2023-08-27_0d0d3f314e215f5bff612bb5d5e94f1f_mafia_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

2023-08-27_0d0d3f314e215f5bff612bb5d5e94f1f_mafia_JC.exe
Size

1.1MB
MD5

0d0d3f314e215f5bff612bb5d5e94f1f
SHA1

34cb935ea977df171093a90af9896c72d4530c55
SHA256

fc9cdb80e0ac81a9cb99cf78fee9442cbf0f4698c415d688d03624e94db86dcd
SHA512

674d6975b17e4f4af93bc4028af6b1f66900c18018a2f3a1730fc70ec8ef1d4f4eee9736d2ff26b9b9f73adc41269e7455f35c5e6b351de297f6a423cae81813
SSDEEP

24576:oKVHxkYq171YUiGwdysFylJKGLT0LbQF5jYm/OxcTxiIg:NYX1YldRFy/F/0XQncS6cdid

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2023-08-27_0d0d3f314e215f5bff612bb5d5e94f1f_mafia_JC.exe

Files

2023-08-27_0d0d3f314e215f5bff612bb5d5e94f1f_mafia_JC.exe
.exe windows:5 windows x86

8b7ce01a527aaaaba63f570e5e4e066d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipDrawImageI
GdipCreateBitmapFromStream
GdipDrawImageRectI
GdiplusShutdown
GdiplusStartup
GdipCreateFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromFile
GdipCloneImage
GdipDisposeImage
GdipFillPath
GdipFillRectangle
GdipDrawLine
GdipSetPathGradientCenterPointI
GdipSetPathGradientSurroundColorsWithCount
GdipGetPathGradientPointCount
GdipSetPathGradientCenterColor
GdipCreatePathGradientFromPath
GdipAddPathEllipse
GdipDeleteFont
GdipCreateFontFromDC
GdipMeasureString
GdipDrawString
GdipFillRectangleI
GdipDrawPath
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipAddPathArcI
GdipAddPathLineI
GdipClosePathFigure
GdipDeletePath
GdipCreatePath
GdipDeletePen
GdipCreatePen1
GdipCreateLineBrushFromRectI
GdipCreateSolidFill
GdipCloneBrush
GdipDeleteBrush
GdipAlloc
GdipFree
GdipSetPenColor
GdipSetLineColors
GdipSetSolidFillColor
GdipGetImageHeight
GdipGetImageWidth

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

winhttp

WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpReadData
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpReceiveResponse
WinHttpWriteData

kernel32

GetModuleHandleW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetModuleHandleExW
GetLastError
CloseHandle
CreateThread
FreeResource
LocalAlloc
LocalFree
CreateFileW
ReadFile
FlushFileBuffers
GetFileSize
GetTempPathW
GetTempFileNameW
DeleteFileW
MoveFileW
FindFirstFileW
FindNextFileW
FindClose
FreeLibrary
LoadLibraryW
GetModuleFileNameW
CreateDirectoryW
GlobalLock
WriteFile
GlobalUnlock
SetEvent
WaitForSingleObject
TerminateThread
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
GetVersionExW
GetCurrentProcess
ExpandEnvironmentStringsW
GetFileAttributesW
GetVersion
SetLastError
SetFilePointer
Sleep
TerminateProcess
GetProcessHeap
HeapAlloc
lstrlenW
HeapFree
WaitForMultipleObjects
GlobalFree
CopyFileW
GetCurrentThreadId
MoveFileExW
GetExitCodeProcess
GetFileSizeEx
GlobalAlloc
GetTickCount
GetFileAttributesExW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetNativeSystemInfo
GetUserDefaultUILanguage
InterlockedDecrement
GetLocalTime
GetFirmwareEnvironmentVariableW
FileTimeToDosDateTime
SystemTimeToFileTime
FileTimeToSystemTime
GetFileType
DuplicateHandle
GetFileInformationByHandle
GetSystemTime
SetEnvironmentVariableA
CompareStringW
SetEndOfFile
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
InterlockedExchange
LoadLibraryA
RaiseException
HeapDestroy
HeapReAlloc
HeapSize
InterlockedIncrement
InterlockedCompareExchange
GetStringTypeW
InitializeCriticalSection
EncodePointer
DecodePointer
OutputDebugStringW
SetCriticalSectionSpinCount
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RtlUnwind
LCMapStringW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapCreate
IsProcessorFeaturePresent
ExitProcess
GetStdHandle
SetHandleCount
GetLocaleInfoW
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CreateEventW

user32

DrawFocusRect
GetDialogBaseUnits
GetSysColor
ExitWindowsEx
GetKeyState
EndDialog
GetDC
InvalidateRect
IsWindow
ScreenToClient
GetSystemMetrics
PostMessageW
SetWindowLongW
CallWindowProcW
HideCaret
SendMessageW
SetFocus
SetWindowTextW
SendDlgItemMessageW
ShowWindow
SetWindowPos
GetDlgItem
GetCursorPos
GetDesktopWindow
SetPropW
GetPropW
BeginPaint
EndPaint
TrackMouseEvent
GetClientRect
IsWindowEnabled
MessageBoxW
GetParent
DefWindowProcW
ReleaseDC
DialogBoxParamW
CreateDialogParamW
GetWindowLongW
GetWindowDC
LoadImageW
SetTimer
EnableWindow
KillTimer
DestroyWindow
RegisterWindowMessageW
GetWindowThreadProcessId
GetForegroundWindow
AttachThreadInput
BringWindowToTop
GetWindow
SetCursor
LoadCursorW
GetWindowRect
SetDlgItemTextW

gdi32

SetBkMode
SetBrushOrgEx
StretchBlt
GetStockObject
GetObjectW
CreatePatternBrush
CreateFontIndirectW
EnumFontFamiliesExW
DeleteObject
ExtTextOutW
GetTextMetricsW
SetBkColor
SetTextColor
DeleteDC
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDeviceCaps

advapi32

RegOpenKeyW
GetUserNameW
LookupAccountSidW
CryptEncrypt
CryptGenKey
CryptExportKey
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegDeleteKeyW
QueryServiceStatus
ControlService
RegDeleteValueW
CryptAcquireContextW
CryptImportKey
CryptGetKeyParam
CryptCreateHash
CryptHashData
CryptVerifySignatureW
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegSetValueExW
CryptGetHashParam
AllocateAndInitializeSid
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetFileSecurityW
FreeSid
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumKeyExW
RegLoadKeyW

shell32

ShellExecuteW
Shell_NotifyIconW
ShellExecuteExW
SHGetKnownFolderPath
SHGetFolderPathW

ole32

CoSetProxyBlanket
CoTaskMemFree
CoInitialize
CoCreateInstance
CoInitializeSecurity
CoUninitialize
CoInitializeEx
GetHGlobalFromStream
CreateStreamOnHGlobal
StringFromCLSID
CoCreateGuid

oleaut32

SysAllocStringByteLen
SysAllocStringLen
SysStringLen
VariantChangeType
VariantClear
VariantInit
SysFreeString
SysAllocString
OleCreatePictureIndirect
SysStringByteLen

shlwapi

PathStripPathW
PathFindExtensionW
PathRemoveExtensionW
PathFileExistsW
PathFindFileNameW
PathAppendW
PathRemoveFileSpecW
PathAddBackslashW
StrToIntExW

uxtheme

SetWindowTheme

crypt32

CryptDecodeObjectEx
CryptStringToBinaryW

Sections

.text
Size: 392KB - Virtual size: 391KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 564KB - Virtual size: 564KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8b7ce01a527aaaaba63f570e5e4e066d

Headers

DLL Characteristics

File Characteristics

Imports

gdiplus

version

winhttp

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

uxtheme

crypt32

Sections

.text Size: 392KB - Virtual size: 391KB

.rdata Size: 105KB - Virtual size: 104KB

.data Size: 12KB - Virtual size: 21KB

.rsrc Size: 564KB - Virtual size: 564KB

.reloc Size: 35KB - Virtual size: 35KB

.text
Size: 392KB - Virtual size: 391KB

.rdata
Size: 105KB - Virtual size: 104KB

.data
Size: 12KB - Virtual size: 21KB

.rsrc
Size: 564KB - Virtual size: 564KB

.reloc
Size: 35KB - Virtual size: 35KB