2023-08-22_f86a162f2af36e43af5cf5955558e505_mafia_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2023-08-22_f86a162f2af36e43af5cf5955558e505_mafia_JC.exe
Size

759KB
MD5

f86a162f2af36e43af5cf5955558e505
SHA1

5367c94bd201f988222d44c7b88fefc77727546b
SHA256

704639f2a97d7cc7bc9a993f204d5b7f3414d383dcd8e174751d295fbe20fc8e
SHA512

5218fa222dd1eb6e68306cdba6361916d56891c53cd5b7011a4070cdf3171a2dc1ad080755f532b712279ce5800c43fadacbb2f1be78b38d0d97f79bc336ddd4
SSDEEP

12288:QzB2hzhXEjpl9Obdc//IDCAU9PqDjvhtJJNqEvrzEMKWyHkVrn4OQXgGokwJWE5i:sB2hzhwNPqDMyr46N5gw+yT9D7KU8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2023-08-22_f86a162f2af36e43af5cf5955558e505_mafia_JC.exe

Files

2023-08-22_f86a162f2af36e43af5cf5955558e505_mafia_JC.exe
.exe windows x86

d1a1e9dc07a4f24265409ac47b873cdc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemTime
SuspendThread
ResumeThread
DeleteFileA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileSectionA
FindFirstFileA
FindClose
FindNextFileA
GetCurrentDirectoryA
TerminateProcess
ReadFile
CreateMutexA
ReleaseMutex
GetVersionExA
GlobalLock
SetEvent
InitializeCriticalSection
CreateEventA
MulDiv
GlobalUnlock
ResetEvent
GetVersion
lstrcpyA
FindResourceA
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
IsDBCSLeadByte
lstrlenW
FlushInstructionCache
RaiseException
SetLastError
lstrcmpiA
LoadLibraryExA
DeleteCriticalSection
CloseHandle
Module32Next
SetEndOfFile
CreateFileW
SetStdHandle
WriteConsoleW
LoadLibraryW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCurrentThreadId
SetHandleCount
GetConsoleMode
GetConsoleCP
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
ExitProcess
HeapCreate
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
LCMapStringW
RtlUnwind
GetCPInfo
GetStartupInfoW
HeapSetInformation
GetCommandLineA
CreateThread
ExitThread
GetSystemTimeAsFileTime
IsDebuggerPresent
GetTempPathA
GetModuleHandleW
VirtualProtect
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
HeapSize
HeapReAlloc
HeapDestroy
DecodePointer
EncodePointer
InterlockedCompareExchange
SetFilePointer
CreateDirectoryA
FlushFileBuffers
GetFileAttributesA
GetSystemDefaultLCID
GetSystemDefaultUILanguage
GetSystemDefaultLangID
LocalFree
GetFileTime
CreateToolhelp32Snapshot
GetModuleHandleA
GetModuleFileNameA
SetEnvironmentVariableA
CreatePipe
GetSystemInfo
GlobalMemoryStatusEx
LockResource
Process32Next
OpenThread
LoadLibraryA
GetLocalTime
GetTempFileNameA
GlobalFree
SetFileAttributesA
EnterCriticalSection
GetProcAddress
GetLastError
Module32First
InterlockedExchange
GetShortPathNameA
MultiByteToWideChar
GetEnvironmentVariableA
Thread32Next
FileTimeToSystemTime
CreateProcessA
LeaveCriticalSection
IsBadCodePtr
SizeofResource
Sleep
WideCharToMultiByte
Thread32First
GlobalAlloc
OpenProcess
WriteFile
IsBadReadPtr
GetThreadContext
GetCurrentThread
GetTickCount
WaitForSingleObject
SetHandleInformation
Process32First
GetCurrentProcess
SetUnhandledExceptionFilter
LoadResource
FreeLibrary
FindResourceW
FindResourceExW
lstrcpynA
VirtualQuery
RtlCaptureContext
lstrlenA
GetFileSize
LocalAlloc
GetSystemPowerStatus
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentProcessId
UnhandledExceptionFilter
FileTimeToLocalFileTime
CreateFileA
GetFileType

user32

CopyImage
LoadImageA
GetKeyboardLayout
GetSystemMetrics
GetDesktopWindow
ReleaseDC
BringWindowToTop
GetForegroundWindow
GetDC
GetClientRect
SetForegroundWindow
MoveWindow
CopyRect
DrawFrameControl
GetDlgCtrlID
LoadCursorA
CallWindowProcA
MapWindowPoints
IsWindowVisible
LoadStringA
EqualRect
ShowWindow
SetWindowPos
GetSysColor
DefWindowProcA
GetDlgItem
UnregisterClassA
GetWindowThreadProcessId
MonitorFromWindow
GetWindowLongA
InvalidateRect
MessageBoxA
SetWindowLongA
SetRect
OffsetRect
InflateRect
GetMonitorInfoA
PtInRect
BeginPaint
SendMessageA
IsWindowEnabled
LoadIconA
GetParent
DrawIconEx
GetKeyState
DrawTextA
KillTimer
SetCapture
FillRect
PostQuitMessage
GetWindow
IsWindow
ReleaseCapture
GetWindowRect
GetMessageA
RegisterClassExA
GetClassInfoExA
CharNextA
TranslateMessage
CreateWindowExA
PeekMessageA
GetActiveWindow
DispatchMessageA
EndPaint
ClientToScreen
DestroyWindow
SetCursor
SetWindowRgn
SetTimer

gdi32

MoveToEx
GetTextExtentPoint32A
LineTo
SetTextColor
GetDeviceCaps
StretchBlt
CreateFontIndirectA
SetBkColor
CreateBitmap
GetClipRgn
SelectClipRgn
SetRectRgn
CreateRectRgnIndirect
CombineRgn
RectInRegion
OffsetRgn
SaveDC
CreateRectRgn
CreatePen
RoundRect
GetPixel
GetStockObject
ExtTextOutA
RestoreDC
CreateSolidBrush
TextOutA
BitBlt
DeleteDC
CreateDIBSection
SetDIBColorTable
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectA
Rectangle
SetBkMode

advapi32

RegOpenKeyA
OpenProcessToken
RegDeleteValueA
RegCreateKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegQueryInfoKeyW
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
LookupAccountSidA
GetTokenInformation
RegQueryInfoKeyA

shell32

ShellExecuteA
SHGetSpecialFolderPathA

ole32

CoInitializeSecurity
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CreateStreamOnHGlobal
CoInitializeEx

oleaut32

OleLoadPicture
SysFreeString
VarUI4FromStr
SafeArrayGetUBound
SafeArrayGetElement
VariantChangeType
VariantInit
SafeArrayDestroy
VariantCopy
VariantClear
SafeArrayGetLBound
SysAllocString

shlwapi

PathAppendA
SHGetValueA
SHSetValueA
StrToIntA
PathFindExtensionA
PathStripPathA
PathFileExistsA
PathFindExtensionW
PathRemoveFileSpecA

gdiplus

GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImageHeight
GdipFree
GdipCreateBitmapFromScan0
GdipLoadImageFromStream
GdipCreateFromHDC
GdipCreateImageAttributes
GdipSetImageAttributesColorKeys
GdipDisposeImageAttributes
GdipDrawImageRectI
GdipDrawImageRectRectI
GdiplusStartup
GdipGetImageWidth
GdipCloneImage
GdipBitmapLockBits
GdipSaveImageToFile
GdipGetImagePaletteSize
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromFile
GdipDisposeImage
GdipBitmapUnlockBits
GdipDrawImageI
GdipAlloc
GdiplusShutdown
GdipGetImageEncodersSize

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

dbghelp

SymCleanup
SymFunctionTableAccess64
SymSetOptions
SearchTreeForFile
SymFromAddr
StackWalk64
SymInitialize
SymGetModuleBase64
SymGetLineFromAddr64

psapi

GetProcessMemoryInfo

wininet

InternetOpenA
InternetOpenUrlA
InternetReadFile
HttpEndRequestA
InternetWriteFile
HttpSendRequestExA
HttpSendRequestA
InternetSetCookieA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetAttemptConnect
InternetConnectA
InternetCloseHandle

comctl32

_TrackMouseEvent

imm32

ImmIsIME
ImmGetDescriptionA

Sections

.text
Size: 518KB - Virtual size: 517KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d1a1e9dc07a4f24265409ac47b873cdc

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

version

dbghelp

psapi

wininet

comctl32

imm32

Sections

.text Size: 518KB - Virtual size: 517KB

.rdata Size: 93KB - Virtual size: 93KB

.data Size: 15KB - Virtual size: 30KB

.rsrc Size: 93KB - Virtual size: 92KB

.reloc Size: 38KB - Virtual size: 40KB

.text
Size: 518KB - Virtual size: 517KB

.rdata
Size: 93KB - Virtual size: 93KB

.data
Size: 15KB - Virtual size: 30KB

.rsrc
Size: 93KB - Virtual size: 92KB

.reloc
Size: 38KB - Virtual size: 40KB