2024-02-25_004a8b9946054997193d6058f8b10002_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-25_004a8b9946054997193d6058f8b10002_mafia
Size

1.9MB
MD5

004a8b9946054997193d6058f8b10002
SHA1

cdcd65f8150573cf657b603b85ab96990617138e
SHA256

07b3b2e7084d0402a1e5d92abd25cb29d4bf40e27258453a5de9f41d6e18e8fd
SHA512

9cbebedbeddf9db827ccaa1844179264150beae0783e5eb3926612c6c0464001fe1e772350a5ebfa239e1777defc0b550f9f07787d4966ea0ab9fe8d3c9bfeef
SSDEEP

24576:N2S5sbX6niJ+bXfUiA2h6ExYyhurzURkn408xaeXCw4zbv+stOvJ5YpjLjl+IcRm:NwXax4E0rzURraeXC3b6v3YvktCh

Score

1^/10

Malware Config

Signatures

Files

2024-02-25_004a8b9946054997193d6058f8b10002_mafia
.exe windows:5 windows x86 arch:x86

170464cb7779130dce11394c08180213

Code Sign

32:5a:37:37:b8:92:6a:78:35:f0:23:96:3d:83:8f:cc
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

10/04/2014, 00:00

Not After

08/06/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=移动云,O=Baidu Online Network Technology (Beijing) Co.\,Ltd,L=北京,ST=北京,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

10:c8:78:8f:cf:c7:ae:f2:9a:c0:20:72:e2:97:19:7e:6e:b6:26:c8
Signer

Actual PE Digest

10:c8:78:8f:cf:c7:ae:f2:9a:c0:20:72:e2:97:19:7e:6e:b6:26:c8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

P:\app\gensoft\pcsuite\native\app\mini\project\Release\MiniDownloader.pdb

Imports

gdiplus

GdipCloneBrush
GdipDisposeImage
GdipAlloc
GdipCloneImage
GdipImageSelectActiveFrame
GdipDrawImageRectRectI
GdipGetImageHeight
GdipGetImageWidth
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipLoadImageFromStream
GdiplusShutdown
GdiplusStartup
GdipDrawImageRect
GdipDrawImageRectI
GdipSetSmoothingMode
GdipSetImageAttributesWrapMode
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipDeleteGraphics
GdipCreateFromHDC
GdipLoadImageFromFile
GdipFree
GdipDeleteBrush
GdipCreateSolidFill
GdipDrawString
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeleteFont
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipDrawImageRectRect

ws2_32

WSACleanup
WSAStartup
closesocket
WSAGetLastError
WSASetLastError
ioctlsocket
setsockopt
WSASend
WSASocketW
getaddrinfo
freeaddrinfo
connect
__WSAFDIsSet
WSARecv
select
recvfrom
sendto
socket
getpeername
htons
ntohs
WSAIoctl
send
recv
getsockopt
bind
getsockname
inet_addr
listen
accept

kernel32

GetFileInformationByHandle
GetFullPathNameA
FlushFileBuffers
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetOEMCP
GetACP
GetConsoleMode
GetConsoleCP
GetLocaleInfoW
HeapCreate
GetStdHandle
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FindResourceW
LoadResource
FreeResource
SizeofResource
LockResource
GlobalAlloc
GlobalLock
GetSystemTimeAsFileTime
CreateEventA
HeapAlloc
GetProcessHeap
HeapFree
SetEvent
GetLastError
GetProcAddress
LoadLibraryW
FreeLibrary
GetTempPathW
CloseHandle
SetLastError
CreateMutexW
GetTickCount
ExpandEnvironmentStringsW
TerminateProcess
GetCurrentProcess
GlobalUnlock
CreateProcessW
WaitForSingleObject
lstrcpynW
lstrlenW
lstrcpynA
lstrlenA
GetVersionExW
MultiByteToWideChar
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
FindResourceExW
DeleteCriticalSection
InitializeCriticalSection
Sleep
GetModuleHandleW
lstrcmpiW
RaiseException
LoadLibraryExW
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
CreateMutexA
FlushInstructionCache
MulDiv
lstrcmpW
CreateThread
CreateFileW
GetFileSize
SetFilePointer
WriteFile
CreateIoCompletionPort
QueueUserAPC
TerminateThread
InterlockedExchangeAdd
WaitForMultipleObjects
GetQueuedCompletionStatus
SetWaitableTimer
InterlockedExchange
PostQueuedCompletionStatus
InterlockedCompareExchange
TlsFree
TlsAlloc
TlsSetValue
TlsGetValue
SleepEx
CreateEventW
CreateWaitableTimerW
PeekNamedPipe
FindFirstFileW
CreateDirectoryW
ReleaseSemaphore
CreateSemaphoreA
ReadFile
MoveFileW
FindClose
FindNextFileW
DeleteFileW
GetCurrentProcessId
DuplicateHandle
GetFileAttributesW
SetEndOfFile
WideCharToMultiByte
VerifyVersionInfoA
VerSetConditionMask
FormatMessageA
ExpandEnvironmentStringsA
MapViewOfFile
UnmapViewOfFile
ResumeThread
CreateFileMappingW
GetTempPathA
GetEnvironmentVariableA
GetModuleFileNameA
GetSystemDirectoryW
GetLogicalDriveStringsW
GetDriveTypeW
GetDiskFreeSpaceExW
GetVolumeInformationW
GetModuleHandleA
CreateFileA
QueryPerformanceCounter
QueryPerformanceFrequency
DeleteFileA
HeapDestroy
HeapReAlloc
HeapSize
GetStringTypeW
EncodePointer
DecodePointer
GetTimeZoneInformation
GetUserDefaultLCID
GetLocaleInfoA
GetCommandLineW
HeapSetInformation
GetStartupInfoW
ExitThread
SetConsoleCtrlHandler
RtlUnwind
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
GetTimeFormatA
GetDateFormatA
LCMapStringW
GetCPInfo
CompareStringW
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
OpenEventA
ResetEvent
SystemTimeToFileTime
CreateWaitableTimerA
LocalFree
DeviceIoControl
AreFileApisANSI
GetVersion
GlobalMemoryStatus
LoadLibraryA
GetVersionExA
FlushConsoleInputBuffer
GetVolumeInformationA
GlobalFree
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
InterlockedPushEntrySList
GetEnvironmentVariableW
GetCurrentDirectoryW
ReadConsoleInputA
SetConsoleMode
IsProcessorFeaturePresent

user32

DispatchMessageW
GetWindow
MonitorFromWindow
CharNextW
GetParent
CallWindowProcW
GetDlgItem
GetMonitorInfoW
MonitorFromPoint
GetMenuItemInfoW
RemoveMenu
GetMenuItemCount
AppendMenuW
TrackPopupMenuEx
DestroyMenu
CreatePopupMenu
PeekMessageW
MapWindowPoints
MessageBeep
DefWindowProcW
SetFocus
LoadStringA
CreateWindowExW
DestroyWindow
TranslateMessage
GetWindowTextLengthW
GetWindowTextW
PostMessageW
PtInRect
ScreenToClient
GetWindowRect
IsIconic
FillRect
GetMessageW
RegisterClassExW
UnregisterDeviceNotification
wvsprintfW
SetTimer
DrawTextW
EndPaint
BeginPaint
PostQuitMessage
SetWindowPos
SetWindowLongW
GetWindowLongW
ShowWindow
SendMessageW
SetRect
GetClientRect
SetWindowTextW
ClientToScreen
IsWindowVisible
LoadImageW
LoadAcceleratorsW
LoadMenuW
RegisterWindowMessageW
IsChild
GetFocus
GetClassNameW
GetSysColor
RedrawWindow
GetClassInfoExW
CreateAcceleratorTableW
MoveWindow
SetCapture
ReleaseCapture
InvalidateRgn
DestroyAcceleratorTable
TranslateAcceleratorW
GetCursorPos
KillTimer
LoadStringW
ReleaseDC
GetDC
GetDesktopWindow
InvalidateRect
IsWindow
IsRectEmpty
UnregisterClassA
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA
LoadCursorW

gdi32

GetObjectW
CreateCompatibleBitmap
BitBlt
Rectangle
GetStockObject
TextOutW
SetBkMode
CreatePen
CreateSolidBrush
DeleteDC
DeleteObject
SelectObject
CreateFontIndirectW
GetDeviceCaps
SetTextColor
CreateCompatibleDC

advapi32

CryptDestroyHash
RegCloseKey
RegCreateKeyW
RegQueryValueExW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegOpenKeyW
CryptGetHashParam
RegDeleteKeyW
CryptReleaseContext
CryptHashData
CryptAcquireContextA
CryptCreateHash
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW

shell32

SHGetPathFromIDListW
SHCreateDirectoryExW
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetSpecialFolderPathW
SHBrowseForFolderW
ord165

ole32

CoUninitialize
OleInitialize
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
OleUninitialize
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CreateStreamOnHGlobal
StringFromGUID2

oleaut32

VarUI4FromStr
SysFreeString
SysAllocString
OleCreateFontIndirect
SysStringLen
SysAllocStringLen
VariantInit
VariantClear
LoadTypeLi
LoadRegTypeLi

shlwapi

SHGetValueW
PathAppendW
PathFileExistsW

comctl32

_TrackMouseEvent
InitCommonControlsEx

iphlpapi

GetAdaptersInfo

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 283KB - Virtual size: 283KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 263KB - Virtual size: 262KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

170464cb7779130dce11394c08180213

Code Sign

32:5a:37:37:b8:92:6a:78:35:f0:23:96:3d:83:8f:ccCertificate

Extended Key Usages

Key Usages

10:c8:78:8f:cf:c7:ae:f2:9a:c0:20:72:e2:97:19:7e:6e:b6:26:c8Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdiplus

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

iphlpapi

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 283KB - Virtual size: 283KB

.data Size: 40KB - Virtual size: 58KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 263KB - Virtual size: 262KB

.reloc Size: 90KB - Virtual size: 89KB

32:5a:37:37:b8:92:6a:78:35:f0:23:96:3d:83:8f:cc
Certificate

10:c8:78:8f:cf:c7:ae:f2:9a:c0:20:72:e2:97:19:7e:6e:b6:26:c8
Signer

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 283KB - Virtual size: 283KB

.data
Size: 40KB - Virtual size: 58KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 263KB - Virtual size: 262KB

.reloc
Size: 90KB - Virtual size: 89KB