2024-05-25_1af4c91138eaa6bbd7205ade9e201261_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-25_1af4c91138eaa6bbd7205ade9e201261_mafia
Size

260KB
MD5

1af4c91138eaa6bbd7205ade9e201261
SHA1

c46458f50cc9030d05f27b0d2ab2742f3dae3251
SHA256

749dd9bd73a12fe5e3aa15ca9d5a6e055bd9a9fa05cf67d9fcaa62f95ea03218
SHA512

3cfa262175ad7105be5420643f310f98ad9ab6a7abee5d5cfd82f29f2a0cc56ffb382cca58f1945ecdb1ff613c2f0faa1741b9102b03ce7fffb9b5d7fb018193
SSDEEP

6144:NDvyfQWRftYvYbGiz8fo3XpEmg+hSaw7Dh:pvyIWf6Yb9z8g3XG1+hS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-25_1af4c91138eaa6bbd7205ade9e201261_mafia

Files

2024-05-25_1af4c91138eaa6bbd7205ade9e201261_mafia
.exe windows:5 windows x86 arch:x86

994e1b4e9a67197cb89805e6c25f3c4f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\昇泰安\龙宇\工作室\yinyue.fm\封装文件\静默安装包\正常包\Release\Unins.pdb

Imports

kernel32

CopyFileA
GetTempFileNameA
GetCurrentProcessId
GetTempPathA
DeleteFileA
FindResourceA
FreeResource
LoadResource
SizeofResource
LockResource
GetVolumeInformationA
MultiByteToWideChar
GetLastError
GetPrivateProfileStringA
GetLocalTime
DeviceIoControl
GetVersionExA
FindFirstFileA
FindNextFileA
TerminateProcess
RemoveDirectoryA
FindClose
CreateFileW
WriteConsoleW
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapSize
GetStringTypeW
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetFilePointer
GetFileType
SetHandleCount
IsProcessorFeaturePresent
CreateProcessA
OpenProcess
WriteFile
CreateFileA
GetACP
WideCharToMultiByte
Sleep
TerminateThread
WaitForSingleObject
CloseHandle
WinExec
CreateToolhelp32Snapshot
GetCurrentDirectoryA
GetModuleHandleA
GetModuleFileNameA
Process32Next
InitializeCriticalSectionAndSpinCount
HeapCreate
IsValidCodePage
GetOEMCP
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
LCMapStringW
RtlUnwind
GetCPInfo
RaiseException
GetStartupInfoW
HeapSetInformation
GetCommandLineA
ExitProcess
GetModuleHandleW
GetProcAddress
GetSystemTimeAsFileTime
HeapReAlloc
HeapAlloc
HeapFree
CreateThread
GetCurrentThreadId
ExitThread
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DecodePointer
EncodePointer
InterlockedExchange
InterlockedDecrement
LoadLibraryW
Process32First
InterlockedIncrement

user32

SetWindowPos
GetDlgItem
ShowWindow
TranslateMessage
BeginPaint
SendMessageA
GetClientRect
IsDlgButtonChecked
SendDlgItemMessageA
PostQuitMessage
CreateDialogParamA
GetMessageA
DestroyWindow
EndPaint
wvsprintfA
wsprintfA
PostMessageA
DispatchMessageA
GetSystemMetrics
CheckRadioButton
MessageBoxA
LoadImageA
GetDlgItemTextA
SetDlgItemTextA

advapi32

RegOpenKeyA
RegCloseKey
RegQueryValueExA
RegDeleteValueA
RegOpenKeyExA
RegDeleteKeyA

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA

ole32

CoTaskMemFree
CoInitialize

gdiplus

GdipDrawImageI
GdipDisposeImage
GdipCreateFont
GdipCreateFontFamilyFromName
GdipCreateSolidFill
GdipFillRectangleI
GdipDrawLineI
GdipCreatePen1
GdiplusStartup
GdipDeleteFontFamily
GdipDeleteGraphics
GdipDeleteFont
GdipDeletePen
GdipDeleteBrush
GdipCreateFromHDC
GdipCreateBitmapFromHICON
GdipDrawString

wininet

InternetCloseHandle
InternetOpenA
InternetReadFile
InternetOpenUrlA
HttpQueryInfoA

iphlpapi

GetAdaptersInfo

netapi32

Netbios

psapi

GetModuleFileNameExA
EnumProcessModules
EnumProcesses

Sections

.text
Size: 174KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

994e1b4e9a67197cb89805e6c25f3c4f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

gdiplus

wininet

iphlpapi

netapi32

psapi

Sections

.text Size: 174KB - Virtual size: 174KB

.rdata Size: 37KB - Virtual size: 36KB

.data Size: 8KB - Virtual size: 16KB

.rsrc Size: 21KB - Virtual size: 21KB

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 174KB - Virtual size: 174KB

.rdata
Size: 37KB - Virtual size: 36KB

.data
Size: 8KB - Virtual size: 16KB

.rsrc
Size: 21KB - Virtual size: 21KB

.reloc
Size: 13KB - Virtual size: 12KB