2024-04-18_c233b629472290501e0371b4722bef93_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-18_c233b629472290501e0371b4722bef93_mafia
Size

1002KB
MD5

c233b629472290501e0371b4722bef93
SHA1

65c7a1960a3a3413cd026dbce50e85f5f96cf712
SHA256

51eb8fb02ceebced5e650d1e6966157e252a50a301949abef732e3c750b4695a
SHA512

c4cc8c9ba05368cce80d613ac06adfe6091fe22807f4f1a9ec54fa76a0e7f0dd64b9d21b0b229b7fff2a1125b1ab341067223ed7614a98cf79cb0c518ba04a00
SSDEEP

24576:1GXFj+nWz/S1KJNS5OqNex0N28EP0aFEEY4kZt0eKVvH6Yo:1O5N6EYde6Yo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-18_c233b629472290501e0371b4722bef93_mafia

Files

2024-04-18_c233b629472290501e0371b4722bef93_mafia
.exe regsvr32 windows:5 windows x86 arch:x86

05edfdfa441ff75041f8351501ce6497

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\work\code\svn\m63\bdbrowser\BDBrowserOutput\Release\BaiduBrowser_Mini.pdb

Imports

bdcommon

?InsertStringTable@String@Help@@YAJPAY01QB_WI@Z
?CreateObjectByInterface@Com@Util@@YGJPA_WPAPAX@Z
?UnInitWinService@Com@Util@@YGJXZ
?GetHexCode@String@Help@@YA_WHH@Z
?CreateObjectAgrgtByIID@Com@Util@@YGJABU_GUID@@PAPAXPAUIUnknown@@@Z
?CreateObjectByIID@Com@Util@@YGJABU_GUID@@PAPAX@Z
?ClearService@Com@Util@@YGJXZ
?SetATLModule@Com@Util@@YGJPAX@Z
?RegService@Com@Util@@YGJABU_GUID@@0PA_W1@Z
?RegObject@Com@Util@@YGJABU_GUID@@0PA_W1@Z
?SetMulTimer@Timer@Common@Util@@YAJIPAUITimerCallback@@I@Z
GetLogController
?GetService@Com@Util@@YGJABU_GUID@@PAPAX@Z
?SetOneTimer@Timer@Common@Util@@YAJIPAUITimerCallback@@I@Z
?EraseTimerCallback@Timer@Common@Util@@YAJPAUITimerCallback@@I@Z
?LoadStringW@String@Help@@YAPB_WPB_W@Z

wininet

InternetSetCookieExW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

msimg32

AlphaBlend

psapi

GetModuleFileNameExW
EnumProcessModules
EnumProcesses

shlwapi

PathRemoveFileSpecW
StrCmpW
PathFileExistsW
SHGetValueW

comctl32

InitCommonControlsEx

kernel32

RaiseException
LocalFree
GetModuleFileNameW
GetFileAttributesW
GetModuleHandleW
GetProcAddress
GetLastError
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
SetLastError
CreateProcessW
CloseHandle
GetCurrentProcessId
GetCurrentProcess
OpenProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
GetPrivateProfileStringW
ExitProcess
CreateMutexW
ReleaseMutex
HeapAlloc
GetProcessHeap
HeapFree
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCommandLineW
SetUnhandledExceptionFilter
GetLocalTime
CreateToolhelp32Snapshot
Thread32First
OpenThread
SuspendThread
ResumeThread
Thread32Next
VirtualQuery
IsBadWritePtr
LoadLibraryW
GetModuleHandleA
CreateFileW
ReadFile
GlobalFindAtomW
TerminateProcess
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
lstrcmpiW
FlushInstructionCache
GetVersionExW
WideCharToMultiByte
GetTickCount
SetProcessWorkingSetSize
lstrlenA
WriteFile
GetFileSize
CreateDirectoryW
FindClose
FindFirstFileW
ProcessIdToSessionId
FreeLibrary
QueryInformationJobObject
IsProcessInJob
SetEvent
GlobalAddAtomW
CreateEventW
LoadLibraryExW
SetThreadLocale
GetThreadLocale
GetCurrentThread
ExpandEnvironmentStringsW
InterlockedExchangeAdd
VirtualProtect
VirtualAlloc
InterlockedCompareExchange
SetThreadContext
GetThreadContext
LoadLibraryA
UnhandledExceptionFilter
EncodePointer
DecodePointer
ExitThread
CreateThread
HeapSetInformation
GetStartupInfoW
RtlUnwind
GetSystemTimeAsFileTime
HeapCreate
HeapDestroy
IsProcessorFeaturePresent
GetStdHandle
GetLocaleInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapReAlloc
HeapSize
IsDebuggerPresent
InterlockedExchange
GetConsoleCP
GetConsoleMode
SetFilePointer
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
FlushFileBuffers
WriteConsoleW
SetEndOfFile
lstrlenW

user32

ShowWindow
MapWindowPoints
GetClientRect
GetWindowLongW
SendMessageW
LoadImageW
CharLowerBuffW
BringWindowToTop
AttachThreadInput
GetWindowThreadProcessId
FindWindowW
SetForegroundWindow
GetForegroundWindow
DefWindowProcW
MessageBoxW
IsWindowEnabled
SendMessageTimeoutW
RegisterClassExW
MonitorFromPoint
SetWindowPos
IsZoomed
EnableWindow
GetAncestor
ScreenToClient
CloseDesktop
OpenInputDesktop
FindWindowExW
AllowSetForegroundWindow
wsprintfW
UnregisterClassA
PostMessageW
GetWindow
GetClassNameW
SetWindowTextW
GetSystemMetrics
SetWindowPlacement
MonitorFromRect
IsIconic
EnumThreadWindows
GetCursorPos
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
GetWindowPlacement
IsWindow
IsWindowVisible
CopyRect
PtInRect
GetActiveWindow
GetParent
SystemParametersInfoW
EqualRect
OffsetRect
SetWindowLongW
IsRectEmpty
CharNextW
CloseWindowStation
DestroyWindow
CreateWindowExW
SetProcessWindowStation
OpenWindowStationA
UnregisterClassW
GetProcessWindowStation

gdi32

CreateDIBSection
SelectObject
DeleteObject
CreateCompatibleDC
DeleteDC

advapi32

GetSecurityDescriptorSacl
InitializeSecurityDescriptor
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegDeleteValueW
RegEnumKeyExW
RegSetValueExW
RegDeleteKeyW
RegCreateKeyExW
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey

shell32

CommandLineToArgvW
SHGetFileInfoW
SHGetMalloc
SHGetFolderPathW
SHGetSpecialFolderPathW

ole32

CoInitialize
OleInitialize
OleUninitialize
CoUninitialize
CoTaskMemFree
StringFromCLSID
CoCreateInstance
CoSetProxyBlanket
CoTaskMemAlloc
StringFromGUID2
CoTaskMemRealloc

oleaut32

SysStringLen
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
VarBstrCmp
VariantInit
SysAllocStringLen
RegisterTypeLi
UnRegisterTypeLi
VarBstrCat
SysStringByteLen
SysAllocStringByteLen
VariantClear
SysAllocString
SysFreeString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 533KB - Virtual size: 532KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 276KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 83KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

05edfdfa441ff75041f8351501ce6497

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bdcommon

wininet

version

msimg32

psapi

shlwapi

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 533KB - Virtual size: 532KB

.rdata Size: 276KB - Virtual size: 276KB

.data Size: 83KB - Virtual size: 92KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 31KB - Virtual size: 31KB

.reloc Size: 76KB - Virtual size: 76KB

.text
Size: 533KB - Virtual size: 532KB

.rdata
Size: 276KB - Virtual size: 276KB

.data
Size: 83KB - Virtual size: 92KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 31KB - Virtual size: 31KB

.reloc
Size: 76KB - Virtual size: 76KB