2024-05-25_1baa244660a49ea860b80e56c3ba2ea9_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-25_1baa244660a49ea860b80e56c3ba2ea9_mafia
Size

1.1MB
MD5

1baa244660a49ea860b80e56c3ba2ea9
SHA1

7d873e1b7083d8c9e7f470aa5edab2edf1228bcc
SHA256

749aff287a9634461b38534bd11d98c92653fec8db1f1f3ccd55f7fa9fdd15e2
SHA512

6c9423f1bad6d04d31ca67158b23d674bd0ef7b826692e21f72ef83cdabce03dc8d3584f074fc5be3e19c7f70bc234f80a86029fd38ff510868942eefc54bff9
SSDEEP

24576:+K+JZq545UTNElZfUxGV9zTIEqgd0YY2m5:9+JAru7+GV6EqgCY12

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-25_1baa244660a49ea860b80e56c3ba2ea9_mafia

Files

2024-05-25_1baa244660a49ea860b80e56c3ba2ea9_mafia
.exe windows:5 windows x86 arch:x86

959df3285c60a250964ca19cae4f070f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\qiangp\Perforce\perforce_1666\qiangp_FX-JSJ625\Fun Player\Rel2.8.6\src\toolkits\bin\Release\FunBaikal.pdb

Imports

wininet

InternetOpenUrlW
InternetReadFile
InternetGetConnectedState
InternetOpenA
HttpQueryInfoA
InternetSetOptionA
HttpQueryInfoW
InternetCloseHandle

gdiplus

GdipCreateLineBrushI
GdipSetStringFormatLineAlign
GdipCreateBitmapFromFile
GdipSetTextRenderingHint
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipFree
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdiplusStartup
GdipReleaseDC
GdipDeleteGraphics
GdipCreateFromHDC
GdipLoadImageFromFileICM
GdipDrawImageRectRect
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipGetImageHeight
GdipGetImageWidth
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipDrawString
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDrawLine
GdipDeletePen
GdipCreatePen1
GdipResetClip
GdipEndContainer
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipBeginContainer2
GdipSetClipRect
GdiplusShutdown

kernel32

HeapFree
CloseHandle
HeapAlloc
CreateEventA
GetPrivateProfileStringW
LoadLibraryW
GetProcAddress
FreeLibrary
GetModuleFileNameW
GetTempPathW
GetNativeSystemInfo
GetVersionExW
MoveFileExW
CopyFileW
DeleteFileW
lstrlenW
lstrcmpiW
RaiseException
GetLastError
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
CreateEventW
WritePrivateProfileStringW
GetPrivateProfileIntW
SetEvent
GetCurrentThreadId
InterlockedExchange
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
GetModuleHandleExA
ResetEvent
WriteFile
SetFilePointer
CreateFileW
ReadFile
GetFileSize
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCurrentProcess
GetFileAttributesExW
FindClose
SetFileAttributesW
TerminateProcess
OpenProcess
LeaveCriticalSection
Process32FirstW
GetCurrentProcessId
CreateToolhelp32Snapshot
GetFileAttributesW
TerminateThread
SetHandleInformation
CreateProcessA
GetStdHandle
CreatePipe
GetModuleFileNameA
CreateFileA
GetLocalTime
GetCurrentDirectoryW
FreeResource
GetProcessHeap
GetACP
DosDateTimeToFileTime
SystemTimeToFileTime
GetFileType
DuplicateHandle
MulDiv
GetStringTypeW
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
OpenEventA
ResumeThread
LocalFree
FormatMessageA
QueryPerformanceCounter
HeapDestroy
HeapReAlloc
HeapSize
EnterCriticalSection
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
Sleep
WideCharToMultiByte
GlobalUnlock
GlobalLock
DeleteFileA
GlobalAlloc
GetModuleHandleW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
RtlUnwind
GetTimeZoneInformation
GetDriveTypeA
CreateDirectoryA
SetEnvironmentVariableA
GetCurrentDirectoryA
SetCurrentDirectoryA
LCMapStringW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetOEMCP
IsValidCodePage
SetLastError
IsProcessorFeaturePresent
HeapCreate
GetLocaleInfoW
SetHandleCount
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ExitProcess
GetTickCount
ExitThread
CreateThread
FindFirstFileExA
FindNextFileA
GetCommandLineW
HeapSetInformation
GetStartupInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetStdHandle
GetFullPathNameA
GetFileInformationByHandle
PeekNamedPipe
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
CompareStringW
GetDriveTypeW
SetEndOfFile
GetFileAttributesA
SetFileAttributesA
Process32NextW

user32

GetPropW
SetPropW
CallWindowProcW
GetClassInfoExW
LoadImageW
EnableWindow
MessageBoxW
IsZoomed
SetWindowRgn
MonitorFromWindow
GetWindowTextW
IsIconic
GetParent
PtInRect
GetFocus
GetCursorPos
ScreenToClient
MapWindowPoints
IsRectEmpty
EndPaint
BeginPaint
GetUpdateRect
SetFocus
GetWindowTextLengthW
SetWindowTextW
CharPrevW
SetRect
DrawTextW
FillRect
DestroyIcon
DrawIconEx
OffsetRect
GetSysColor
ClientToScreen
SetCaretPos
HideCaret
ShowCaret
CreateCaret
wvsprintfW
InflateRect
GetMonitorInfoW
GetWindow
GetKeyState
GetSystemMetrics
IntersectRect
SetTimer
UnregisterClassW
KillTimer
WaitMessage
GetQueueStatus
TranslateMessage
RegisterClassExW
CallMsgFilterW
MsgWaitForMultipleObjectsEx
DispatchMessageW
PeekMessageW
ReleaseCapture
SetCapture
SendMessageW
UpdateLayeredWindow
GetWindowDC
ReleaseDC
GetDC
InvalidateRect
DefWindowProcW
GetWindowLongW
SetWindowLongW
SystemParametersInfoW
DestroyWindow
IsWindow
CreateWindowExW
RegisterClassW
SetCursor
LoadCursorW
CharNextW
ShowWindow
PostQuitMessage
PostMessageW
GetWindowRect
SetWindowPos
GetClientRect
LoadIconW

advapi32

RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW

ole32

CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoInitialize
CoUninitialize
CoCreateGuid
CoTaskMemRealloc

shell32

SHGetSpecialFolderPathW
SHFileOperationW
SHCreateDirectoryExW

oleaut32

VarUI4FromStr

shlwapi

PathRemoveFileSpecW
PathFindFileNameW
PathIsFileSpecW
PathFileExistsW

comctl32

_TrackMouseEvent
ord17

gdi32

CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject
DeleteDC
CreateDIBSection
GetObjectW
GetStockObject
CreateFontIndirectW
CreatePen
SaveDC
RestoreDC
Rectangle
SetWindowOrgEx
GetTextMetricsW
CreateRoundRectRgn
GetDeviceCaps
SelectClipRgn
GetClipBox
CreateRectRgnIndirect
ExtSelectClipRgn
CombineRgn
StretchBlt
SetStretchBltMode
SetBkColor
ExtTextOutW
CreateSolidBrush
CreatePenIndirect
MoveToEx
LineTo
RoundRect
SetBkMode
SetTextColor
GetCharABCWidthsW
GetTextExtentPoint32W
TextOutW
GetObjectA

wsock32

WSAGetLastError
htons
shutdown
WSACleanup
recv
htonl
socket
closesocket
send
connect
WSAStartup

urlmon

UrlMkGetSessionOption

ws2_32

WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Sections

.text
Size: 630KB - Virtual size: 629KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 265KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

959df3285c60a250964ca19cae4f070f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wininet

gdiplus

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

comctl32

gdi32

wsock32

urlmon

ws2_32

version

Sections

.text Size: 630KB - Virtual size: 629KB

.rdata Size: 140KB - Virtual size: 140KB

.data Size: 32KB - Virtual size: 115KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 265KB - Virtual size: 265KB

.reloc Size: 81KB - Virtual size: 81KB

.text
Size: 630KB - Virtual size: 629KB

.rdata
Size: 140KB - Virtual size: 140KB

.data
Size: 32KB - Virtual size: 115KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 265KB - Virtual size: 265KB

.reloc
Size: 81KB - Virtual size: 81KB