C:\昇泰安\龙宇\工作室\解压源码\便压安装脚本2014\SetupApp\bin\SetupApp.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-15_b7b22e2b5a4f21860930b2cd46b881ea_mafia_magniber.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-15_b7b22e2b5a4f21860930b2cd46b881ea_mafia_magniber.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-06-15_b7b22e2b5a4f21860930b2cd46b881ea_mafia_magniber
-
Size
3.9MB
-
MD5
b7b22e2b5a4f21860930b2cd46b881ea
-
SHA1
c2012c9758109e905606c3e1eeb6a2fa7adada0a
-
SHA256
e689a0a189ee7ebcceec3cf0238660735433d229903450b6a9aa2d84244891f6
-
SHA512
0721a9c895117384c51cf3f7579937f2f8464e3e146aeb0eccdd1c9e17e12d1a91c4c6a2f5bccf9012b65d3a8406a273c3651741166c01116e213a3375ae3f57
-
SSDEEP
98304:9GJwzWWclz19HybXKXHy0nojiu71gM5dkzb3:9GsNcl3ybXpjiu1gMEf3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-15_b7b22e2b5a4f21860930b2cd46b881ea_mafia_magniber
Files
-
2024-06-15_b7b22e2b5a4f21860930b2cd46b881ea_mafia_magniber.exe windows:5 windows x86 arch:x86
c336af2bc0bcbbdd87ab5ab4389baa6c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
WritePrivateProfileStringA
DeviceIoControl
GetVersionExA
GetEnvironmentVariableA
FindFirstFileA
FindNextFileA
DeleteFileA
GetFileAttributesA
GetProcAddress
GetSystemInfo
OutputDebugStringA
WinExec
lstrlenA
DosDateTimeToFileTime
SetFilePointer
SystemTimeToFileTime
SetFileTime
ReadFile
GetFileType
GetCurrentDirectoryW
GetFullPathNameA
GetDriveTypeW
IsDBCSLeadByteEx
GetProcessHeap
GetVolumeInformationA
CreateFileW
WriteConsoleW
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapSize
GetStringTypeW
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetHandleCount
IsValidCodePage
GetOEMCP
LoadLibraryW
InitializeCriticalSectionAndSpinCount
HeapCreate
IsProcessorFeaturePresent
GetLocaleInfoW
CreateMutexA
GetLastError
WriteFile
CreateFileA
GetACP
WideCharToMultiByte
MultiByteToWideChar
GetTempPathA
LockResource
SizeofResource
LoadResource
FreeResource
FindResourceA
Sleep
TerminateThread
CloseHandle
GetModuleHandleA
GetModuleFileNameA
GetLocalTime
GetPrivateProfileStringA
SetFileAttributesA
CreateDirectoryA
TerminateProcess
OpenProcess
GetCurrentProcess
SetEndOfFile
GetModuleFileNameW
GetStdHandle
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsDebuggerPresent
InterlockedIncrement
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringW
RtlUnwind
GetCPInfo
RaiseException
GetStartupInfoW
HeapSetInformation
GetCommandLineA
MoveFileA
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleW
HeapFree
CreateThread
GetCurrentThreadId
ExitThread
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DecodePointer
EncodePointer
InterlockedExchange
InterlockedDecrement
user32
SetWindowPos
GetDlgItem
CreateWindowExA
MessageBoxA
TranslateMessage
SendMessageA
GetClientRect
LoadIconA
SendDlgItemMessageA
PostQuitMessage
ShowWindow
GetMessageA
DestroyWindow
EndPaint
wvsprintfA
PostMessageA
EnableWindow
SetDlgItemTextA
GetDlgItemTextA
DispatchMessageA
GetSystemMetrics
LoadImageA
CreateDialogParamA
IsDlgButtonChecked
BeginPaint
gdi32
CreateFontA
advapi32
OpenProcessToken
OpenSCManagerA
StartServiceA
CreateServiceA
CloseServiceHandle
RegCloseKey
AdjustTokenPrivileges
RegOpenKeyExA
RegCreateKeyExA
LookupPrivilegeValueA
RegQueryValueExA
RegSetValueExA
shell32
Shell_NotifyIconA
ShellExecuteA
SHGetSpecialFolderLocation
SHCreateDirectoryExA
SHBrowseForFolderA
SHGetPathFromIDListA
ole32
CoCreateInstance
CoInitialize
CoTaskMemFree
gdiplus
GdipFillRectangleI
GdipDrawLineI
GdipCreateFromHDC
GdiplusStartup
GdipCreateFontFamilyFromName
GdipDrawString
GdipCreateFont
GdipCreateSolidFill
GdipDeleteFontFamily
GdipDeleteGraphics
GdipDeleteFont
GdipDeletePen
GdipDeleteBrush
GdipCreatePen1
wininet
HttpOpenRequestA
InternetConnectA
InternetCloseHandle
InternetOpenA
InternetReadFile
InternetOpenUrlA
HttpQueryInfoA
HttpSendRequestA
shlwapi
PathCombineA
PathIsDirectoryA
PathIsURLA
UrlGetPartA
PathFileExistsA
PathStripPathA
PathRemoveBackslashA
netapi32
Netbios
sensapi
IsNetworkAlive
psapi
EnumProcesses
EnumProcessModules
GetModuleFileNameExA
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
iphlpapi
GetAdaptersInfo
Sections
.text Size: 260KB - Virtual size: 259KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ