2023-08-25_b700b35a6c431663f14166b73c29a87f_mafia_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2023-08-25_b700b35a6c431663f14166b73c29a87f_mafia_JC.exe
Size

1.1MB
MD5

b700b35a6c431663f14166b73c29a87f
SHA1

7323cc7e3f60ee3c4557c930138883f5cf4adf78
SHA256

36d0d7f90e2f84791f62e92917b6e8ab3608b0e5ee175f2351d7ad6f35b19c4c
SHA512

71820a4798fcbc2bfd17192b8acfbb33a415ae4b30551bbfa78af6f3d2531c4dd6a6806b20788e865d7188028839128671335aac4b753c496d202c2117ef2157
SSDEEP

24576:1CZUpBBJkJmHZLzGxTJLFNKws33rxPTEYjyuH+pDJAAjDV64tsq:1MUpRNOxTrNcH1rE7pD/jDV64tsq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2023-08-25_b700b35a6c431663f14166b73c29a87f_mafia_JC.exe

Files

2023-08-25_b700b35a6c431663f14166b73c29a87f_mafia_JC.exe
.exe windows:5 windows x86

6f0ab1c222b4c7a3cea304e69fe2c495

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAGetLastError
recv
closesocket
send
shutdown
WSASetLastError

kernel32

LockFile
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
SetFileTime
WriteFile
WideCharToMultiByte
Sleep
FormatMessageW
GetVersionExW
GetFileAttributesW
ReadFile
CreateFileW
GetEnvironmentVariableA
MultiByteToWideChar
FlushFileBuffers
GetStdHandle
GetLastError
GetCurrentDirectoryW
MoveFileW
LockFileEx
GetDiskFreeSpaceW
FindClose
GetProcessId
CreateFileMappingW
SetCurrentDirectoryW
RemoveDirectoryW
SetEnvironmentVariableA
FindNextFileW
GetFileAttributesExW
CloseHandle
DeleteFileW
GetFileInformationByHandle
GetTempPathA
LocalFree
GetSystemTime
GetTickCount
InitializeCriticalSection
PeekNamedPipe
GetQueuedCompletionStatus
WaitForSingleObject
ConnectNamedPipe
CreateNamedPipeW
LoadLibraryW
GetOverlappedResult
DisconnectNamedPipe
UnlockFile
LocalAlloc
PostQueuedCompletionStatus
WaitForMultipleObjects
CreateIoCompletionPort
CreateThread
GlobalMemoryStatus
GetModuleHandleW
CreateRemoteThread
OpenProcess
VirtualFreeEx
VirtualAllocEx
OpenThread
WriteProcessMemory
FreeLibrary
TerminateProcess
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
GetDriveTypeW
CompareStringW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
CreateDirectoryW
HeapFree
GetCurrentProcess
HeapAlloc
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
SetFilePointer
GetVersion
LoadLibraryA
GetVersionExA
FlushConsoleInputBuffer
FindFirstFileW
GetFileSize
HeapReAlloc
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
ReadConsoleInputA
SetConsoleMode
GetProcAddress
GetFullPathNameW
GetFullPathNameA
FileTimeToSystemTime
CreateEventW
SetStdHandle
WriteConsoleW
EncodePointer
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
SetHandleCount
GetFileType
ExitProcess
RtlUnwind
GetConsoleCP
GetConsoleMode
IsProcessorFeaturePresent
RaiseException
InterlockedIncrement
InterlockedDecrement
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
LCMapStringW
HeapSize
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
SetConsoleCtrlHandler
InterlockedExchange
GetLocaleInfoW
CreateFileA

user32

PostThreadMessageW
GetDesktopWindow
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegisterEventSourceA
ReportEventA
DeregisterEventSource
SetSecurityDescriptorSacl
GetLengthSid
FreeSid
SetEntriesInAclW
AllocateAndInitializeSid
InitializeAcl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

Exports

Exports

unqlite_begin
unqlite_close
unqlite_commit
unqlite_config
unqlite_kv_cursor_data
unqlite_kv_cursor_data_callback
unqlite_kv_cursor_delete_entry
unqlite_kv_cursor_key
unqlite_kv_cursor_key_callback
unqlite_kv_cursor_next_entry
unqlite_kv_cursor_prev_entry
unqlite_kv_cursor_reset
unqlite_kv_cursor_seek
unqlite_kv_cursor_valid_entry
unqlite_lib_config
unqlite_lib_copyright
unqlite_lib_ident
unqlite_lib_init
unqlite_lib_is_threadsafe
unqlite_lib_shutdown
unqlite_lib_signature
unqlite_lib_version
unqlite_open
unqlite_rollback
unqlite_util_load_mmaped_file
unqlite_util_random_num
unqlite_util_random_string
unqlite_util_release_mmaped_file
unqlite_vm_config

Sections

.text
Size: 750KB - Virtual size: 750KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 186KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 69KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6f0ab1c222b4c7a3cea304e69fe2c495

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 750KB - Virtual size: 750KB

.rdata Size: 186KB - Virtual size: 186KB

.data Size: 69KB - Virtual size: 85KB

.rsrc Size: 48KB - Virtual size: 47KB

.reloc Size: 51KB - Virtual size: 50KB

.text
Size: 750KB - Virtual size: 750KB

.rdata
Size: 186KB - Virtual size: 186KB

.data
Size: 69KB - Virtual size: 85KB

.rsrc
Size: 48KB - Virtual size: 47KB

.reloc
Size: 51KB - Virtual size: 50KB