2024-06-11_59787e2a849930510e8a3e7f6cdfba39_mafia_magniber

Sharing

Copy URL

Twitter E-mail

General

Target

2024-06-11_59787e2a849930510e8a3e7f6cdfba39_mafia_magniber
Size

3.8MB
MD5

59787e2a849930510e8a3e7f6cdfba39
SHA1

383e535019de423fde9cfabc1341d1e60363146a
SHA256

b840f7a4cd5a9388318975ac51c6412af7faa3444d27a1863cf852170ea01594
SHA512

4d6a7bfb7ff059a0180e394645c51ff014738bb4c1938c9b695e1409b4e8b29d2e74e0fbe00907c9f3712d10aebc6fe8fedf10400faae48c25300c7cc178704a
SSDEEP

98304:kFFLB2M9eUIUvGGE6uYTnctxl6LY4tWuuigFby:OLIM91IUuGE6uYzc9X4iiqby

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-11_59787e2a849930510e8a3e7f6cdfba39_mafia_magniber

Files

2024-06-11_59787e2a849930510e8a3e7f6cdfba39_mafia_magniber
.exe windows:5 windows x86 arch:x86

84f33de98d6a9957451dd55e8a179084

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\昇泰安\龙宇\工作室\解压源码\便压安装脚本2014\SetupApp\bin\SetupApp.pdb

Imports

kernel32

WriteFile
lstrcmpA
Process32First
Process32Next
CreateMutexA
CreateToolhelp32Snapshot
GetVolumeInformationA
WritePrivateProfileStringA
GetVersionExA
lstrlenA
GetEnvironmentVariableA
FindFirstFileA
FindNextFileA
lstrcpyA
GetFileAttributesA
GetSystemInfo
OutputDebugStringA
WinExec
DosDateTimeToFileTime
SetFilePointer
SystemTimeToFileTime
SetFileTime
ReadFile
GetFileType
GetCurrentDirectoryW
GetFullPathNameA
GetACP
FormatMessageA
LocalFree
IsDBCSLeadByteEx
GetProcessHeap
SetEndOfFile
CreateFileW
WriteConsoleW
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
HeapSize
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetHandleCount
IsValidCodePage
GetOEMCP
LoadLibraryW
InitializeCriticalSectionAndSpinCount
HeapCreate
WideCharToMultiByte
DeviceIoControl
GetLastError
CreateFileA
MultiByteToWideChar
GetTempPathA
LockResource
SizeofResource
LoadResource
FreeResource
FindResourceA
TerminateThread
DeleteFileA
CloseHandle
GetModuleHandleA
GetModuleFileNameA
LoadLibraryA
GetLocalTime
GetPrivateProfileStringA
SetFileAttributesA
GetProcAddress
CreateDirectoryA
TerminateProcess
Sleep
OpenProcess
GetCurrentProcess
GetDriveTypeW
IsProcessorFeaturePresent
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
SetLastError
TlsFree
InterlockedIncrement
TlsSetValue
TlsGetValue
TlsAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringW
RtlUnwind
GetCPInfo
RaiseException
GetStartupInfoW
HeapSetInformation
GetCommandLineA
MoveFileA
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleW
HeapFree
CreateThread
GetCurrentThreadId
ExitThread
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DecodePointer
EncodePointer
InterlockedExchange
InterlockedDecrement

user32

SendDlgItemMessageA
PostQuitMessage
CreateDialogParamA
GetMessageA
SetDlgItemTextA
GetDlgItemTextA
EnableWindow
LoadImageA
GetSystemMetrics
DispatchMessageA
IsDlgButtonChecked
ShowWindow
GetDlgItem
CreateWindowExA
MessageBoxA
TranslateMessage
BeginPaint
SendMessageA
GetClientRect
LoadIconA
DestroyWindow
EndPaint
wvsprintfA
PostMessageA
SetWindowPos

gdi32

CreateFontA

advapi32

OpenProcessToken
OpenSCManagerA
StartServiceA
CreateServiceA
CloseServiceHandle
RegCloseKey
AdjustTokenPrivileges
RegOpenKeyExA
RegCreateKeyExA
LookupPrivilegeValueA
RegQueryValueExA
RegSetValueExA

shell32

SHBrowseForFolderA
ShellExecuteA
Shell_NotifyIconA
SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHCreateDirectoryExA

ole32

CoInitialize
CoCreateInstance
CoTaskMemFree

gdiplus

GdipCreateSolidFill
GdiplusStartup
GdipCreatePen1
GdipDeleteBrush
GdipDeletePen
GdipDeleteFont
GdipDeleteGraphics
GdipDeleteFontFamily
GdipCreateFont
GdipDrawString
GdipCreateFontFamilyFromName
GdipCreateFromHDC
GdipFillRectangleI
GdipDrawLineI

wininet

HttpOpenRequestA
HttpQueryInfoA
InternetOpenUrlA
InternetReadFile
InternetOpenA
InternetCloseHandle
InternetConnectA
HttpSendRequestA

shlwapi

PathCombineA
PathIsDirectoryA
PathRemoveBackslashA
PathFileExistsA
PathStripPathA
UrlGetPartA
PathIsURLA

netapi32

Netbios

sensapi

IsNetworkAlive

psapi

EnumProcessModules
EnumProcesses
GetModuleFileNameExA

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 319KB - Virtual size: 318KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

84f33de98d6a9957451dd55e8a179084

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

gdiplus

wininet

shlwapi

netapi32

sensapi

psapi

version

iphlpapi

Sections

.text Size: 319KB - Virtual size: 318KB

.rdata Size: 62KB - Virtual size: 61KB

.data Size: 9KB - Virtual size: 18KB

.rsrc Size: 4.8MB - Virtual size: 4.8MB

.reloc Size: 31KB - Virtual size: 31KB

.text
Size: 319KB - Virtual size: 318KB

.rdata
Size: 62KB - Virtual size: 61KB

.data
Size: 9KB - Virtual size: 18KB

.rsrc
Size: 4.8MB - Virtual size: 4.8MB

.reloc
Size: 31KB - Virtual size: 31KB