4e4c04b07bd616d79d939dc0c5a05c86_mafia_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4e4c04b07bd616d79d939dc0c5a05c86_mafia_JC.exe
Size

2.4MB
MD5

4e4c04b07bd616d79d939dc0c5a05c86
SHA1

c991cced9884b6fb315255a57caeb07207ff4ff9
SHA256

eb8a08c1bbed998660425704c1861fd85dc0ccd43e6bf6c67a6c4f9e0ba2383f
SHA512

5cd8b6bbb35b40ac829d68f78e5a3995040135d2cc04afb8f9024813a6f5cd48173ee8c6d1b94777c5da583f2c542b01255e7a7e4f02f2f144233c5af9d6e2c8
SSDEEP

49152:KSvshJx6C+29c2TC77ObkyMTLXr3kygSJn1F2x:KSvsh6CBSekyMTLXpgq1F2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4e4c04b07bd616d79d939dc0c5a05c86_mafia_JC.exe

Files

4e4c04b07bd616d79d939dc0c5a05c86_mafia_JC.exe
.exe windows x86

385be78d4b30e43c4135b8dfc88095fa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

mixerGetNumDevs
mixerOpen
mixerSetControlDetails
mixerGetLineInfoW
mixerGetLineControlsW
mixerClose
mixerGetDevCapsW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

comdlg32

GetOpenFileNameW
PrintDlgW
PageSetupDlgW
CommDlgExtendedError
ChooseColorW
GetSaveFileNameW
ChooseFontW

winspool.drv

GetPrinterW
ClosePrinter
OpenPrinterW

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW

kernel32

SetEvent
ResumeThread
GetDateFormatW
GetTimeFormatW
IsDBCSLeadByte
SuspendThread
FormatMessageW
GetSystemTimeAsFileTime
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedCompareExchange
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
GetConsoleMode
GetConsoleCP
GetStringTypeW
IsValidCodePage
GetOEMCP
GetACP
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
CreateEventW
TlsFree
GetFileAttributesW
TlsGetValue
TlsAlloc
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetLocaleInfoA
LCMapStringW
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
GetCPInfo
VirtualQuery
GetSystemInfo
VirtualProtect
GetLocalTime
ExitProcess
ExitThread
RtlUnwind
GetStartupInfoW
HeapSetInformation
DecodePointer
EncodePointer
InitializeCriticalSection
LocalFree
LoadLibraryA
LocalAlloc
SetEnvironmentVariableA
WaitForSingleObject
GetExitCodeProcess
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileInformationByHandle
GetLongPathNameW
GetShortPathNameW
GetCommandLineW
lstrlenA
QueryPerformanceCounter
QueryPerformanceFrequency
CompareStringW
RemoveDirectoryW
SetFileAttributesW
GetFileSize
ReadFile
GetLogicalDriveStringsW
DeleteFileW
MoveFileW
VerSetConditionMask
VerifyVersionInfoW
GetTempPathW
GetTempFileNameW
DeviceIoControl
GetVolumeInformationW
GlobalHandle
GetSystemTime
GetDiskFreeSpaceExW
CreateProcessW
FindNextFileW
GetSystemDirectoryW
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
IsBadWritePtr
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcessId
GetProfileStringW
lstrcpynA
GetVersionExW
lstrcmpiW
SetLastError
lstrcpyW
lstrcpynW
GlobalAlloc
GlobalLock
GlobalUnlock
GetTickCount
MulDiv
GlobalFree
GetLocaleInfoW
lstrcatW
lstrcmpW
CreateDirectoryW
GetFullPathNameW
CreateThread
RaiseException
DeleteCriticalSection
GetCurrentThreadId
InterlockedExchange
LoadLibraryW
GetCurrentDirectoryW
FreeLibrary
HeapCreate
WideCharToMultiByte
FindFirstFileW
FindClose
GetModuleFileNameW
lstrlenW
GetModuleHandleW
GetProcAddress
GetCurrentProcess
FlushInstructionCache
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
CreateFileW
WriteFile
CopyFileW
CloseHandle
CreateMutexW
SetEndOfFile
CreateFileA
GetDriveTypeW
WriteConsoleW
GetLastError
Sleep
SetFilePointer
FlushFileBuffers
SetStdHandle
TlsSetValue
GetUserDefaultLCID
IsValidLocale
EnumSystemLocalesA
SetUnhandledExceptionFilter

user32

GetParent
GetDlgItem
MapWindowPoints
GetClientRect
GetMonitorInfoW
MonitorFromWindow
GetWindowLongW
GetWindowRect
GetWindow
LoadCursorW
SetDlgItemTextW
EndDialog
GetActiveWindow
EnableWindow
LoadStringW
IsWindowEnabled
SetWindowTextW
SetWindowPos
BeginDeferWindowPos
GetScrollPos
SetScrollPos
GetScrollRange
SetScrollRange
GetScrollInfo
EnableScrollBar
EndDeferWindowPos
MsgWaitForMultipleObjectsEx
IsWindowUnicode
GetMessageA
DispatchMessageA
GetTopWindow
SetLayeredWindowAttributes
IsRectEmpty
SetWindowRgn
TrackPopupMenu
CheckMenuItem
AdjustWindowRectEx
IsDialogMessageW
SetWindowContextHelpId
SendDlgItemMessageW
MapDialogRect
CreateDialogParamW
IsZoomed
GetMenu
GetDlgItemTextW
CreateDialogIndirectParamW
WaitForInputIdle
EnumThreadWindows
ModifyMenuW
MonitorFromPoint
TrackPopupMenuEx
InvalidateRgn
MoveWindow
CreateAcceleratorTableW
DeferWindowPos
DestroyIcon
CheckRadioButton
GetCaretPos
GetAsyncKeyState
RegisterClipboardFormatW
SetScrollInfo
GetComboBoxInfo
EqualRect
IntersectRect
ChildWindowFromPoint
UnregisterClassA
GetClassNameW
IsChild
DestroyAcceleratorTable
DrawFrameControl
SetRect
CallNextHookEx
GetSysColorBrush
GetWindowThreadProcessId
CharLowerW
UnhookWindowsHookEx
SetWindowsHookExW
DrawEdge
IsDlgButtonChecked
GetDlgItemInt
SetDlgItemInt
CheckDlgButton
GetSystemMetrics
SystemParametersInfoW
GetWindowDC
RemoveMenu
AppendMenuW
CreatePopupMenu
GetMessagePos
CharNextW
PtInRect
LoadStringA
PostQuitMessage
GetMenuItemCount
DeleteMenu
wsprintfW
InsertMenuW
SetMenuDefaultItem
GetMenuItemInfoW
SetMenuItemInfoW
DestroyMenu
SetRectEmpty
LoadAcceleratorsW
TranslateAcceleratorW
GetMenuStringW
DialogBoxParamW
IsMenu
GetClassInfoExW
RegisterClassExW
LoadMenuW
EnableMenuItem
LoadBitmapW
GetMessageW
TranslateMessage
DispatchMessageW
BringWindowToTop
KillTimer
SetTimer
GetDoubleClickTime
EndPaint
BeginPaint
GetKeyState
GetDesktopWindow
wvsprintfW
GetFocus
SetMenu
PostMessageW
IsWindowVisible
GetKeyboardLayout
GetSubMenu
LoadIconW
UpdateWindow
SetFocus
MsgWaitForMultipleObjects
MessageBeep
DestroyWindow
EnumWindows
SetForegroundWindow
IsIconic
ShowWindow
SendMessageTimeoutW
FrameRect
DrawTextW
CallWindowProcW
CreateWindowExW
DrawFocusRect
FillRect
DefWindowProcW
OffsetRect
InflateRect
CopyRect
ReleaseDC
GetDC
GetDlgCtrlID
SetCapture
SetCursor
MessageBoxW
SendMessageW
IsWindow
RegisterWindowMessageW
DestroyCursor
GetSysColor
LoadImageW
GetIconInfo
ReleaseCapture
WindowFromPoint
GetCapture
GetCursorPos
PeekMessageW
SetWindowLongW
DrawStateW
GetWindowTextW
GetWindowTextLengthW
ClientToScreen
ScreenToClient
InvalidateRect
RedrawWindow

advapi32

RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegDeleteKeyW
RegEnumKeyExW
RegQueryInfoKeyW
CryptAcquireContextW
CryptImportKey
CryptReleaseContext
CryptDestroyKey
CryptGenKey
CryptExportKey
CryptEncrypt
CryptGetUserKey
CryptDecrypt
CryptDestroyHash
CryptDeriveKey
CryptHashData
CryptCreateHash
RegCreateKeyExW

ole32

OleUninitialize
CreateStreamOnHGlobal
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
StringFromGUID2
CoTaskMemAlloc
OleLockRunning
CoTaskMemFree
CoTaskMemRealloc
OleRun
RegisterDragDrop
OleDuplicateData
ReleaseStgMedium
RevokeDragDrop
DoDragDrop
OleInitialize

shell32

SHGetSpecialFolderLocation
DragQueryFileW
SHGetPathFromIDListW
SHGetMalloc
DragQueryPoint
DragFinish
SHGetDesktopFolder
SHFileOperationW
DragAcceptFiles
ShellExecuteExW
FindExecutableW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW

oleaut32

OleTranslateColor
SysAllocStringLen
SysStringLen
SysFreeString
VariantCopy
VariantChangeType
VariantClear
VariantInit
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SafeArrayDestroy
OleCreateFontIndirect
SafeArrayAccessData
SafeArrayCreate
DispCallFunc
VarDateFromStr
VarI4FromStr
VarR8FromStr
VarDecFromStr
VarDecCmp
VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrCmp
LoadRegTypeLi
LoadTypeLi
SafeArrayUnaccessData
GetErrorInfo
VarUI4FromStr

shlwapi

PathIsDirectoryW
PathRemoveFileSpecW
PathAppendW
PathAddBackslashW
PathUnquoteSpacesW
PathRemoveArgsW
PathGetArgsW
PathCanonicalizeW
PathRelativePathToW
PathIsFileSpecW
PathRenameExtensionW
PathFileExistsW

comctl32

ImageList_Destroy
ImageList_DrawEx
ImageList_DragLeave
ImageList_DragEnter
ImageList_DragShowNolock
ImageList_DragMove
ImageList_EndDrag
ImageList_GetIcon
InitCommonControlsEx
_TrackMouseEvent
ImageList_GetImageCount
ImageList_AddMasked
ImageList_Create
ImageList_LoadImageW
ImageList_Draw
ImageList_DrawIndirect
CreateStatusWindowW
ord8
ImageList_GetIconSize
ImageList_BeginDrag

gdi32

DeleteObject
GetObjectW
DeleteDC
SetTextColor
BitBlt
SetBkColor
SelectObject
CreateCompatibleDC
CreateBitmap
CreateCompatibleBitmap
SetBkMode
CreateSolidBrush
MoveToEx
LineTo
CreatePen
ExtTextOutW
SetViewportOrgEx
GetDeviceCaps
SetMapMode
GetMapMode
DPtoLP
SaveDC
RestoreDC
EndDoc
AbortDoc
StartDocW
DeleteEnhMetaFile
CreateEnhMetaFileW
CloseEnhMetaFile
EnumFontsW
ResetDCW
GetTextMetricsW
StartPage
EndPage
CreateDCW
GetBkColor
TextOutW
GetEnhMetaFileHeader
OffsetWindowOrgEx
PlayEnhMetaFile
CreateFontIndirectW
Rectangle
SetBrushOrgEx
SelectClipRgn
CreatePatternBrush
CreateRectRgnIndirect
CombineRgn
PatBlt
CreateDIBSection
GetTextExtentPoint32W
SetDCPenColor
SetWindowOrgEx
ModifyWorldTransform
SetGraphicsMode
CreateRectRgn
GetPixel
Polygon
CreatePolygonRgn
GetTextColor
FillRgn
FrameRgn
GetClipBox
RoundRect
GetStockObject

msimg32

AlphaBlend
GradientFill

wininet

InternetGetConnectedState

gdiplus

GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToFile
GdipCreateFontFamilyFromName
GdipDrawString
GdipCreateFromHWNDICM
GdipCreateFromHWND
GdipCreateStringFormat
GdipCloneImage
GdipDisposeImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipDrawImageI
GdipFillRectangleI
GdipDeleteGraphics
GdipCreateFromHDC
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipDeleteFontFamily
GdipMeasureString
GdipFillPath
GdipDrawPath
GdipSetSmoothingMode
GdipSetInterpolationMode
GdipGetImageGraphicsContext
GdipAddPathStringI
GdipDeletePath
GdipCreatePath
GdipSetStringFormatAlign
GdipSetPenLineJoin
GdipDeletePen
GdipCreatePen1
GdipGetImageWidth
GdipCreateFont

wsock32

ntohs
shutdown
closesocket
ntohl
send
WSAGetLastError
select
recv
WSACleanup
gethostbyname
ioctlsocket
getsockopt
connect
inet_ntoa
htons
setsockopt
socket
WSAStartup
listen
bind
htonl
__WSAFDIsSet
accept

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.secure
Size: 512B - Virtual size: 63B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 244KB - Virtual size: 243KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 65B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 280KB - Virtual size: 280KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

385be78d4b30e43c4135b8dfc88095fa

Headers

DLL Characteristics

File Characteristics

Imports

winmm

version

comdlg32

winspool.drv

rpcrt4

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

comctl32

gdi32

msimg32

wininet

gdiplus

wsock32

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.secure Size: 512B - Virtual size: 63B

.rdata Size: 244KB - Virtual size: 243KB

.data Size: 36KB - Virtual size: 53KB

.tls Size: 512B - Virtual size: 65B

.rsrc Size: 280KB - Virtual size: 280KB

.reloc Size: 82KB - Virtual size: 82KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.secure
Size: 512B - Virtual size: 63B

.rdata
Size: 244KB - Virtual size: 243KB

.data
Size: 36KB - Virtual size: 53KB

.tls
Size: 512B - Virtual size: 65B

.rsrc
Size: 280KB - Virtual size: 280KB

.reloc
Size: 82KB - Virtual size: 82KB