NEAS[.]2023-09-08_ca814f5e0664e89a7bf54f3ed9a5950d_mafia_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2023-09-08_ca814f5e0664e89a7bf54f3ed9a5950d_mafia_JC.exe
Size

146KB
MD5

ca814f5e0664e89a7bf54f3ed9a5950d
SHA1

70096fa2beb39e055a4f5c5f246871ee08b90fb9
SHA256

e1120153538d6438417386176e6f5006d122fec68115ef8bd1b3cedc2b4df555
SHA512

ac281235172e7bccf94bf3d995e999bfa657d69f30d03154139eb849c7c249aa39ae5dc8170467a01efdd0baed34d194bce5dc38a274a66086c8db120ebddc06
SSDEEP

3072:OMAPa+HrYVlZCBXwIAr1jNrQkUospgHFVT:OMBlVloBXwnFLvBlV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2023-09-08_ca814f5e0664e89a7bf54f3ed9a5950d_mafia_JC.exe

Files

NEAS.2023-09-08_ca814f5e0664e89a7bf54f3ed9a5950d_mafia_JC.exe
.exe windows:5 windows x86

02aff732c86115268caa2c25ec545dda

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

urlmon

URLDownloadToFileA

wininet

DeleteUrlCacheEntry

kernel32

InitializeCriticalSectionAndSpinCount
GetProcessHeap
SetEndOfFile
SetEnvironmentVariableA
DeleteFileA
WritePrivateProfileStringA
CreateDirectoryA
GetPrivateProfileStringA
MoveFileA
InterlockedIncrement
InterlockedDecrement
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
RaiseException
RtlUnwind
GetLastError
HeapFree
GetCommandLineA
HeapSetInformation
HeapAlloc
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
GetProcAddress
GetFileAttributesA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
ExitProcess
WriteFile
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointer
FlushFileBuffers
CloseHandle
HeapCreate
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
HeapReAlloc
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
LoadLibraryW
WriteConsoleW
SetStdHandle
CreateFileA
CreateFileW
CompareStringW

Sections

.text
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

02aff732c86115268caa2c25ec545dda

Headers

DLL Characteristics

File Characteristics

Imports

urlmon

wininet

kernel32

Sections

.text Size: 109KB - Virtual size: 109KB

.rdata Size: 21KB - Virtual size: 20KB

.data Size: 6KB - Virtual size: 13KB

.reloc Size: 7KB - Virtual size: 7KB

.rsrc Size: 1024B - Virtual size: 752B

.text
Size: 109KB - Virtual size: 109KB

.rdata
Size: 21KB - Virtual size: 20KB

.data
Size: 6KB - Virtual size: 13KB

.reloc
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 1024B - Virtual size: 752B