NEAS[.]2023-09-07_0566cf709f94c9e8309601c30ad49eb1_mafia_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2023-09-07_0566cf709f94c9e8309601c30ad49eb1_mafia_JC.exe
Size

548KB
MD5

0566cf709f94c9e8309601c30ad49eb1
SHA1

d7978e67a32904fa1a25ad60c7873624ab5349dd
SHA256

fbca748bb73683cea09e7fcc52f9a0e6b8875109a2943541e5cbeb6956f03c71
SHA512

1855ec8a9a4415b6206a125fbbf0447487eb1f4903e657a852fe6b564e4e6b110d79e45438858376be14b0fbc7568a52e73bf24970c2e3c26bff272776fa66e7
SSDEEP

12288:Xm8E8ris+9yVRBygXVk05hVxHlGQ6RauBmt+HjN9MTPo70TdLdU:XmZs+9yLl0RPmSjNeTPoudLdU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2023-09-07_0566cf709f94c9e8309601c30ad49eb1_mafia_JC.exe

Files

NEAS.2023-09-07_0566cf709f94c9e8309601c30ad49eb1_mafia_JC.exe
.exe windows:5 windows x86

40372360963768f9f8c688249c681146

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmpiA
GetVersionExW
GetSystemTimeAsFileTime
ResumeThread
SuspendThread
GlobalFree
FindFirstFileA
GetEnvironmentVariableA
GlobalAlloc
GetCurrentThread
GetCurrentProcess
GetLastError
Sleep
GetModuleFileNameA
CreateDirectoryA
SetErrorMode
SetEnvironmentVariableA
CompareStringW
GetProcessHeap
SetEndOfFile
CreateFileW
CreateFileA
WriteConsoleW
SetStdHandle
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetLocaleInfoW
LoadLibraryW
FreeLibrary
CloseHandle
IsValidCodePage
GetOEMCP
GetACP
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetFilePointer
ReadFile
GetTimeZoneInformation
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetStartupInfoW
GetFileType
SetHandleCount
FormatMessageA
SetUnhandledExceptionFilter
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
MultiByteToWideChar
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
SetConsoleCtrlHandler
GetCommandLineA
HeapSetInformation
GetTimeFormatA
GetDateFormatA
HeapAlloc
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileExA
FindNextFileA
FindClose
GetProcAddress
GetModuleHandleW
ExitProcess
HeapReAlloc
GetCPInfo
RaiseException
RtlUnwind
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapSize
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
LoadLibraryA

advapi32

QueryServiceStatusEx
CloseServiceHandle
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
ControlService
QueryServiceConfigA
OpenSCManagerA
OpenServiceA
SetServiceStatus
StartServiceA
CreateServiceA
RegisterServiceCtrlHandlerA
ChangeServiceConfig2A
DeleteService
StartServiceCtrlDispatcherA

dbghelp

UnDecorateSymbolName
SymGetModuleInfo
SymFromAddr
SymInitialize
StackWalk
SymGetModuleBase
SymFunctionTableAccess
SymCleanup
SymGetLineFromAddr
SymSetOptions

ws2_32

select
__WSAFDIsSet
ioctlsocket
WSAStringToAddressA
connect
inet_ntoa
recvfrom
getaddrinfo
setsockopt
sendto
recv
bind
socket
freeaddrinfo
closesocket
send
listen
getnameinfo
accept
WSAStartup
WSAGetLastError
WSACleanup

iphlpapi

GetAdaptersAddresses

Sections

.text
Size: 416KB - Virtual size: 416KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

40372360963768f9f8c688249c681146

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

dbghelp

ws2_32

iphlpapi

Sections

.text Size: 416KB - Virtual size: 416KB

.rdata Size: 80KB - Virtual size: 79KB

.data Size: 21KB - Virtual size: 222KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 29KB - Virtual size: 28KB

.text
Size: 416KB - Virtual size: 416KB

.rdata
Size: 80KB - Virtual size: 79KB

.data
Size: 21KB - Virtual size: 222KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 29KB - Virtual size: 28KB