2024-03-10_8387ba8bd17ac87566f260b6a0665d68_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-10_8387ba8bd17ac87566f260b6a0665d68_mafia
Size

3.9MB
MD5

8387ba8bd17ac87566f260b6a0665d68
SHA1

2a83a33c64586b08df3b846756a11daa759c2b9e
SHA256

96f27da03f63ad98ab834b853dcef555dfb52d6d1478748071f32a3f125810ff
SHA512

b90671938a0918a874479f37c152048fa50eab42185cfe3315fb5bc2ae19c4f3fe69866309528bde8d8b1d21c796df467f5ef29efa60edfdc224eb618e025fd6
SSDEEP

98304:WG6+2o/uW9oYyQHvxJ1UuoXiyCdufpunWTVLopOwKkZJo/rs5Z9ZfTg7omt8px:WH+2iZlnqCUxopOwKkZIaZ87ht8px

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-10_8387ba8bd17ac87566f260b6a0665d68_mafia

Files

2024-03-10_8387ba8bd17ac87566f260b6a0665d68_mafia
.exe windows:5 windows x86 arch:x86

df2166ea90bcb625c47a0d9dd5d4830f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\ly_3D\Program\QQLaunch\QQLaunch\Release\QQLaunch.pdb

Imports

ws2_32

getaddrinfo
freeaddrinfo
WSAIoctl
WSACleanup
gethostbyname
WSAStartup
inet_ntoa
send
recv
closesocket
socket
setsockopt
inet_addr
htons
connect

kernel32

ExitThread
GetFileInformationByHandle
GetDriveTypeA
FindFirstFileExA
WriteConsoleW
RtlUnwind
RaiseException
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapSize
HeapQueryInformation
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
HeapCreate
QueryPerformanceCounter
UnhandledExceptionFilter
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
LCMapStringW
IsProcessorFeaturePresent
GetStringTypeW
GetFullPathNameA
CreateFileA
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetProcessHeap
SetEnvironmentVariableA
HeapFree
DecodePointer
EncodePointer
GetStartupInfoW
HeapSetInformation
GetCommandLineW
FindResourceExW
GetUserDefaultLCID
VirtualProtect
SearchPathW
GetProfileIntW
GetNumberFormatW
GetWindowsDirectoryW
GetTempPathW
GetTempFileNameW
lstrcpyW
SetErrorMode
GetFileSizeEx
GetFileAttributesW
GetFileAttributesExW
GlobalFlags
lstrlenA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
InterlockedIncrement
GlobalFindAtomW
CompareStringW
GlobalAddAtomW
SuspendThread
ResumeThread
SetThreadPriority
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
lstrcmpA
GlobalDeleteAtom
GetCurrentThread
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoW
lstrcmpW
InterlockedExchange
GlobalGetAtomNameW
GetFullPathNameW
GetVolumeInformationW
HeapReAlloc
FindClose
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
MoveFileW
GetModuleHandleW
lstrcmpiW
GetThreadLocale
LocalAlloc
InitializeCriticalSectionAndSpinCount
FileTimeToLocalFileTime
CreateEventW
InterlockedDecrement
ActivateActCtx
ReleaseActCtx
CreateActCtxW
DeactivateActCtx
CopyFileW
GlobalSize
MulDiv
GetModuleHandleA
LoadLibraryA
GetSystemDirectoryA
VerifyVersionInfoA
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
WaitForMultipleObjects
PeekNamedPipe
ReadFile
FormatMessageA
SleepEx
SetLastError
ReleaseMutex
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalFree
GlobalLock
FreeResource
GlobalAlloc
OutputDebugStringW
RemoveDirectoryW
DeleteFileW
WaitForSingleObject
CreateProcessW
MoveFileExW
GetDiskFreeSpaceExW
GetDriveTypeW
GetLogicalDriveStringsW
GetCurrentDirectoryW
TerminateProcess
GetVersionExW
Process32NextW
OpenProcess
Process32FirstW
CreateToolhelp32Snapshot
CreateMutexW
VerifyVersionInfoW
VerSetConditionMask
GetModuleFileNameW
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
FreeLibrary
CreateThread
WideCharToMultiByte
lstrlenW
CloseHandle
FileTimeToSystemTime
GetFileTime
CreateFileW
Sleep
GetTickCount
LocalFree
FormatMessageW
SetCurrentDirectoryW
CreateDirectoryW
GetLastError
SetEvent
GetProcAddress
LoadLibraryW
FindResourceW
LoadResource
LockResource
DeleteFileA
SizeofResource
MultiByteToWideChar
ExitProcess
MoveFileA
HeapAlloc
GetCPInfo
FindFirstFileW
CreateDirectoryA
InterlockedCompareExchange
GetTimeFormatA
GetDateFormatA
SetHandleCount

user32

DestroyIcon
IsIconic
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
SetRect
IsRectEmpty
CopyAcceleratorTableW
OffsetRect
CharNextW
SetLayeredWindowAttributes
EnumDisplayMonitors
SystemParametersInfoW
SetRectEmpty
DeleteMenu
ReleaseCapture
WindowFromPoint
SetCapture
IntersectRect
InflateRect
RealChildWindowFromPoint
UnregisterClassW
GetSysColorBrush
RegisterWindowMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
GetMessagePos
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
UpdateWindow
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
CopyRect
PtInRect
SetWindowPlacement
GetWindowPlacement
CallWindowProcW
GetMenu
GetWindowTextLengthW
GetWindowTextW
SetFocus
MoveWindow
GetDlgCtrlID
SetWindowTextW
IsDialogMessageW
SendDlgItemMessageW
CheckDlgButton
CloseClipboard
SetCursor
SetWindowsHookExW
CallNextHookEx
GetMessageW
GetMenuItemInfoW
IsWindowVisible
GetKeyState
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
IsWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
GetWindow
SetWindowContextHelpId
MapDialogRect
WaitMessage
PeekMessageW
DispatchMessageW
PostQuitMessage
CharUpperW
GetSystemMetrics
GetDesktopWindow
GetWindowThreadProcessId
GetLastActivePopup
IsWindowEnabled
MessageBoxW
GetSysColor
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ScreenToClient
GrayStringW
DrawTextExW
DrawTextW
SetClipboardData
OpenClipboard
GetUpdateRect
TabbedTextOutW
FillRect
FrameRect
IsClipboardFormatAvailable
SetMenuDefaultItem
PostThreadMessageW
UnhookWindowsHookEx
GetMenuState
GetMenuStringW
AppendMenuW
GetMenuItemID
InsertMenuW
GetMenuItemCount
GetSubMenu
RemoveMenu
EnableWindow
PostMessageW
SetTimer
KillTimer
GetClassLongW
SendMessageW
LoadIconW
GetParent
GetWindowRgn
DestroyWindow
ShowWindow
SetWindowPos
GetWindowRect
CreateWindowExW
LoadCursorW
DefWindowProcW
DestroyMenu
TranslateAcceleratorW
BringWindowToTop
CreatePopupMenu
InsertMenuItemW
LoadAcceleratorsW
LoadImageW
DestroyCursor
DrawIcon
InvalidateRect
UpdateLayeredWindow
SetWindowLongW
GetWindowLongW
ClientToScreen
wsprintfW
GetClientRect
CreateMenu
IsMenu
SubtractRect
MapVirtualKeyExW
IsCharLowerW
GetDoubleClickTime
CharUpperBuffW
CopyIcon
TranslateMessage
EmptyClipboard
MonitorFromPoint
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
UnionRect
GetKeyNameTextW
CopyImage
GetIconInfo
EnableScrollBar
HideCaret
InvertRect
GetMenuDefaultItem
RegisterClipboardFormatW
LockWindowUpdate
SetCursorPos
CreateAcceleratorTableW
GetKeyboardState
GetKeyboardLayout
MapVirtualKeyW
ToUnicodeEx
DrawFocusRect
DrawFrameControl
DrawEdge
DrawIconEx
DrawStateW
GetSystemMenu
SetClassLongW
GetAsyncKeyState
NotifyWinEvent
DestroyAcceleratorTable
SetParent
RedrawWindow
SetWindowRgn
IsZoomed
UnpackDDElParam
ReuseDDElParam
ShowOwnedPopups
LoadMenuW

gdi32

GetObjectW
GetViewportExtEx
GetWindowExtEx
GetPixel
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
CreateBitmap
GetStockObject
SelectPalette
GetObjectType
CreatePen
CreateSolidBrush
CreateHatchBrush
CreateFontIndirectW
CreateRectRgnIndirect
SetRectRgn
CombineRgn
GetMapMode
PatBlt
DPtoLP
CreateDIBitmap
GetTextMetricsW
GetTextCharsetInfo
SelectClipRgn
GetTextColor
GetRgnBox
GetTextExtentPoint32W
CreateDIBSection
CreateRoundRectRgn
CreatePolygonRgn
CreateEllipticRgn
Polyline
Ellipse
Polygon
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
OffsetRgn
SetDIBColorTable
StretchBlt
SetPixel
Rectangle
EnumFontFamiliesExW
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
GetTextFaceW
SetPixelV
GetBkColor
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetTextColor
SetROP2
SetPolyFillMode
SetBkColor
RestoreDC
SaveDC
CreateDCW
CopyMetaFileW
GetDeviceCaps
DeleteObject
PtInRegion
CreateRectRgn
BitBlt
CreateCompatibleBitmap
EnumFontFamiliesW
SetBkMode
CreateCompatibleDC

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegDeleteValueW
RegQueryValueExW
RegCloseKey
RegCreateKeyW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
CryptDestroyKey
CryptEncrypt
CryptReleaseContext
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyW
RegCreateKeyExW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextA
CryptImportKey

shell32

SHGetSpecialFolderLocation
ShellExecuteW
ShellExecuteExW
SHGetFileInfoW
DragFinish
SHBrowseForFolderW
SHAppBarMessage
SHCreateDirectoryExW
SHGetPathFromIDListW
SHGetDesktopFolder
DragQueryFileW

comctl32

ImageList_GetIconSize

shlwapi

PathStripToRootW
PathIsUNCW
PathFindExtensionW
PathFindFileNameW
UrlUnescapeW
PathRemoveFileSpecW

ole32

CreateStreamOnHGlobal
CoTaskMemFree
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
CoRegisterMessageFilter
CoRevokeClassObject
DoDragDrop
OleFlushClipboard
OleIsCurrentClipboard
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoInitializeEx
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoInitialize
CoUninitialize
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoCreateGuid
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantChangeType
VariantInit
SysAllocStringLen
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
OleCreateFontIndirect
VarBstrFromDate

oledlg

OleUIBusyW

wsock32

getsockopt
gethostname
WSASetLastError
__WSAFDIsSet
WSAGetLastError
select
getsockname
getpeername
ntohs
bind
sendto
recvfrom
listen
accept
inet_ntoa

gdiplus

GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipFree
GdipAlloc
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesWrapMode
GdipCreateMatrix
GdipDeleteMatrix
GdipSetMatrixElements
GdipTranslateMatrix
GdipRotateMatrix
GdipDeleteBrush
GdipCloneBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenLineJoin
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipCreatePath
GdipDeletePath
GdipAddPathString
GdipAddPathStringI
GdipTransformPath
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipSetWorldTransform
GdipResetWorldTransform
GdipDrawPath
GdipFillPath
GdipDrawImageI
GdipDrawImagePointsI
GdipDrawImageRectRect
GdipGetPathWorldBounds
GdipGetImageWidth
GdipGetImageHeight
GdipAddPathRectangleI
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdiplusStartup
GdiplusShutdown
GdipDisposeImage
GdipLoadImageFromStream
GdipCloneImage
GdipCreateBitmapFromHBITMAP
GdipDrawImageRectI
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromStream

iphlpapi

GetAdaptersInfo

wininet

HttpSendRequestW
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetOpenW
InternetGetLastResponseInfoW
InternetCloseHandle
HttpQueryInfoW
HttpAddRequestHeadersW
InternetQueryDataAvailable
InternetSetOptionExW
InternetCanonicalizeUrlW
InternetCrackUrlW
HttpOpenRequestW
InternetConnectW

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmGetOpenStatus
ImmReleaseContext
ImmGetContext

winmm

PlaySoundW

wldap32

ord22
ord211
ord46
ord41
ord79
ord35
ord301
ord33
ord32
ord200
ord30
ord27
ord26
ord50
ord60
ord143

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_version
curl_version_info

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 339KB - Virtual size: 339KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 197KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

df2166ea90bcb625c47a0d9dd5d4830f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

wsock32

gdiplus

iphlpapi

wininet

oleacc

imm32

winmm

wldap32

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 339KB - Virtual size: 339KB

.data Size: 68KB - Virtual size: 99KB

.rsrc Size: 1.6MB - Virtual size: 1.6MB

.reloc Size: 197KB - Virtual size: 196KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 339KB - Virtual size: 339KB

.data
Size: 68KB - Virtual size: 99KB

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 197KB - Virtual size: 196KB