538a9cce40d2ce4a477d47c5b371c3a1_mafia_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

538a9cce40d2ce4a477d47c5b371c3a1_mafia_JC.exe
Size

2.4MB
MD5

538a9cce40d2ce4a477d47c5b371c3a1
SHA1

e60b431e1af149fa4ee72f4d44809c999b69a399
SHA256

dbd7ef1c3450e77bfb4fba531f6abd191f57171de50147249329f692418a51b4
SHA512

4cce1db7af4b794d2b117995c5dff02d6c2bddfe03bf831845eec33b0937067c62b819058a4dd7cf7c01e7fc3a4a2d0a6db04251d2394385b45636778390c8a3
SSDEEP

49152:7WDI/7hEPvRjVgbm3VwTZNrl37tfNY+YDj:7WDsEPvRjybmI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
538a9cce40d2ce4a477d47c5b371c3a1_mafia_JC.exe

Files

538a9cce40d2ce4a477d47c5b371c3a1_mafia_JC.exe
.exe windows x86

97f5c5cdc5e80758b7adff3a733244ad

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
ConvertSidToStringSidW
GetLengthSid
GetSecurityInfo
CopySid
GetUserNameW
GetTokenInformation
OpenProcessToken
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenCurrentUser
RegQueryValueExW
RegNotifyChangeKeyValue
GetSidSubAuthority
GetSidSubAuthorityCount
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
IsValidSid

kernel32

TerminateProcess
GetModuleFileNameA
IsDebuggerPresent
GetCurrentThreadId
OutputDebugStringA
ReleaseMutex
CloseHandle
DebugBreak
GetTempPathA
GlobalAlloc
LocalFree
ResetEvent
SetEvent
WaitForMultipleObjects
CreateThread
Sleep
GetVersionExW
InterlockedCompareExchange
GetSystemTimeAsFileTime
SystemTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
QueryPerformanceCounter
FindFirstFileW
FindNextFileW
GetFullPathNameW
DeleteFileW
RemoveDirectoryW
GetSystemTime
LockResource
FindResourceExW
FindClose
MulDiv
SetProcessWorkingSetSize
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateFileW
GetTickCount
WriteFile
ExitThread
LoadLibraryW
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
HeapAlloc
HeapFree
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeW
CancelIo
ReadFile
GetOverlappedResult
FlushInstructionCache
SetLastError
InterlockedExchange
EncodePointer
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WideCharToMultiByte
HeapSetInformation
GetStartupInfoW
ExitProcess
VirtualProtect
VirtualQuery
RtlUnwind
GetCPInfo
LCMapStringW
GetStdHandle
HeapCreate
GetLocaleInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetTimeZoneInformation
SetFilePointer
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
SetStdHandle
CreateFileA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
GetThreadLocale
CopyFileW
SetFileAttributesW
GetTempPathW
GetFileSizeEx
CreateDirectoryW
GetFileAttributesW
GetCurrentDirectoryW
CreateMutexW
WaitForSingleObject
GetCurrentProcess
CreateProcessW
GlobalFree
GlobalLock
GlobalUnlock
SetThreadPriority
ResumeThread
OpenThread
FormatMessageA
GetModuleHandleA
AllocConsole
LoadLibraryA
GetLongPathNameW
GetTempFileNameW
MoveFileW
GetFileAttributesExW
GetDiskFreeSpaceExW
GetDriveTypeW
GetUserDefaultUILanguage
VerSetConditionMask
VerifyVersionInfoW
FindFirstFileExW
GetFileInformationByHandle
PeekNamedPipe
GetDriveTypeA
FindFirstFileExA
GetFullPathNameA
GetCommandLineW
InitializeCriticalSection
CreateEventW
GetCurrentProcessId
ProcessIdToSessionId
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
FindResourceW
LoadResource
GetFileSize
SizeofResource
RaiseException
lstrcmpiW
lstrlenW
FreeLibrary
GetModuleFileNameW
GetProcAddress
GetModuleHandleW
GetLastError
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
MultiByteToWideChar

user32

SetWindowPos
LoadCursorW
DestroyMenu
CreatePopupMenu
TrackPopupMenu
TrackPopupMenuEx
GetShellWindow
GetDC
ReleaseDC
AppendMenuW
SetMenuItemBitmaps
SendMessageW
UnregisterClassA
MoveWindow
GetWindowRect
BeginPaint
EndPaint
InvalidateRect
InvalidateRgn
ShowWindow
IsWindowVisible
CharNextW
IsWindowEnabled
SetCapture
SetWindowRgn
GetClassInfoExW
SetRect
TrackMouseEvent
GetKeyState
ReleaseCapture
UpdateLayeredWindow
OffsetRect
SetCursor
IntersectRect
MessageBoxA
wvsprintfW
wsprintfW
MessageBoxW
IsWindow
DispatchMessageW
DefWindowProcW
CreateWindowExW
SetWindowLongW
PeekMessageW
GetWindowLongW
RegisterClassExW
TranslateMessage
KillTimer
PostMessageW
PostQuitMessage
GetMessageW
SetTimer
DestroyWindow
GetMonitorInfoW
SetWindowTextW
GetCursorPos
EndDialog
GetDlgItem
SetCursorPos
GetForegroundWindow
SetFocus
DialogBoxParamW
MonitorFromPoint
ScreenToClient
ClientToScreen

ole32

CoInitializeEx
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoInitialize
CoUninitialize
CoCreateGuid
CreateStreamOnHGlobal

oleaut32

SysFreeString
SysStringLen
SysAllocString
VarUI4FromStr

gdi32

EnumEnhMetaFile
CloseEnhMetaFile
CreateEnhMetaFileW
GetCurrentObject
GetFontUnicodeRanges
GetTextMetricsW
GetOutlineTextMetricsW
GetObjectA
AddFontMemResourceEx
DeleteEnhMetaFile
CreateFontIndirectW
CreateRectRgn
BitBlt
CreateCompatibleDC
DeleteDC
CombineRgn
ExtCreateRegion
GetDIBits
CreateDCW
GetObjectW
DeleteObject
RemoveFontMemResourceEx
SelectObject
GetDeviceCaps
CreateDIBSection

gdiplus

GdipCreateFromHDC
GdipGraphicsClear
GdiplusStartup
GdipCloneImage
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipGetImageEncodersSize
GdipAlloc
GdipCreateBitmapFromScan0
GdipFree
GdipRestoreGraphics
GdiplusShutdown
GdipBitmapGetPixel
GdipGetImagePixelFormat
GdipDrawImageRectRectI
GdipPrivateAddFontFile
GdipDrawImageI
GdipSetClipGraphics
GdipCloneFontFamily
GdipCreateRegion
GdipDeleteRegion
GdipSetEmpty
GdipCombineRegionRect
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipSetImageAttributesRemapTable
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipImageRotateFlip
GdipGetImageHeight
GdipGetImageWidth
GdipDeleteFont
GdipCreateBitmapFromStream
GdipGetFontCollectionFamilyCount
GdipGetFontCollectionFamilyList
GdipNewPrivateFontCollection
GdipDeletePrivateFontCollection
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawDriverString
GdipFillRectangleI
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipDeleteBrush
GdipCloneBrush
GdipCreateSolidFill
GdipCreateTextureIAI
GdipSetTextureWrapMode
GdipCreatePen1
GdipDeletePen
GdipGetPenWidth
GdipSetCompositingQuality
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipResetWorldTransform
GdipTranslateWorldTransform
GdipScaleWorldTransform
GdipRotateWorldTransform
GdipDrawLine
GdipFillRectangle
GdipDrawImageRectRect
GdipSetClipRect
GdipSetClipRegion
GdipResetClip
GdipSaveGraphics
GdipCreateTextureIA
GdipGetFamilyName
GdipSaveImageToStream

winmm

timeGetTime

crypt32

CryptFindOIDInfo

shell32

SHCreateDirectoryExW
ShellExecuteW
SHGetFolderPathW
SHFileOperationW
SHGetSpecialFolderPathW

shlwapi

PathCanonicalizeW
PathCombineW
PathFileExistsW
StrDupW
PathFindExtensionW
PathRemoveFileSpecW
PathRemoveBackslashW
PathIsDirectoryW
PathIsRelativeW

secur32

CompleteAuthToken
FreeCredentialsHandle
AcquireCredentialsHandleA
InitializeSecurityContextA
DeleteSecurityContext
QueryCredentialsAttributesW
FreeContextBuffer
QueryContextAttributesW
DecryptMessage
EncryptMessage
ApplyControlToken
AcquireCredentialsHandleW

usp10

ScriptItemize
ScriptBreak
ScriptShape
ScriptStringFree
ScriptStringOut
ScriptStringAnalyse
ScriptCPtoX
ScriptLayout
ScriptPlace
ScriptFreeCache

ws2_32

getsockopt
socket
getsockname
getpeername
bind
connect
setsockopt
send
sendto
recv
recvfrom
listen
WSACloseEvent
closesocket
ioctlsocket
WSAEnumNetworkEvents
WSAGetLastError
WSAWaitForMultipleEvents
WSAEventSelect
WSAStartup
WSACleanup
WSACreateEvent
getaddrinfo
freeaddrinfo
WSAResetEvent
WSASetEvent
accept
WSCEnumProtocols

wininet

InternetQueryOptionW

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 360KB - Virtual size: 360KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

97f5c5cdc5e80758b7adff3a733244ad

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

ole32

oleaut32

gdi32

gdiplus

winmm

crypt32

shell32

shlwapi

secur32

usp10

ws2_32

wininet

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 360KB - Virtual size: 360KB

.data Size: 108KB - Virtual size: 119KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 161KB - Virtual size: 161KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 360KB - Virtual size: 360KB

.data
Size: 108KB - Virtual size: 119KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 161KB - Virtual size: 161KB