NEAS[.]2023-09-07_318a456061d6a1775354daf27eeac752_mafia_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2023-09-07_318a456061d6a1775354daf27eeac752_mafia_JC.exe
Size

2.6MB
MD5

318a456061d6a1775354daf27eeac752
SHA1

317563e829ce496b9455b150feebc8f8eccf3b70
SHA256

3b3fc0c30415ad3b8805845fd0f3ed4f341458e58b9ce2815ca6aa80275b61a3
SHA512

484799852b2f91e2a55ee829874af6dcbaf203ba96cbfe252d20a442315308e4e25f659b32e341d8401f6e788c68146c28ae80c7e567e044ca1515030d9b9fbe
SSDEEP

49152:kmsklugnZPRvDSFR8DNi3x2OVYgigscLzvGpjr8XpI50Mdw/NsOIlz7oV39hInAz:PugnZPlSFR8DNi3ocYgigscLzvGVrUnt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2023-09-07_318a456061d6a1775354daf27eeac752_mafia_JC.exe

Files

NEAS.2023-09-07_318a456061d6a1775354daf27eeac752_mafia_JC.exe
.exe windows:5 windows x86

3725c47682e58d2ff15afaf3599b2309

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

FindFirstUrlCacheEntryA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetQueryOptionA
InternetQueryDataAvailable
HttpQueryInfoA
InternetCloseHandle
InternetGetLastResponseInfoA
InternetOpenA
InternetSetStatusCallback
InternetSetFilePointer
InternetWriteFile
InternetReadFile
FindCloseUrlCache
InternetOpenUrlA
DeleteUrlCacheEntry
FindNextUrlCacheEntryA

kernel32

GetConsoleCP
GetConsoleMode
CompareStringW
GetTimeZoneInformation
GetProcessHeap
CreateFileW
SetEnvironmentVariableA
QueryPerformanceCounter
GetEnvironmentStringsW
WriteConsoleW
FreeEnvironmentStringsW
FreeLibrary
GetProcAddress
LoadLibraryA
LocalFree
FormatMessageA
MultiByteToWideChar
FindResourceW
SizeofResource
LockResource
LoadResource
WideCharToMultiByte
CreateFileA
CreateFileMappingA
SetHandleCount
MapViewOfFile
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
InterlockedIncrement
InterlockedDecrement
CreateProcessA
GetLastError
lstrcmpW
GetCurrentDirectoryA
lstrlenA
FindNextFileA
FindFirstFileA
GlobalReAlloc
SetLastError
DeactivateActCtx
ActivateActCtx
SystemTimeToFileTime
GetLocalTime
FileTimeToSystemTime
DeleteFileA
GetTickCount
SetFilePointer
GetFileType
GetStringTypeW
LCMapStringW
IsValidCodePage
HeapCreate
IsProcessorFeaturePresent
GetStdHandle
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
HeapSize
HeapQueryInformation
SetStdHandle
CreateThread
ExitThread
HeapReAlloc
GetStartupInfoW
HeapSetInformation
GetCommandLineA
ExitProcess
HeapAlloc
VirtualQuery
GetSystemInfo
VirtualAlloc
HeapFree
DuplicateHandle
GetCurrentProcess
CloseHandle
RaiseException
EncodePointer
DecodePointer
RtlUnwind
FindResourceExW
VirtualProtect
SearchPathA
Sleep
GetProfileIntA
GetTempPathA
GetTempFileNameA
SetErrorMode
GetNumberFormatA
GetWindowsDirectoryA
GetFileTime
GetFileSizeEx
GetFileAttributesExA
GetFullPathNameA
GetVolumeInformationA
FindClose
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
MoveFileA
lstrcmpiA
lstrcpyA
GetOEMCP
GetCPInfo
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
TlsGetValue
GetACP
GlobalFlags
LocalAlloc
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FileTimeToLocalFileTime
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
CreateEventA
SuspendThread
SetEvent
WaitForSingleObject
ResumeThread
SetThreadPriority
GetCurrentThread
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoA
lstrcmpA
GetModuleHandleW
GetThreadLocale
GetModuleFileNameW
ReleaseActCtx
CreateActCtxW
CopyFileA
GlobalSize
lstrlenW
GetCurrentProcessId
MulDiv
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GetVersionExA
CompareStringA
LoadLibraryW
FindResourceA
FreeResource
GetFileAttributesA
SetFileAttributesA
WriteFile
SetFileTime
CreateDirectoryA
DosDateTimeToFileTime
ReadFile

user32

MonitorFromPoint
UpdateLayeredWindow
MapVirtualKeyExA
IsCharLowerA
LoadImageW
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
LockWindowUpdate
SetCursorPos
CreateAcceleratorTableA
LoadAcceleratorsW
GetKeyboardState
GetKeyboardLayout
ToAsciiEx
DrawFrameControl
DrawStateA
LoadMenuW
SetClassLongA
DestroyAcceleratorTable
RegisterClipboardFormatA
DrawIconEx
CopyImage
GetIconInfo
NotifyWinEvent
EnableScrollBar
HideCaret
InvertRect
GetAsyncKeyState
GetMenuDefaultItem
UnionRect
SetParent
GetSystemMenu
MessageBeep
CharUpperA
LoadCursorW
SetLayeredWindowAttributes
EnumDisplayMonitors
DeleteMenu
SetCapture
InvalidateRgn
IsRectEmpty
CopyAcceleratorTableA
UnregisterClassA
GetSysColorBrush
RealChildWindowFromPoint
UnpackDDElParam
ReuseDDElParam
LoadMenuA
LoadImageA
DestroyIcon
LoadAcceleratorsA
InsertMenuItemA
IntersectRect
BringWindowToTop
TranslateAcceleratorA
SetRectEmpty
IsZoomed
MapVirtualKeyA
GetKeyNameTextA
WaitMessage
SetWindowContextHelpId
MapDialogRect
ShowOwnedPopups
GetMessageA
TranslateMessage
ValidateRect
PostQuitMessage
CharNextA
DestroyMenu
GetMenuItemInfoA
InflateRect
GetMenuStringA
InsertMenuA
RemoveMenu
GetWindowThreadProcessId
EndPaint
BeginPaint
GetWindowDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
IsMenu
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
GetCapture
DrawEdge
ClientToScreen
ReleaseCapture
PostMessageA
ShowScrollBar
UpdateWindow
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
ScreenToClient
DeferWindowPos
GetScrollInfo
SetScrollInfo
PtInRect
SetWindowPlacement
PostThreadMessageA
DefFrameProcA
DefMDIChildProcA
DrawMenuBar
TranslateMDISysAccel
CreateMenu
SetMenuDefaultItem
GetWindowRgn
DestroyCursor
SubtractRect
GetWindowPlacement
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
GetWindow
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
GetDoubleClickTime
CharUpperBuffA
CopyIcon
GetUpdateRect
FrameRect
IsClipboardFormatAvailable
GetNextDlgGroupItem
EndDialog
GetNextDlgTabItem
IsWindowEnabled
DrawFocusRect
GetSysColor
IsWindowVisible
EqualRect
KillTimer
IsWindow
SetTimer
ReleaseDC
SetWindowRgn
LoadBitmapW
SetRect
GetKeyState
FillRect
GetClientRect
IsIconic
DrawIcon
OffsetRect
LoadCursorA
SetCursor
InvalidateRect
CopyRect
GetSystemMetrics
AppendMenuA
CreatePopupMenu
GetCursorPos
LoadIconA
RedrawWindow
LoadIconW
MessageBoxA
GetWindowRect
GetDC
AdjustWindowRect
SystemParametersInfoA
SetWindowPos
GetWindowLongA
EnableWindow
SendMessageA
GetParent
SetWindowLongA
WindowFromPoint

gdi32

SetPolyFillMode
SetROP2
SetStretchBltMode
SetMapMode
GetClipBox
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
GetLayout
SetLayout
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
ExtTextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
CreatePatternBrush
SelectPalette
GetObjectType
CreatePen
CreateHatchBrush
CopyMetaFileA
CreateDCA
GetBkColor
SetBkMode
CreateRectRgnIndirect
PatBlt
GetTextMetricsA
SetRectRgn
GetMapMode
DPtoLP
GetRgnBox
EnumFontFamiliesA
GetTextCharsetInfo
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
CreateRoundRectRgn
CreatePolygonRgn
CreateEllipticRgn
Polyline
Ellipse
Polygon
Rectangle
OffsetRgn
EnumFontFamiliesExA
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
SetPixelV
GetTextFaceA
SaveDC
RestoreDC
CreateBitmap
SetBkColor
SetTextColor
GetTextExtentPoint32A
GetDeviceCaps
CreateDIBitmap
GetBitmapBits
SetPixel
CreateBitmapIndirect
SelectClipRgn
GetPixel
CreateRectRgn
ExtCreateRegion
CombineRgn
TextOutA
StretchBlt
CreateFontIndirectA
GetStockObject
BitBlt
GetObjectA
SetDIBColorTable
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
CreateDIBSection
DeleteDC
GetTextColor
DeleteObject
CreateSolidBrush

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegEnumValueA
RegCloseKey
RegEnumKeyExA

shell32

SHGetSpecialFolderPathA
ShellExecuteA
DragFinish
DragQueryFileA
SHAppBarMessage
SHBrowseForFolderA
Shell_NotifyIconA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetDesktopFolder
SHGetFileInfoA

comctl32

ord17
_TrackMouseEvent
ImageList_GetIconSize

shlwapi

PathFindFileNameA
UrlUnescapeA
PathStripToRootA
PathIsUNCA
PathFindExtensionA
PathRemoveFileSpecW

ole32

DoDragDrop
OleGetClipboard
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CoInitializeEx
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoCreateGuid
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CoInitialize
CoCreateInstance
CoUninitialize
CreateStreamOnHGlobal
OleLockRunning
CoTaskMemFree

oleaut32

VariantInit
VariantClear
VariantCopy
VariantChangeType
OleCreateFontIndirect
SysStringLen
SysAllocStringLen
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrFromDate
SysAllocString
SysFreeString
SysStringByteLen
SysAllocStringByteLen

oledlg

ord8

wsock32

WSAStartup
WSACleanup
WSASetLastError
select
__WSAFDIsSet
closesocket
gethostbyname
socket
ioctlsocket
htons
inet_ntoa
connect

gdiplus

GdipGetImageHeight
GdipCreateFromHDC
GdipReleaseDC
GdipSetSmoothingMode
GdipDrawImageRectI
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdipCreateBitmapFromStreamICM
GdipGetImageGraphicsContext
GdipDrawImageI
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdiplusStartup
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdiplusShutdown
GdipDrawImagePointsI
GdipCreateBitmapFromHBITMAP
GdipSetInterpolationMode
GdipDeleteGraphics
GdipFree
GdipGetImageWidth
GdipCreateBitmapFromStream

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

imm32

ImmGetContext
ImmReleaseContext
ImmGetOpenStatus

winmm

PlaySoundA

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 301KB - Virtual size: 300KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 173KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3725c47682e58d2ff15afaf3599b2309

Headers

DLL Characteristics

File Characteristics

Imports

wininet

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

wsock32

gdiplus

oleacc

imm32

winmm

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 301KB - Virtual size: 300KB

.data Size: 31KB - Virtual size: 63KB

.rsrc Size: 115KB - Virtual size: 115KB

.reloc Size: 173KB - Virtual size: 172KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 301KB - Virtual size: 300KB

.data
Size: 31KB - Virtual size: 63KB

.rsrc
Size: 115KB - Virtual size: 115KB

.reloc
Size: 173KB - Virtual size: 172KB