatabase2
JetBeginSession
JetInit2
JetCreateInstance2
JetSetSystemParameter
JetTerm2
JetEndSession
JetCloseDatabase
JetCloseTable
JetGetDatabaseFileInfo
JetDeleteTable

iphlpapi

GetAdaptersAddresses

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wininet

DeleteUrlCacheEntryW
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW
InternetConnectW
DeleteUrlCacheEntryA
InternetQueryDataAvailable
InternetCloseHandle
InternetReadFile
HttpQueryInfoW
InternetOpenUrlW
InternetOpenW
FindNextUrlCacheEntryExW
FindFirstUrlCacheEntryExW
FindCloseUrlCache
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
InternetCrackUrlW

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 840KB - Virtual size: 839KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 348KB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 367KB - Virtual size: 368KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

361f5df611b9342348aeb50774fe5a96

Headers

DLL Characteristics

File Characteristics

Imports

rpcrt4

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

uxtheme

wtsapi32

netapi32

crypt32

wintrust

esent

iphlpapi

version

wininet

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.rdata Size: 840KB - Virtual size: 839KB

.data Size: 348KB - Virtual size: 2.4MB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 2.0MB - Virtual size: 2.0MB

.reloc Size: 367KB - Virtual size: 368KB

.text
Size: 2.9MB - Virtual size: 2.9MB

.rdata
Size: 840KB - Virtual size: 839KB

.data
Size: 348KB - Virtual size: 2.4MB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

.reloc
Size: 367KB - Virtual size: 368KB