2024-06-27_10176ee39815ba9c2619cf1653154f8d_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-06-27_10176ee39815ba9c2619cf1653154f8d_mafia
Size

2.5MB
MD5

10176ee39815ba9c2619cf1653154f8d
SHA1

f20b62cc0f34b4c380b946ac15445188703641b3
SHA256

9d31a125db0367add208dda3db47017c67bfae4b33e15c13906ae9a9607fa51d
SHA512

e404f86bc08346f235b109c9f6b5d5e074bea507baaa182dd9fd180042009f7b90f54f884fa2878a61535405ef09bc3909bb5172844f22c1139be6434308f520
SSDEEP

49152:2MKVwP7iLJNmgpLQPlAgV32b5V4UwdfxkMMxpU6guUFAi5p917iIdvVqSnMM+Wj:2MvP7MNmgOPbV32b5V4UwdfQxpUgUFAG

Score

1^/10

Malware Config

Signatures

Files

2024-06-27_10176ee39815ba9c2619cf1653154f8d_mafia
.exe windows:5 windows x86 arch:x86

492f1b29ed081afa37e04bfcb8cb993a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17-11-2006 00:00

Not After

30-12-2020 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:98:bc:fd:fe:a4:cb:65:92:e1:af:8b:2d:aa:fc:be
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

23-03-2015 00:00

Not After

22-03-2017 23:59

Subject

CN=丛云（北京）科技有限公司,OU=IT,O=丛云（北京）科技有限公司,L=北京,ST=北京,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9e:03:ff:5e:72:52:a7:ea:5b:2d:0a:73:5f:5c:55:34:57:0f:fb:43
Signer

Actual PE Digest

9e:03:ff:5e:72:52:a7:ea:5b:2d:0a:73:5f:5c:55:34:57:0f:fb:43

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Launcher\La123456外网版New\release\LeagueOfElites\LeagueOfElites.pdb

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

HttpSendRequestW
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetGetLastResponseInfoW
HttpQueryInfoW
InternetQueryDataAvailable
InternetSetOptionExW
InternetQueryOptionW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetOpenW
InternetOpenUrlW
InternetCloseHandle
InternetReadFile

winmm

timeGetTime
PlaySoundW

kernel32

RtlUnwind
WriteConsoleW
GetFileType
GetStdHandle
ExitThread
RaiseException
HeapReAlloc
VirtualQuery
ExitProcess
HeapQueryInformation
HeapSize
SetStdHandle
GetSystemTimeAsFileTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapCreate
QueryPerformanceCounter
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
IsProcessorFeaturePresent
GetConsoleCP
GetConsoleMode
LCMapStringW
GetStringTypeW
GetTimeZoneInformation
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetEnvironmentVariableA
GetProcessHeap
GetDriveTypeW
HeapAlloc
HeapFree
DecodePointer
EncodePointer
GetProcAddress
LoadLibraryW
FreeLibrary
SizeofResource
LockResource
LoadResource
FindResourceW
UnmapViewOfFile
GetStartupInfoW
OpenFileMappingW
GetLastError
MapViewOfFile
SetLastError
OpenMutexW
WaitForSingleObject
ReleaseMutex
GetModuleHandleW
GetSystemInfo
GetVersionExW
CompareStringW
MultiByteToWideChar
SetUnhandledExceptionFilter
InitializeCriticalSection
DeleteCriticalSection
GetLocalTime
GetCurrentThread
GetCurrentProcess
CreateFileW
GetCurrentThreadId
EnterCriticalSection
GetCurrentProcessId
LeaveCriticalSection
TerminateProcess
InterlockedDecrement
FindResourceExW
GetUserDefaultLCID
VirtualProtect
SearchPathW
GetProfileIntW
GetTempPathW
GetTempFileNameW
GetNumberFormatW
GetWindowsDirectoryW
lstrcpyW
GetCurrentDirectoryW
SetErrorMode
GetFileTime
GetFileSizeEx
GetFileAttributesW
GlobalGetAtomNameW
GlobalFlags
FindNextFileW
SuspendThread
ResumeThread
SetThreadPriority
GetPrivateProfileIntW
GetTickCount
FreeResource
GlobalUnlock
GlobalLock
CloseHandle
HeapSetInformation
lstrcmpA
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GlobalAlloc
WideCharToMultiByte
GetCommandLineW
GetLocaleInfoW
InterlockedExchange
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GetFullPathNameW
GetVolumeInformationW
FindFirstFileW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
lstrcmpiW
LocalAlloc
lstrlenA
CopyFileW
GlobalSize
FormatMessageW
LocalFree
MulDiv
lstrlenW
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
lstrcmpW
GetThreadLocale
ActivateActCtx
ReleaseActCtx
CreateActCtxW
DeactivateActCtx
CreateDirectoryW
AreFileApisANSI
SetFileAttributesW
ReleaseSemaphore
CreateSemaphoreA
SetEvent
CreateEventA
GetFileSize
SetFilePointer
WriteFile
ReadFile
CreateFileA
VirtualAlloc
CreateThread
GetModuleFileNameW
DeleteFileA
FileTimeToLocalFileTime
GetDiskFreeSpaceExA
GetModuleHandleA
FindNextFileA
GetModuleFileNameA
FindClose
SetFileAttributesA
FindFirstFileA
CreateDirectoryA
FileTimeToSystemTime
GetFileAttributesA
RemoveDirectoryW
InterlockedIncrement
WritePrivateProfileStringW
GetLogicalDriveStringsW
GlobalFree
CreateEventW
GetPrivateProfileStringW
GetFileAttributesExW
MoveFileW
DeleteFileW
InitializeCriticalSectionAndSpinCount
ResetEvent
Sleep

user32

MonitorFromPoint
UnionRect
MapVirtualKeyExW
IsCharLowerW
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
GetKeyNameTextW
LockWindowUpdate
SetCursorPos
CreateAcceleratorTableW
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
DrawFrameControl
DrawEdge
DrawStateW
GetSystemMenu
SetClassLongW
DestroyAcceleratorTable
SetWindowRgn
UnpackDDElParam
ReuseDDElParam
LoadMenuW
LoadAcceleratorsW
InsertMenuItemW
TranslateAcceleratorW
DrawIconEx
LoadImageW
CopyImage
GetIconInfo
NotifyWinEvent
EnableScrollBar
HideCaret
DrawFocusRect
InvertRect
MapVirtualKeyW
CreatePopupMenu
GetMenuDefaultItem
RedrawWindow
DestroyIcon
PostThreadMessageW
SetLayeredWindowAttributes
EnumDisplayMonitors
SetRectEmpty
DeleteMenu
WindowFromPoint
LoadCursorW
GetSysColorBrush
RealChildWindowFromPoint
DestroyMenu
GetMenuItemInfoW
UnregisterClassW
InflateRect
ShowOwnedPopups
SetCursor
GetMessageW
GetCursorPos
ValidateRect
MessageBeep
GetNextDlgGroupItem
SetWindowContextHelpId
MapDialogRect
RegisterClipboardFormatW
PostQuitMessage
WaitMessage
CharUpperW
EndPaint
BeginPaint
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
FillRect
GetActiveWindow
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
GetMenuStringW
AppendMenuW
InsertMenuW
RemoveMenu
SetWindowTextW
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
ScreenToClient
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
DefWindowProcW
CallWindowProcW
GetMenu
GetDlgItem
GetParent
GetDlgCtrlID
GetWindow
CharNextW
UnhookWindowsHookEx
ReleaseCapture
SetFocus
GetDesktopWindow
GetFocus
SetCapture
InvalidateRgn
EqualRect
IntersectRect
OffsetRect
GetWindowRgn
DestroyCursor
SubtractRect
GetDoubleClickTime
CharUpperBuffW
CopyIcon
GetUpdateRect
FrameRect
IsClipboardFormatAvailable
SetRect
IsRectEmpty
CopyRect
IsWindowEnabled
IsWindowVisible
IsWindow
CopyAcceleratorTableW
SetMenuDefaultItem
CreateMenu
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
IsMenu
wsprintfW
PostMessageW
GetWindowDC
PtInRect
IsZoomed
BringWindowToTop
ShowWindow
DispatchMessageW
TranslateMessage
PeekMessageW
MoveWindow
SetParent
KillTimer
DrawIcon
GetSystemMetrics
SendMessageW
IsIconic
SystemParametersInfoW
UpdateWindow
LoadIconW
GetWindowThreadProcessId
GetAsyncKeyState
ReleaseDC
UpdateLayeredWindow
GetDC
SetTimer
GetWindowRect
GetClientRect
SetWindowPos
SetForegroundWindow
MessageBoxW
SetWindowLongW
GetWindowLongW
EnableWindow
InvalidateRect
IsDialogMessageW

gdi32

MoveToEx
SetTextAlign
GetLayout
SetLayout
SelectClipRgn
CreateRectRgn
GetViewportExtEx
GetWindowExtEx
GetPixel
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
CreatePatternBrush
SelectPalette
GetObjectType
CreatePen
CreateHatchBrush
CreateFontIndirectW
SetRectRgn
CombineRgn
GetMapMode
PatBlt
DPtoLP
LineTo
GetTextMetricsW
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
CreateRoundRectRgn
CreatePolygonRgn
CreateEllipticRgn
Polyline
Ellipse
Polygon
SetDIBColorTable
StretchBlt
SetPixel
Rectangle
OffsetRgn
EnumFontFamiliesExW
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
SetPixelV
GetTextFaceW
IntersectClipRect
GetClipBox
ExcludeClipRect
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CreateDCW
CopyMetaFileW
CreateBitmap
SetBkColor
SetTextColor
GetTextColor
GetBkColor
GetDeviceCaps
GetObjectW
GetStockObject
GetRgnBox
CreateRectRgnIndirect
BitBlt
DeleteObject
DeleteDC
SelectObject
CreateCompatibleBitmap
CreateDIBSection
GetTextExtentPoint32W
CreateSolidBrush
CreateCompatibleDC

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegEnumValueW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegDeleteValueW

shell32

DragQueryFileW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHAppBarMessage
SHGetFileInfoW
SHBrowseForFolderW
ShellExecuteW
DragFinish
SHGetDesktopFolder

comctl32

InitCommonControlsEx
ImageList_GetIconSize

shlwapi

UrlUnescapeW
PathStripToRootW
PathIsUNCW
PathFindExtensionW
PathFindFileNameW
PathIsDirectoryEmptyW
PathRemoveFileSpecW

ole32

CLSIDFromString
CLSIDFromProgID
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CoCreateGuid
OleDuplicateData
ReleaseStgMedium
CreateStreamOnHGlobal
CoDisconnectObject
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoTaskMemFree
CoTaskMemAlloc
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoCreateInstance
CoUninitialize
CoInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoInitializeEx
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
DoDragDrop
OleLockRunning
IsAccelerator
OleTranslateAccelerator

oleaut32

VarBstrFromDate
VariantCopy
VariantChangeType
OleCreateFontIndirect
SysAllocStringLen
SafeArrayDestroy
SystemTimeToVariantTime
VariantTimeToSystemTime
SysStringLen
VariantClear
LoadTypeLi
SysAllocStringByteLen
SysStringByteLen
SysFreeString
VariantInit
SysAllocString

oledlg

OleUIBusyW

ws2_32

WSAStartup
WSACleanup
closesocket
htonl
htons
inet_addr
accept
select
bind
WSAGetLastError
WSASetLastError
connect
sendto
recvfrom
WSAAsyncSelect
recv
send
listen
socket

gdiplus

GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipSetInterpolationMode
GdiplusShutdown
GdiplusStartup
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipGetImageWidth
GdipGetImageHeight
GdipLoadImageFromStream
GdipFree
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageRect
GdipDrawImageRectI

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

imm32

ImmGetContext
ImmReleaseContext
ImmGetOpenStatus

Exports

Exports

LzmaCompress
LzmaUncompress
SevenZipExecute
SevenZipUncompressEx

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 317KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 177KB - Virtual size: 4.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 384KB - Virtual size: 384KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 190KB - Virtual size: 189KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

492f1b29ed081afa37e04bfcb8cb993a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91Certificate

Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

6c:98:bc:fd:fe:a4:cb:65:92:e1:af:8b:2d:aa:fc:beCertificate

Extended Key Usages

Key Usages

9e:03:ff:5e:72:52:a7:ea:5b:2d:0a:73:5f:5c:55:34:57:0f:fb:43Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

wininet

winmm

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

ws2_32

gdiplus

oleacc

imm32

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 317KB - Virtual size: 316KB

.data Size: 177KB - Virtual size: 4.2MB

.rsrc Size: 384KB - Virtual size: 384KB

.reloc Size: 190KB - Virtual size: 189KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

6c:98:bc:fd:fe:a4:cb:65:92:e1:af:8b:2d:aa:fc:be
Certificate

9e:03:ff:5e:72:52:a7:ea:5b:2d:0a:73:5f:5c:55:34:57:0f:fb:43
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 317KB - Virtual size: 316KB

.data
Size: 177KB - Virtual size: 4.2MB

.rsrc
Size: 384KB - Virtual size: 384KB

.reloc
Size: 190KB - Virtual size: 189KB