C:\昇泰安\龙宇\工作室\yinyue.fm\封装文件\静默安装包\正常包\Release\Unins.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-25_1af4c91138eaa6bbd7205ade9e201261_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-25_1af4c91138eaa6bbd7205ade9e201261_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-25_1af4c91138eaa6bbd7205ade9e201261_mafia
-
Size
260KB
-
MD5
1af4c91138eaa6bbd7205ade9e201261
-
SHA1
c46458f50cc9030d05f27b0d2ab2742f3dae3251
-
SHA256
749dd9bd73a12fe5e3aa15ca9d5a6e055bd9a9fa05cf67d9fcaa62f95ea03218
-
SHA512
3cfa262175ad7105be5420643f310f98ad9ab6a7abee5d5cfd82f29f2a0cc56ffb382cca58f1945ecdb1ff613c2f0faa1741b9102b03ce7fffb9b5d7fb018193
-
SSDEEP
6144:NDvyfQWRftYvYbGiz8fo3XpEmg+hSaw7Dh:pvyIWf6Yb9z8g3XG1+hS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-25_1af4c91138eaa6bbd7205ade9e201261_mafia
Files
-
2024-05-25_1af4c91138eaa6bbd7205ade9e201261_mafia.exe windows:5 windows x86 arch:x86
994e1b4e9a67197cb89805e6c25f3c4f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CopyFileA
GetTempFileNameA
GetCurrentProcessId
GetTempPathA
DeleteFileA
FindResourceA
FreeResource
LoadResource
SizeofResource
LockResource
GetVolumeInformationA
MultiByteToWideChar
GetLastError
GetPrivateProfileStringA
GetLocalTime
DeviceIoControl
GetVersionExA
FindFirstFileA
FindNextFileA
TerminateProcess
RemoveDirectoryA
FindClose
CreateFileW
WriteConsoleW
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapSize
GetStringTypeW
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetFilePointer
GetFileType
SetHandleCount
IsProcessorFeaturePresent
CreateProcessA
OpenProcess
WriteFile
CreateFileA
GetACP
WideCharToMultiByte
Sleep
TerminateThread
WaitForSingleObject
CloseHandle
WinExec
CreateToolhelp32Snapshot
GetCurrentDirectoryA
GetModuleHandleA
GetModuleFileNameA
Process32Next
InitializeCriticalSectionAndSpinCount
HeapCreate
IsValidCodePage
GetOEMCP
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
LCMapStringW
RtlUnwind
GetCPInfo
RaiseException
GetStartupInfoW
HeapSetInformation
GetCommandLineA
ExitProcess
GetModuleHandleW
GetProcAddress
GetSystemTimeAsFileTime
HeapReAlloc
HeapAlloc
HeapFree
CreateThread
GetCurrentThreadId
ExitThread
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DecodePointer
EncodePointer
InterlockedExchange
InterlockedDecrement
LoadLibraryW
Process32First
InterlockedIncrement
user32
SetWindowPos
GetDlgItem
ShowWindow
TranslateMessage
BeginPaint
SendMessageA
GetClientRect
IsDlgButtonChecked
SendDlgItemMessageA
PostQuitMessage
CreateDialogParamA
GetMessageA
DestroyWindow
EndPaint
wvsprintfA
wsprintfA
PostMessageA
DispatchMessageA
GetSystemMetrics
CheckRadioButton
MessageBoxA
LoadImageA
GetDlgItemTextA
SetDlgItemTextA
advapi32
RegOpenKeyA
RegCloseKey
RegQueryValueExA
RegDeleteValueA
RegOpenKeyExA
RegDeleteKeyA
shell32
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA
ole32
CoTaskMemFree
CoInitialize
gdiplus
GdipDrawImageI
GdipDisposeImage
GdipCreateFont
GdipCreateFontFamilyFromName
GdipCreateSolidFill
GdipFillRectangleI
GdipDrawLineI
GdipCreatePen1
GdiplusStartup
GdipDeleteFontFamily
GdipDeleteGraphics
GdipDeleteFont
GdipDeletePen
GdipDeleteBrush
GdipCreateFromHDC
GdipCreateBitmapFromHICON
GdipDrawString
wininet
InternetCloseHandle
InternetOpenA
InternetReadFile
InternetOpenUrlA
HttpQueryInfoA
iphlpapi
GetAdaptersInfo
netapi32
Netbios
psapi
GetModuleFileNameExA
EnumProcessModules
EnumProcesses
Sections
.text Size: 174KB - Virtual size: 174KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ