NEAS[.]2023-09-08_674335ef776673cc6918b2473f7eafd1_mafia_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2023-09-08_674335ef776673cc6918b2473f7eafd1_mafia_JC.exe
Size

354KB
MD5

674335ef776673cc6918b2473f7eafd1
SHA1

7c7c3cfbe8ae159b854d5c2e89a3cc173225682b
SHA256

34c3359f11f25fe80ec2ecb607a1026174f2daeb69827cce402398b48126cd1b
SHA512

13190fa55d4559ab6e201ad8f238fb2e98289d4fd461aa7221b050f8a336e87c49c739895015fdbc0d795dae7cd343ded12e3ce8918cac10f161e7a59acd4d79
SSDEEP

3072:1sAtO0O9OwT1fE9H2KxvKvZLqElPzu2T2wIgaiazgx1NfvQ9EgTjScesaL:1hO0cZnKxvKvZFz5T2cfaz2NfY99Sc0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2023-09-08_674335ef776673cc6918b2473f7eafd1_mafia_JC.exe

Files

NEAS.2023-09-08_674335ef776673cc6918b2473f7eafd1_mafia_JC.exe
.exe windows:5 windows x86

392f0be6de387859b09ad26ba9d67eb8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

bcrypt

BCryptFreeBuffer
BCryptEnumAlgorithms
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptDestroyKey
BCryptEncrypt
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptSetProperty
BCryptDecrypt
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash

ncrypt

NCryptFreeBuffer
NCryptEnumKeys
NCryptFreeObject
NCryptOpenStorageProvider
NCryptDeleteKey
NCryptOpenKey
NCryptGetProperty
NCryptExportKey
NCryptEncrypt
NCryptDecrypt
NCryptSignHash
NCryptDeriveKey
NCryptSecretAgreement
NCryptImportKey
NCryptFinalizeKey
NCryptSetProperty
NCryptCreatePersistedKey
NCryptVerifySignature

ws2_32

gethostname
socket
bind
ioctlsocket
WSAStartup
closesocket
WSACleanup
getaddrinfo
freeaddrinfo
getnameinfo
setsockopt
htonl
htons
ntohs
recvfrom
select
__WSAFDIsSet
sendto
ntohl
WSAGetLastError

iphlpapi

GetAdaptersAddresses

kernel32

CompareStringW
CreateFileW
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
LCMapStringW
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
HeapSize
GetProcessHeap
SetEndOfFile
RtlUnwind
RaiseException
WriteConsoleW
SetStdHandle
SetFilePointer
GetTimeZoneInformation
GetStartupInfoW
SetHandleCount
FlushFileBuffers
SetEnvironmentVariableA
GetStdHandle
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLocaleInfoW
LoadLibraryW
InterlockedExchange
SetConsoleCtrlHandler
FatalAppExitA
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
HeapDestroy
HeapCreate
IsProcessorFeaturePresent
GetCurrentThread
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetModuleFileNameW
HeapAlloc
GetSystemTimeAsFileTime
FormatMessageA
GetLastError
GetFullPathNameA
FreeLibrary
LoadLibraryA
Sleep
SetPriorityClass
GetCurrentProcess
GetCurrentProcessId
HeapFree
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
MultiByteToWideChar
ReadFile
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
CloseHandle
DuplicateHandle
GetFileType
CreateFileA
EncodePointer
GetCommandLineA
HeapSetInformation
GetCPInfo

Sections

.text
Size: 243KB - Virtual size: 243KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 66.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

392f0be6de387859b09ad26ba9d67eb8

Headers

DLL Characteristics

File Characteristics

Imports

bcrypt

ncrypt

ws2_32

iphlpapi

kernel32

Sections

.text Size: 243KB - Virtual size: 243KB

.rdata Size: 25KB - Virtual size: 24KB

.data Size: 26KB - Virtual size: 66.5MB

.idata Size: 5KB - Virtual size: 4KB

.reloc Size: 53KB - Virtual size: 53KB

.text
Size: 243KB - Virtual size: 243KB

.rdata
Size: 25KB - Virtual size: 24KB

.data
Size: 26KB - Virtual size: 66.5MB

.idata
Size: 5KB - Virtual size: 4KB

.reloc
Size: 53KB - Virtual size: 53KB