2024-03-13_004fe26b5a07aea77d2bdf91a63d84af_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-13_004fe26b5a07aea77d2bdf91a63d84af_mafia
Size

1002KB
MD5

004fe26b5a07aea77d2bdf91a63d84af
SHA1

79d64dbdd3f480e9dbc8d7833f3fdda2d91b2cf6
SHA256

d0e47099b56907627b975e9aaa7926d71fa10956a0f60a687e8dad695c6d872f
SHA512

f583584ed9031343768dca5d9c05117a62b7272e610dc358eb549f70d33265a3ce4fda9bef4356c0774f16e81811a001ad6dedebecbe0b905b38e8adbd22b465
SSDEEP

24576:9R3lj+nWz/S1KJNSJOq9ex0NW8kP0aFPEXYkDt0eKebHPYe:9n5N5EX9FPYe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-13_004fe26b5a07aea77d2bdf91a63d84af_mafia

Files

2024-03-13_004fe26b5a07aea77d2bdf91a63d84af_mafia
.exe regsvr32 windows:5 windows x86 arch:x86

05edfdfa441ff75041f8351501ce6497

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Projects\BaiduBrowser\m63release\bdbrowser\BDBrowserOutput\Release\BaiduBrowser_Mini.pdb

Imports

bdcommon

?InsertStringTable@String@Help@@YAJPAY01QB_WI@Z
?CreateObjectByInterface@Com@Util@@YGJPA_WPAPAX@Z
?UnInitWinService@Com@Util@@YGJXZ
?GetHexCode@String@Help@@YA_WHH@Z
?CreateObjectAgrgtByIID@Com@Util@@YGJABU_GUID@@PAPAXPAUIUnknown@@@Z
?CreateObjectByIID@Com@Util@@YGJABU_GUID@@PAPAX@Z
?ClearService@Com@Util@@YGJXZ
?SetATLModule@Com@Util@@YGJPAX@Z
?RegService@Com@Util@@YGJABU_GUID@@0PA_W1@Z
?RegObject@Com@Util@@YGJABU_GUID@@0PA_W1@Z
?SetMulTimer@Timer@Common@Util@@YAJIPAUITimerCallback@@I@Z
GetLogController
?GetService@Com@Util@@YGJABU_GUID@@PAPAX@Z
?SetOneTimer@Timer@Common@Util@@YAJIPAUITimerCallback@@I@Z
?EraseTimerCallback@Timer@Common@Util@@YAJPAUITimerCallback@@I@Z
?LoadStringW@String@Help@@YAPB_WPB_W@Z

wininet

InternetSetCookieExW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

msimg32

AlphaBlend

psapi

GetModuleFileNameExW
EnumProcessModules
EnumProcesses

shlwapi

PathRemoveFileSpecW
StrCmpW
PathFileExistsW
SHGetValueW

comctl32

InitCommonControlsEx

kernel32

RaiseException
LocalFree
GetModuleFileNameW
GetFileAttributesW
GetModuleHandleW
GetProcAddress
GetLastError
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
SetLastError
CreateProcessW
CloseHandle
GetCurrentProcessId
GetCurrentProcess
OpenProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
GetPrivateProfileStringW
ExitProcess
CreateMutexW
ReleaseMutex
HeapAlloc
GetProcessHeap
HeapFree
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCommandLineW
SetUnhandledExceptionFilter
GetLocalTime
CreateToolhelp32Snapshot
Thread32First
OpenThread
SuspendThread
ResumeThread
Thread32Next
VirtualQuery
IsBadWritePtr
LoadLibraryW
GetModuleHandleA
CreateFileW
ReadFile
GlobalFindAtomW
TerminateProcess
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
lstrcmpiW
FlushInstructionCache
GetVersionExW
WideCharToMultiByte
GetTickCount
SetProcessWorkingSetSize
lstrlenA
WriteFile
GetFileSize
CreateDirectoryW
FindClose
FindFirstFileW
ProcessIdToSessionId
FreeLibrary
QueryInformationJobObject
IsProcessInJob
SetEvent
GlobalAddAtomW
CreateEventW
LoadLibraryExW
SetThreadLocale
GetThreadLocale
GetCurrentThread
ExpandEnvironmentStringsW
InterlockedExchangeAdd
VirtualProtect
VirtualAlloc
InterlockedCompareExchange
SetThreadContext
GetThreadContext
LoadLibraryA
UnhandledExceptionFilter
EncodePointer
DecodePointer
ExitThread
CreateThread
HeapSetInformation
GetStartupInfoW
RtlUnwind
GetSystemTimeAsFileTime
HeapCreate
HeapDestroy
IsProcessorFeaturePresent
GetStdHandle
GetLocaleInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapReAlloc
HeapSize
IsDebuggerPresent
InterlockedExchange
GetConsoleCP
GetConsoleMode
SetFilePointer
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
FlushFileBuffers
WriteConsoleW
SetEndOfFile
lstrlenW

user32

ShowWindow
MapWindowPoints
GetClientRect
GetWindowLongW
SendMessageW
LoadImageW
CharLowerBuffW
BringWindowToTop
AttachThreadInput
GetWindowThreadProcessId
FindWindowW
SetForegroundWindow
GetForegroundWindow
DefWindowProcW
MessageBoxW
IsWindowEnabled
SendMessageTimeoutW
RegisterClassExW
MonitorFromPoint
SetWindowPos
IsZoomed
EnableWindow
GetAncestor
ScreenToClient
CloseDesktop
OpenInputDesktop
FindWindowExW
AllowSetForegroundWindow
wsprintfW
UnregisterClassA
PostMessageW
GetWindow
GetClassNameW
SetWindowTextW
GetSystemMetrics
SetWindowPlacement
MonitorFromRect
IsIconic
EnumThreadWindows
GetCursorPos
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
GetWindowPlacement
IsWindow
IsWindowVisible
CopyRect
PtInRect
GetActiveWindow
GetParent
SystemParametersInfoW
EqualRect
OffsetRect
SetWindowLongW
IsRectEmpty
CharNextW
CloseWindowStation
DestroyWindow
CreateWindowExW
SetProcessWindowStation
OpenWindowStationA
UnregisterClassW
GetProcessWindowStation

gdi32

CreateDIBSection
SelectObject
DeleteObject
CreateCompatibleDC
DeleteDC

advapi32

GetSecurityDescriptorSacl
InitializeSecurityDescriptor
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegDeleteValueW
RegEnumKeyExW
RegSetValueExW
RegDeleteKeyW
RegCreateKeyExW
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey

shell32

CommandLineToArgvW
SHGetFileInfoW
SHGetMalloc
SHGetFolderPathW
SHGetSpecialFolderPathW

ole32

CoInitialize
OleInitialize
OleUninitialize
CoUninitialize
CoTaskMemFree
StringFromCLSID
CoCreateInstance
CoSetProxyBlanket
CoTaskMemAlloc
StringFromGUID2
CoTaskMemRealloc

oleaut32

SysStringLen
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
VarBstrCmp
VariantInit
SysAllocStringLen
RegisterTypeLi
UnRegisterTypeLi
VarBstrCat
SysStringByteLen
SysAllocStringByteLen
VariantClear
SysAllocString
SysFreeString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 533KB - Virtual size: 532KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 276KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 83KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

05edfdfa441ff75041f8351501ce6497

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bdcommon

wininet

version

msimg32

psapi

shlwapi

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 533KB - Virtual size: 532KB

.rdata Size: 276KB - Virtual size: 276KB

.data Size: 83KB - Virtual size: 92KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 31KB - Virtual size: 31KB

.reloc Size: 76KB - Virtual size: 76KB

.text
Size: 533KB - Virtual size: 532KB

.rdata
Size: 276KB - Virtual size: 276KB

.data
Size: 83KB - Virtual size: 92KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 31KB - Virtual size: 31KB

.reloc
Size: 76KB - Virtual size: 76KB