NEAS[.]2023-09-05_d7c0ac29eaa72c5b0bd11559cd547f74_mafia_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2023-09-05_d7c0ac29eaa72c5b0bd11559cd547f74_mafia_JC.exe
Size

2.1MB
MD5

d7c0ac29eaa72c5b0bd11559cd547f74
SHA1

d894e5fd5690101bc784f74bf92f7e59aebfa69b
SHA256

37d1d4f44e40fe422b28e691ee5d0830793a2168ea4b725ee984f2fdba83a2bb
SHA512

36a4316810044e89099968ff08a0d30d97adc218af90dafe1bcb41949b6118905f2e1a080a3a24858fc649df3d129adbf4a788e0e661f8984191e5e936f26e6a
SSDEEP

49152:yDdKEsnTcTPRti6L5mIQaJn9j51oNV+QzTt5ctar0SXLsrRqqhgC6bDtbDQ:2QAPjLZQaEvbr0asrIbDtbDQ

Score

1^/10

Malware Config

Signatures

Files

NEAS.2023-09-05_d7c0ac29eaa72c5b0bd11559cd547f74_mafia_JC.exe
.exe windows:5 windows x86

f20660042aebd0312800e76068066ef7

Code Sign

04:00:00:00:00:01:23:9e:0f:ac:b3
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

28/01/1999, 13:00

Not After

27/01/2017, 12:00

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:00:00:00:00:01:2d:57:7b:a2:26
Certificate

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Not Before

05/01/2011, 17:48

Not After

05/01/2014, 17:48

Subject

CN=Dell Inc.,OU=KACE,O=Dell Inc.,L=Round Rock,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:23:9e:0f:af:24
Certificate

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Not Before

22/01/2004, 10:00

Not After

27/01/2017, 10:00

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c1:46:dd:71:90:95:ee:fa:5b:49:38:46:8f:f5:08:9a:b8:f5:d9:7d
Signer

Actual PE Digest

c1:46:dd:71:90:95:ee:fa:5b:49:38:46:8f:f5:08:9a:b8:f5:d9:7d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mpr

WNetCancelConnection2A
WNetAddConnection2A

wtsapi32

WTSEnumerateSessionsA
WTSFreeMemory
WTSQuerySessionInformationW
WTSQuerySessionInformationA

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

netapi32

NetGetDCName
NetUserGetInfo

kernel32

Process32First
CreateToolhelp32Snapshot
TerminateProcess
ConnectNamedPipe
CreateNamedPipeA
SetCurrentDirectoryA
GetCurrentDirectoryA
WaitForMultipleObjects
SearchPathA
VerLanguageNameA
GlobalUnlock
GlobalFree
GlobalLock
GlobalAlloc
FileTimeToDosDateTime
FileTimeToLocalFileTime
LocalAlloc
lstrlenA
lstrcpyA
SetFilePointer
CreateFileW
GetCurrentThreadId
GetVersion
GetFileType
GetFullPathNameA
DosDateTimeToFileTime
SetVolumeLabelA
SetEndOfFile
SystemTimeToFileTime
SetFileTime
GetDriveTypeA
GetVolumeInformationA
FileTimeToSystemTime
SetFileAttributesA
GetLocalTime
GetFileTime
LocalFileTimeToFileTime
GetTickCount
QueryPerformanceCounter
Process32Next
lstrcpynA
InitializeCriticalSection
LeaveCriticalSection
InterlockedExchange
lstrcmpiA
EnterCriticalSection
CreateMutexA
ReleaseMutex
SetUnhandledExceptionFilter
LoadLibraryW
CreateThread
CreateSemaphoreW
DeleteCriticalSection
TerminateThread
ReleaseSemaphore
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
IsProcessorFeaturePresent
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetStartupInfoW
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
ProcessIdToSessionId
OpenProcess
LoadLibraryA
FreeLibrary
SetEnvironmentVariableW
GetProcessHeap
HeapAlloc
HeapFree
PeekNamedPipe
CreatePipe
DuplicateHandle
GetExitCodeProcess
WaitForSingleObject
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CopyFileW
CreateDirectoryW
CreateProcessW
FindNextFileW
FindFirstFileW
GetSystemDefaultLCID
GetLocaleInfoA
MultiByteToWideChar
FormatMessageA
SetEnvironmentVariableA
FindFirstFileA
FindNextFileA
FindClose
WideCharToMultiByte
GetVersionExA
GetProcAddress
GetCurrentProcess
GetTempPathA
GetTempFileNameA
GetFileAttributesA
GetModuleFileNameA
WriteConsoleInputA
LoadResource
LockResource
SizeofResource
SetLastError
WaitNamedPipeA
CreateFileA
GetCurrentProcessId
ReadConsoleA
WriteFile
GetStdHandle
ReadFile
Sleep
SetConsoleCtrlHandler
SetConsoleTitleA
CloseHandle
GetConsoleTitleA
GetComputerNameA
GetLastError
GetCommandLineW
LocalFree
FindResourceA
GetModuleHandleA
FlushFileBuffers
LCMapStringW
GetTimeZoneInformation
GetCurrentDirectoryW
GetFileInformationByHandle
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoW
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
HeapCreate
ExitProcess
GetModuleHandleW
IsDebuggerPresent
UnhandledExceptionFilter
CompareStringW
GlobalMemoryStatus
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetCPInfo
InterlockedIncrement
InterlockedDecrement
HeapSize
RemoveDirectoryA
GetFullPathNameW
MoveFileW
FindFirstFileExW
DecodePointer
EncodePointer
RaiseException
FindFirstFileExA
GetCommandLineA
HeapSetInformation
RtlUnwind
ExitThread
ResumeThread
GetTimeFormatA
GetDateFormatA
DeleteFileA
GetSystemTimeAsFileTime
HeapReAlloc
MoveFileA
GetDriveTypeW

user32

SetUserObjectSecurity
MapVirtualKeyA
CharToOemA
OemToCharA
MessageBoxA
GetDesktopWindow
GetUserObjectInformationW
PostThreadMessageA
OpenWindowStationA
GetProcessWindowStation
SetProcessWindowStation
OpenDesktopA
CloseWindowStation
CloseDesktop
GetUserObjectSecurity

advapi32

CopySid
SetSecurityDescriptorDacl
GetSecurityDescriptorGroup
AdjustTokenPrivileges
IsValidSecurityDescriptor
GetSecurityDescriptorSacl
IsValidSid
GetSecurityDescriptorOwner
SetKernelObjectSecurity
GetSecurityDescriptorControl
GetKernelObjectSecurity
IsValidAcl
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegDeleteValueA
RegDeleteKeyA
RegCloseKey
RegQueryInfoKeyA
RegEnumKeyExA
RegEnumValueA
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
AllocateAndInitializeSid
EqualSid
FreeSid
LookupPrivilegeValueA
AddAccessAllowedAce
GetSecurityDescriptorDacl
GetAclInformation
InitializeAcl
GetAce
AddAce
GetLengthSid
InitializeSecurityDescriptor
OpenProcessToken
DuplicateTokenEx
SetTokenInformation
LookupAccountSidW
LookupAccountNameW
LogonUserW
CreateProcessWithLogonW
CreateProcessAsUserW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
GetNamedSecurityInfoA
SetEntriesInAclA
SetNamedSecurityInfoA
GetTokenInformation
RevertToSelf
ImpersonateLoggedOnUser
OpenSCManagerA
OpenServiceA
CreateServiceA
CloseServiceHandle
StartServiceA
GetUserNameA

shell32

CommandLineToArgvW
SHFileOperationA

ole32

CoCreateGuid
StringFromGUID2

iphlpapi

GetAdaptersInfo

userenv

DestroyEnvironmentBlock
UnloadUserProfile
CreateEnvironmentBlock
LoadUserProfileA

psapi

EnumProcesses

shlwapi

PathUnquoteSpacesA
PathRemoveFileSpecA
PathFindFileNameA
PathIsRootA
PathStripToRootA
PathIsURLA

Sections

.text
Size: 554KB - Virtual size: 554KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 57KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f20660042aebd0312800e76068066ef7

Code Sign

04:00:00:00:00:01:23:9e:0f:ac:b3Certificate

Extended Key Usages

Key Usages

01:00:00:00:00:01:2d:57:7b:a2:26Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:23:9e:0f:af:24Certificate

Extended Key Usages

Key Usages

c1:46:dd:71:90:95:ee:fa:5b:49:38:46:8f:f5:08:9a:b8:f5:d9:7dSigner

Headers

DLL Characteristics

File Characteristics

Imports

mpr

wtsapi32

version

netapi32

kernel32

user32

advapi32

shell32

ole32

iphlpapi

userenv

psapi

shlwapi

Sections

.text Size: 554KB - Virtual size: 554KB

.rdata Size: 90KB - Virtual size: 89KB

.data Size: 57KB - Virtual size: 107KB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.reloc Size: 36KB - Virtual size: 35KB

04:00:00:00:00:01:23:9e:0f:ac:b3
Certificate

01:00:00:00:00:01:2d:57:7b:a2:26
Certificate

04:00:00:00:00:01:23:9e:0f:af:24
Certificate

c1:46:dd:71:90:95:ee:fa:5b:49:38:46:8f:f5:08:9a:b8:f5:d9:7d
Signer

.text
Size: 554KB - Virtual size: 554KB

.rdata
Size: 90KB - Virtual size: 89KB

.data
Size: 57KB - Virtual size: 107KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

.reloc
Size: 36KB - Virtual size: 35KB