3ff2618441dd7eb900a3b89b44e1af23_mafia_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

3ff2618441dd7eb900a3b89b44e1af23_mafia_JC.exe
Size

1.4MB
MD5

3ff2618441dd7eb900a3b89b44e1af23
SHA1

a92f58e37b058b9fd736385ecc3edaf69ed0fdb7
SHA256

8bee5f8bbcf9fb19a66490eff156c75f40762ab11ee0b21c1d49928ba7ad2c2d
SHA512

885ce654b93c090698f7edbc9770dc4bcde319e4308bdd5d88f195785a21f114cca164f4c390eb594971ddcb10fcd71fe17a5e1d95fd5ac48cd9e9e242af21e7
SSDEEP

24576:yQHdcoXoqGRvhkDmG8FToK093g/XUlvoqMRTUW9UChXIfPr2pxE+FdpBNwYAhUex:vd/MyDmG8FToK093sXUlvoqMRTUc9hXk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3ff2618441dd7eb900a3b89b44e1af23_mafia_JC.exe

Files

3ff2618441dd7eb900a3b89b44e1af23_mafia_JC.exe
.exe windows x86

740b81b2fcf35b46b36ea878153c1538

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
GetFileSize
FormatMessageA
GetLastError
FormatMessageW
GetModuleHandleA
HeapFree
GetProcessHeap
IsDBCSLeadByteEx
WriteFile
CreateFileW
SetFilePointer
SetLastError
HeapAlloc
WritePrivateProfileStringA
WritePrivateProfileSectionA
GetPrivateProfileStringA
GetPrivateProfileSectionA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
OutputDebugStringA
LocalFree
LocalAlloc
GetModuleFileNameA
CreateThread
lstrlenW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
lstrcmpiA
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
IsDBCSLeadByte
lstrcmpA
MulDiv
FindResourceA
LoadLibraryExA
QueryPerformanceCounter
QueryPerformanceFrequency
GetLocaleInfoA
lstrcpynA
GetModuleHandleW
FreeResource
GetCommandLineA
SetEnvironmentVariableA
WriteConsoleW
SetStdHandle
GetDriveTypeW
SetConsoleCtrlHandler
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
FatalAppExitA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
SetHandleCount
GetLocaleInfoW
GetStringTypeW
GetConsoleMode
GetConsoleCP
GetModuleFileNameW
GetStdHandle
GetCurrentThread
TlsFree
TlsSetValue
LoadLibraryA
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFileType
GetDriveTypeA
GetFileInformationByHandle
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringW
GetCPInfo
CompareStringW
GetStartupInfoW
HeapSetInformation
VirtualQuery
VirtualProtect
GetDateFormatA
GetTimeFormatA
RtlUnwind
FindFirstFileExA
FindClose
AreFileApisANSI
CreateFileMappingA
CreateFileMappingW
CreateMutexW
DeleteFileW
FlushFileBuffers
GetCurrentProcessId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetFileAttributesW
GetFileAttributesExW
GetFullPathNameA
GetFullPathNameW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetTickCount
HeapCreate
HeapValidate
LoadLibraryW
LockFile
LockFileEx
MapViewOfFile
SetEndOfFile
SystemTimeToFileTime
UnlockFile
UnlockFileEx
UnmapViewOfFile
DeviceIoControl
GetDiskFreeSpaceExA
GlobalAlloc
GlobalLock
GlobalFree
GlobalUnlock
GetStartupInfoA
CreateProcessA
CreateToolhelp32Snapshot
Process32First
OpenProcess
Process32Next
TerminateProcess
lstrcatA
WinExec
CreateFileA
GetFileTime
CloseHandle
FileTimeToLocalFileTime
GetProcAddress
FreeLibrary
WaitForSingleObject
CreateDirectoryA
GetFileAttributesA
SetFileAttributesA
lstrcpyA
lstrlenA
GetVersionExA
MultiByteToWideChar
DeleteFileA
WideCharToMultiByte
FindResourceExW
FindResourceW
LoadResource
LockResource
RaiseException
OutputDebugStringW
DecodePointer
EncodePointer
InterlockedExchange
Sleep
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapDestroy
PeekNamedPipe
FileTimeToSystemTime
SizeofResource
TlsGetValue

user32

EndDialog
TranslateMessage
DispatchMessageA
UnregisterClassA
wsprintfA
SendMessageA
FindWindowA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
RegisterClipboardFormatA
MessageBoxA
DestroyWindow
CharNextA
SetWindowLongA
GetWindowLongA
PostMessageA
SetWindowTextA
GetWindowTextA
SetWindowPos
GetWindowRect
GetClientRect
ClientToScreen
ScreenToClient
GetDC
ShowWindow
SetDlgItemTextA
GetParent
GetDlgItem
SetScrollInfo
IsWindow
MapWindowPoints
GetMonitorInfoA
MonitorFromWindow
GetWindow
GetClassInfoExA
LoadCursorA
CallWindowProcA
PostQuitMessage
SetFocus
MessageBeep
PeekMessageA
DefWindowProcA
CreateWindowExA
RegisterClassExA
DialogBoxParamA
GetSysColor
MoveWindow
ReleaseDC
InvalidateRect
InvalidateRgn
RedrawWindow
SetCapture
IsChild
GetClassNameA
ReleaseCapture
FillRect
EndPaint
BeginPaint
DestroyAcceleratorTable
GetFocus
GetDesktopWindow
GetWindowTextLengthA
CreateAcceleratorTableA
IsDialogMessageA
CreateDialogParamA
CharNextW
GetSystemMetrics
CopyRect
DrawTextA
TranslateAcceleratorA
GetActiveWindow
PtInRect
KillTimer
SetTimer
RegisterWindowMessageA
GetMessageA

gdi32

CreateSolidBrush
CreatePen
SetTextColor
SetBkMode
Rectangle
SetBkColor
ExtTextOutA
GetStockObject
GetObjectA
GetTextExtentPoint32A
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
SelectObject
DeleteObject
GetTextMetricsA

advapi32

RegQueryValueA
RegQueryInfoKeyA
RegEnumKeyExA
RegQueryInfoKeyW
RegCreateKeyExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegEnumKeyA
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyA
RegSetValueExA
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey

shell32

SHGetSpecialFolderPathA
SHBrowseForFolderA
SHGetSpecialFolderLocation
SHGetFileInfoA
SHGetPathFromIDListA
ShellExecuteA
DragQueryFileA
SHAppBarMessage
ShellExecuteExA
SHChangeNotify
SHFileOperationA
SHFreeNameMappings
SHGetMalloc
SHGetDesktopFolder

ole32

CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoRegisterClassObject
StringFromGUID2
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoResumeClassObjects
ProgIDFromCLSID
CoRevokeClassObject
CoTaskMemFree
CoCreateInstance
CoInitialize
CoCreateGuid

oleaut32

VariantChangeType
UnRegisterTypeLi
SafeArrayCreate
SafeArrayGetElemsize
SafeArrayAccessData
SafeArrayUnaccessData
OleCreateFontIndirect
VariantClear
VariantInit
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
SysAllocString
SysAllocStringLen
SysStringLen
CreateErrorInfo
SysFreeString
GetErrorInfo
SetErrorInfo
RegisterTypeLi

comctl32

InitCommonControlsEx

urlmon

FindMimeFromData
CoInternetGetSession

iconv

libiconv
libiconv_close
libiconv_open

gdiplus

GdiplusShutdown
GdiplusStartup
GdipGetImageThumbnail
GdipCloneImage
GdipAlloc
GdipFree
GdipDisposeImage
GdipSaveImageToFile
GdipSaveImageToStream
GdipCreateBitmapFromHBITMAP
GdipGetImageEncodersSize
GdipGetImageEncoders

wininet

HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
InternetConnectA
InternetSetOptionA
InternetOpenW
InternetSetOptionW
InternetReadFile
InternetConnectW
HttpSendRequestW
HttpSendRequestExW
InternetOpenA
InternetCloseHandle
InternetGetConnectedState
HttpQueryInfoA
InternetSetCookieA
HttpQueryInfoW

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

iphlpapi

GetAdaptersInfo

winmm

waveOutSetVolume

Sections

.text
Size: 881KB - Virtual size: 880KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 294KB - Virtual size: 294KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

740b81b2fcf35b46b36ea878153c1538

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

urlmon

iconv

gdiplus

wininet

version

iphlpapi

winmm

Sections

.text Size: 881KB - Virtual size: 880KB

.rdata Size: 161KB - Virtual size: 161KB

.data Size: 18KB - Virtual size: 32KB

.rsrc Size: 294KB - Virtual size: 294KB

.reloc Size: 34KB - Virtual size: 34KB

.text
Size: 881KB - Virtual size: 880KB

.rdata
Size: 161KB - Virtual size: 161KB

.data
Size: 18KB - Virtual size: 32KB

.rsrc
Size: 294KB - Virtual size: 294KB

.reloc
Size: 34KB - Virtual size: 34KB