2023-08-26_6cc9769f2edd854e329edb0456da5657_mafia_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2023-08-26_6cc9769f2edd854e329edb0456da5657_mafia_JC.exe
Size

464KB
MD5

6cc9769f2edd854e329edb0456da5657
SHA1

8234a9cd623f3e3941afe665d19ca5654c25c9e3
SHA256

d6f411ee1f1175fd05441914ef20c8986797af223d8ce624d62d6e759c281df4
SHA512

bf47bb57e93aefb29fd2cd075ed5dd48f6c79798a10b6024924fb6bdf7a3043edfaae21aa22fe7a81f6570fc3cdd675aedecbbb006aa41b0088ca418629487c7
SSDEEP

12288:WWP7WOqXKc7PxBuuKJaH5ja1OA2ZxwUYP/bs:WWi96wKola1OA2ZxwUq/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2023-08-26_6cc9769f2edd854e329edb0456da5657_mafia_JC.exe

Files

2023-08-26_6cc9769f2edd854e329edb0456da5657_mafia_JC.exe
.exe windows:5 windows x86

4631c598d8e33b16430bcb666f537267

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitThread
GetDriveTypeA
GetFullPathNameA
CopyFileA
GetTempPathA
DeleteFileW
GetCurrentThread
SetThreadPriority
GetCurrentProcess
SetPriorityClass
GetEnvironmentVariableA
GetModuleFileNameA
ExitProcess
GetLocalTime
CloseHandle
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetLastError
GetModuleFileNameW
ExpandEnvironmentStringsA
WaitForMultipleObjects
PeekNamedPipe
FormatMessageA
WaitForSingleObject
VerSetConditionMask
VerifyVersionInfoA
SleepEx
InitializeCriticalSection
Sleep
GetCurrentThreadId
GlobalAlloc
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
GetProcAddress
CreateThread
CreateProcessW
GetCurrentDirectoryW
GetWindowsDirectoryA
OpenProcess
LoadLibraryA
TerminateProcess
CreateFileW
ReadFile
FileTimeToSystemTime
GetFileInformationByHandle
SetFilePointer
WriteFile
GetTickCount
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
InterlockedDecrement
InterlockedIncrement
FileTimeToLocalFileTime
FindFirstFileExA
FindClose
HeapFree
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapSize
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetConsoleCP
GetConsoleMode
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCurrentProcessId
GetTimeZoneInformation
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
HeapReAlloc
FreeLibrary
LoadLibraryW
CreateFileA
WriteConsoleW
SetStdHandle
FlushFileBuffers
LCMapStringW
SetEndOfFile
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
GetDriveTypeW

user32

PostThreadMessageW
MessageBoxW

advapi32

OpenProcessToken
CryptDestroyHash
RegDeleteKeyA
RegOpenKeyExA
DeleteService
ControlService
CreateServiceW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
CreateProcessAsUserW
CryptGetHashParam
CryptCreateHash
CryptAcquireContextA
CryptHashData
CryptReleaseContext

shell32

SHChangeNotify
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHFileOperationW
ShellExecuteExW

ole32

CoTaskMemFree

iphlpapi

GetAdaptersInfo

ws2_32

freeaddrinfo
getaddrinfo
sendto
recvfrom
connect
listen
ioctlsocket
gethostname
socket
closesocket
getpeername
getsockopt
WSAStartup
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
select
WSAGetLastError
__WSAFDIsSet
accept
WSASetLastError
WSACleanup
htons

wldap32

ord211
ord143
ord60
ord50
ord26
ord30
ord32
ord35
ord79
ord200
ord33
ord301
ord27
ord41
ord46
ord22

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape

Sections

.text
Size: 326KB - Virtual size: 326KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4631c598d8e33b16430bcb666f537267

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

iphlpapi

ws2_32

wldap32

Exports

Exports

Sections

.text Size: 326KB - Virtual size: 326KB

.rdata Size: 62KB - Virtual size: 62KB

.data Size: 7KB - Virtual size: 15KB

.rsrc Size: 48KB - Virtual size: 48KB

.reloc Size: 18KB - Virtual size: 17KB

.text
Size: 326KB - Virtual size: 326KB

.rdata
Size: 62KB - Virtual size: 62KB

.data
Size: 7KB - Virtual size: 15KB

.rsrc
Size: 48KB - Virtual size: 48KB

.reloc
Size: 18KB - Virtual size: 17KB