D:\work\stcode\wloader\资源同步助手2.0\XLoader\Release\XLoader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-06_8f714b8f5a195a9aa2382ce7d7ff9183_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-06_8f714b8f5a195a9aa2382ce7d7ff9183_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-06_8f714b8f5a195a9aa2382ce7d7ff9183_mafia
-
Size
1.1MB
-
MD5
8f714b8f5a195a9aa2382ce7d7ff9183
-
SHA1
a90b05368ab5170cb8eb56192f68991d1edef595
-
SHA256
71a3c0c615f2f4846004d06c31636f6e08258f3b499ae9735c426851225c72f1
-
SHA512
2ae7ef898b9f45bdef2d81df7a31601d73e55ae8212468889728cc024a06608abf566cc66a3797d14c8485183f3ecf73ce0cecf6a8ec0d5a6e68f54989864a83
-
SSDEEP
24576:YcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbA:Y5QZuTtS0rQMYOQ+q8CE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-06_8f714b8f5a195a9aa2382ce7d7ff9183_mafia
Files
-
2024-06-06_8f714b8f5a195a9aa2382ce7d7ff9183_mafia.exe windows:5 windows x86 arch:x86
fe8cd0edefdc88a5f20fe38f2239521b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CreateDirectoryA
GetFileAttributesA
DeleteFileA
LockResource
LoadResource
SizeofResource
FindResourceW
VirtualQuery
Process32NextW
lstrcmpiW
Process32FirstW
CreateToolhelp32Snapshot
FileTimeToSystemTime
FileTimeToLocalFileTime
GetProcessTimes
OpenProcess
InitializeCriticalSection
DeleteCriticalSection
Sleep
EnterCriticalSection
LeaveCriticalSection
CreateThread
GetComputerNameA
GlobalFree
GlobalAlloc
GetNativeSystemInfo
GetProcAddress
GetModuleHandleW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
CreateProcessW
TerminateProcess
GetTickCount
WriteFile
DeleteFileW
GetLogicalDriveStringsA
SetFilePointer
CreateFileW
GetLastError
ReadFile
GetLocalTime
CreateMutexA
LoadLibraryW
GetTempPathW
GetTempPathA
GetCurrentProcess
CloseHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW
GetProcessHeap
SetStdHandle
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
FlushFileBuffers
GetConsoleMode
GetConsoleCP
InterlockedDecrement
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
SetEndOfFile
OutputDebugStringA
TlsSetValue
TlsGetValue
TlsAlloc
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
HeapFree
HeapAlloc
RtlUnwind
RaiseException
EncodePointer
DecodePointer
HeapReAlloc
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
IsProcessorFeaturePresent
HeapCreate
ExitProcess
GetStdHandle
GetModuleFileNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
user32
LoadStringA
advapi32
RegQueryValueExA
LookupPrivilegeValueW
CreateProcessAsUserW
AdjustTokenPrivileges
RegCloseKey
RegOpenKeyExA
RegEnumKeyExA
OpenProcessToken
shell32
SHGetSpecialFolderPathA
SHGetFolderPathA
ShellExecuteA
shlwapi
PathRemoveFileSpecA
PathFileExistsA
winhttp
WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpConnect
WinHttpSetTimeouts
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpOpen
rpcrt4
UuidCreateSequential
iphlpapi
GetAdaptersInfo
SendARP
ws2_32
inet_ntoa
gethostbyname
WSAStartup
inet_addr
WSACleanup
Exports
Exports
GetModuleHandle64
GetProcAddress64
GetThreadContext64
ReadProcessMemory64
SetLastErrorFromX64Call
SetThreadContext64
VirtualAllocEx64
VirtualFreeEx64
VirtualProtectEx64
VirtualQueryEx64
WriteProcessMemory64
X64Call
_cJSON_AddArrayToObject@8
_cJSON_AddBoolToObject@12
_cJSON_AddFalseToObject@8
_cJSON_AddItemReferenceToArray@8
_cJSON_AddItemReferenceToObject@12
_cJSON_AddItemToArray@8
_cJSON_AddItemToObject@12
_cJSON_AddItemToObjectCS@12
_cJSON_AddNullToObject@8
_cJSON_AddNumberToObject@16
_cJSON_AddObjectToObject@8
_cJSON_AddRawToObject@12
_cJSON_AddStringToObject@12
_cJSON_AddTrueToObject@8
_cJSON_Compare@12
_cJSON_CreateArray@0
_cJSON_CreateArrayReference@4
_cJSON_CreateBool@4
_cJSON_CreateDoubleArray@8
_cJSON_CreateFalse@0
_cJSON_CreateFloatArray@8
_cJSON_CreateIntArray@8
_cJSON_CreateNull@0
_cJSON_CreateNumber@8
_cJSON_CreateObject@0
_cJSON_CreateObjectReference@4
_cJSON_CreateRaw@4
_cJSON_CreateString@4
_cJSON_CreateStringArray@8
_cJSON_CreateStringReference@4
_cJSON_CreateTrue@0
_cJSON_Delete@4
_cJSON_DeleteItemFromArray@8
_cJSON_DeleteItemFromObject@8
_cJSON_DeleteItemFromObjectCaseSensitive@8
_cJSON_DetachItemFromArray@8
_cJSON_DetachItemFromObject@8
_cJSON_DetachItemFromObjectCaseSensitive@8
_cJSON_DetachItemViaPointer@8
_cJSON_Duplicate@8
_cJSON_GetArrayItem@8
_cJSON_GetArraySize@4
_cJSON_GetErrorPtr@0
_cJSON_GetObjectItem@8
_cJSON_GetObjectItemCaseSensitive@8
_cJSON_GetStringValue@4
_cJSON_HasObjectItem@8
_cJSON_InitHooks@4
_cJSON_InsertItemInArray@12
_cJSON_IsArray@4
_cJSON_IsBool@4
_cJSON_IsFalse@4
_cJSON_IsInvalid@4
_cJSON_IsNull@4
_cJSON_IsNumber@4
_cJSON_IsObject@4
_cJSON_IsRaw@4
_cJSON_IsString@4
_cJSON_IsTrue@4
_cJSON_Minify@4
_cJSON_Parse@4
_cJSON_ParseWithOpts@12
_cJSON_Print@4
_cJSON_PrintBuffered@12
_cJSON_PrintPreallocated@16
_cJSON_PrintUnformatted@4
_cJSON_ReplaceItemInArray@12
_cJSON_ReplaceItemInObject@12
_cJSON_ReplaceItemInObjectCaseSensitive@12
_cJSON_ReplaceItemViaPointer@12
_cJSON_SetNumberHelper@12
_cJSON_Version@0
_cJSON_free@4
_cJSON_malloc@4
Sections
.text Size: 267KB - Virtual size: 266KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 739KB - Virtual size: 739KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ