4f3aa1ebf412e27622ad95efde1d5716_mafia_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4f3aa1ebf412e27622ad95efde1d5716_mafia_JC.exe
Size

82KB
MD5

4f3aa1ebf412e27622ad95efde1d5716
SHA1

ef070e9975c34d424b19e6aad51defe4b1de42e0
SHA256

9b18112cd9f735778ede0a8d77f0f247ee026e6bde259ef29844855b28608ba4
SHA512

2f377b5273937874b2ef5f2c498d8bed1762af3382dbe0b6b64bc61b9bc63ee543a925e852b66c9a7f1f6fc4d1d85c3e25a4de0311748b45bb6c2dc570a5716d
SSDEEP

1536:Sz0kCSZnv2LKNr5wU83gJ5PD9bIBUBFdZ:Sgk/nbB5mgvP6BUBjZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4f3aa1ebf412e27622ad95efde1d5716_mafia_JC.exe

Files

4f3aa1ebf412e27622ad95efde1d5716_mafia_JC.exe
.exe windows x86

a1f9e562956f97806b8f2f448af354bd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetWindowThreadProcessId
PostMessageA
EnumWindows

shell32

SHChangeNotify

kernel32

TerminateProcess
WaitForSingleObject
OpenProcess
Sleep
FreeLibrary
GetProcAddress
LoadLibraryA
CreateProcessA
CloseHandle
CreateFileA
FindClose
FindNextFileA
DeleteFileA
FindFirstFileA
WriteFile
CreateDirectoryA
LCMapStringW
GetStringTypeW
IsProcessorFeaturePresent
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
ReadFile
GetFileType
GetCommandLineA
HeapSetInformation
MultiByteToWideChar
GetModuleHandleW
ExitProcess
DecodePointer
SetUnhandledExceptionFilter
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
IsValidLocale
GetStartupInfoW
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
GetCurrentThread
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsDebuggerPresent
GetCurrentProcess
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
SetEnvironmentVariableW
HeapFree
SetEnvironmentVariableA
SetConsoleCtrlHandler
InterlockedExchange
LoadLibraryW
GetLocaleInfoW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
CompareStringW
HeapAlloc
HeapReAlloc
HeapSize

advapi32

RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
RegCloseKey
RegDeleteKeyA

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a1f9e562956f97806b8f2f448af354bd

Headers

DLL Characteristics

File Characteristics

Imports

user32

shell32

kernel32

advapi32

Sections

.text Size: 60KB - Virtual size: 59KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 6KB - Virtual size: 8KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 60KB - Virtual size: 59KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 6KB - Virtual size: 8KB

.reloc
Size: 3KB - Virtual size: 3KB