2024-05-16_801d69af7e56deac7654cfd6fd1705ff_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-16_801d69af7e56deac7654cfd6fd1705ff_mafia
Size

331KB
MD5

801d69af7e56deac7654cfd6fd1705ff
SHA1

53869dd1d3d15fad903a31e4c651956b453bc3a1
SHA256

5bcf163fc0fa36f70dfee97a45a4e0b9547bdeab9a3dc1acfeb2daa81038dc84
SHA512

c996e55d8b2dd9ce559de7021aeb0f6250d60049ee3434178d16cc2ce11531db5dadb525a651dee665fe33db00f7e3796aafd797415c63996e15dd864cdd9540
SSDEEP

6144:c1xl1wJW39/Bj2R9kyJXno1Bh99CRk7myaXVhkPjxZdPKk4SalLqf3KfGYwG8rwJ:c1D1wi9sayJXnWsRk7+XVhkXdPKjjPGQ

Score

1^/10

Malware Config

Signatures

Files

2024-05-16_801d69af7e56deac7654cfd6fd1705ff_mafia
.exe windows:5 windows x86 arch:x86

71087df8663c02353c67e2269af44d04

Code Sign

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/04/2012, 00:00

Not After

24/04/2015, 23:59

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:be:39:70:0e:95:57:7b:10:4e:e7:0c:df:58:7f:40:e8:09:37:24
Signer

Actual PE Digest

42:be:39:70:0e:95:57:7b:10:4e:e7:0c:df:58:7f:40:e8:09:37:24

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\client\build\Release\bdMiniDownloader.pdb

Imports

wininet

HttpOpenRequestW
HttpAddRequestHeadersW
InternetConnectW
InternetOpenW
InternetCrackUrlW
HttpQueryInfoW
HttpSendRequestW
InternetCloseHandle
InternetReadFile

shlwapi

PathAppendW
PathFileExistsW
PathFindFileNameW

iphlpapi

GetAdaptersInfo

psapi

EnumProcesses
EnumProcessModules
GetModuleFileNameExW

kernel32

MultiByteToWideChar
WideCharToMultiByte
RaiseException
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
GetCurrentProcess
CloseHandle
GetExitCodeProcess
WaitForSingleObject
GetCurrentThreadId
SetLastError
lstrlenA
lstrlenW
CreateEventW
ExpandEnvironmentStringsW
LocalFree
GetLastError
CreateMutexW
SetEvent
TerminateThread
GetExitCodeThread
WritePrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileStringW
DeleteFileW
WriteFile
SetEndOfFile
SetFilePointer
CreateFileW
DeleteCriticalSection
InitializeCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
CreateDirectoryW
OpenProcess
GetProcAddress
GetModuleHandleW
FreeResource
GlobalUnlock
GlobalLock
GlobalAlloc
GetUserDefaultUILanguage
DecodePointer
EncodePointer
RtlUnwind
ExitThread
CreateThread
HeapFree
HeapAlloc
GetCommandLineW
HeapSetInformation
GetStartupInfoW
IsProcessorFeaturePresent
GetStdHandle
GetModuleFileNameW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
HeapSize
ExitProcess
Sleep
HeapCreate
HeapDestroy
ReadFile
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryW
GetConsoleCP
GetConsoleMode
GetStringTypeW
SetStdHandle
CreateFileA
WriteConsoleW
GetProcessHeap
InterlockedCompareExchange
InterlockedPushEntrySList
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
FlushFileBuffers

user32

GetWindow
GetParent
GetClassInfoExW
LoadCursorW
DestroyWindow
CallWindowProcW
PostQuitMessage
DefWindowProcW
RegisterClassExW
CreateWindowExW
LoadIconW
IsWindowVisible
ReleaseCapture
GetWindowRect
GetCursorPos
SetForegroundWindow
GetCapture
DispatchMessageW
TranslateMessage
GetMessageW
IsWindow
UnregisterClassA
SetWindowPos
PostMessageW
SendMessageW
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
GetClientRect
WindowFromPoint
MapWindowPoints
SetWindowLongW
GetDC
UpdateLayeredWindow
ReleaseDC
GetCursor
SetCursor
SetCapture

advapi32

RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegQueryValueExW

ole32

CoCreateGuid
CreateStreamOnHGlobal
StringFromGUID2

shell32

ShellExecuteExW
CommandLineToArgvW
SHGetSpecialFolderPathW
Shell_NotifyIconW

gdi32

CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetBitmapBits
GetBitmapBits
DeleteDC
DeleteObject

gdiplus

GdipCloneImage
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipGetImageWidth
GdipSetImageAttributesWrapMode
GdipDrawImageRectRect
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetImageHeight
GdipDeleteBrush
GdipFree
GdipAlloc
GdipCreatePen1
GdipDeletePen
GdipCreateSolidFill
GdipDrawRectangleI
GdipFillRectangleI
GdipCloneBrush
GdipCreateStringFormat
GdipDeleteStringFormat
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipSetStringFormatAlign
GdipDrawString
GdiplusStartup
GdiplusShutdown
GdipCreatePath
GdipDeletePath
GdipGetPathWorldBounds
GdipAddPathString
GdipLoadImageFromStream
GdipDisposeImage

wsock32

htonl

Sections

.text
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

71087df8663c02353c67e2269af44d04

Code Sign

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5cCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

42:be:39:70:0e:95:57:7b:10:4e:e7:0c:df:58:7f:40:e8:09:37:24Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wininet

shlwapi

iphlpapi

psapi

kernel32

user32

advapi32

ole32

shell32

gdi32

gdiplus

wsock32

Sections

.text Size: 192KB - Virtual size: 192KB

.rdata Size: 37KB - Virtual size: 36KB

.data Size: 15KB - Virtual size: 25KB

.rsrc Size: 66KB - Virtual size: 65KB

.reloc Size: 16KB - Virtual size: 16KB

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

42:be:39:70:0e:95:57:7b:10:4e:e7:0c:df:58:7f:40:e8:09:37:24
Signer

.text
Size: 192KB - Virtual size: 192KB

.rdata
Size: 37KB - Virtual size: 36KB

.data
Size: 15KB - Virtual size: 25KB

.rsrc
Size: 66KB - Virtual size: 65KB

.reloc
Size: 16KB - Virtual size: 16KB