2024-07-11_0ca1ea59b7829eba1991729e5159b090_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-07-11_0ca1ea59b7829eba1991729e5159b090_mafia
Size

1.9MB
MD5

0ca1ea59b7829eba1991729e5159b090
SHA1

a9f1c5f04ea8e661a90fad736c89117020d9cb8e
SHA256

56ff4b50284dce0141014ba208bd7062e438c832ba5c14d7841320355344cd34
SHA512

287f6036fbed290fdf73a8d83512c1f8b719f617b040ae8e1e269f4274a8bb3d4330c1dda1052e220dd93fe8cbceb48f55f682042993395c8f37b8b9aa8939af
SSDEEP

49152:4Etb6QYlHTVemK11MzO6pJ1uVr7tje4W7Hf:4Et+QYlRemy2O6pJotja

Score

1^/10

Malware Config

Signatures

Files

2024-07-11_0ca1ea59b7829eba1991729e5159b090_mafia
.exe windows:5 windows x86 arch:x86

32dcf78386b87e9d8978bb21ad43d32e

Code Sign

32:5a:37:37:b8:92:6a:78:35:f0:23:96:3d:83:8f:cc
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

10/04/2014, 00:00

Not After

08/06/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=移动云,O=Baidu Online Network Technology (Beijing) Co.\,Ltd,L=北京,ST=北京,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

22:80:0a:2b:4f:4b:11:30:18:ee:0a:7d:e3:be:19:00:c9:73:6a:31
Signer

Actual PE Digest

22:80:0a:2b:4f:4b:11:30:18:ee:0a:7d:e3:be:19:00:c9:73:6a:31

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

R:\app\gensoft\pcsuite\native\app\mini\project\Release\MiniDownloader.pdb

Imports

gdiplus

GdipCloneBrush
GdipDisposeImage
GdipAlloc
GdipCloneImage
GdipImageSelectActiveFrame
GdipDrawImageRectRectI
GdipGetImageHeight
GdipGetImageWidth
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipLoadImageFromStream
GdiplusShutdown
GdiplusStartup
GdipDrawImageRect
GdipDrawImageRectI
GdipSetSmoothingMode
GdipSetImageAttributesWrapMode
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipDeleteGraphics
GdipCreateFromHDC
GdipLoadImageFromFile
GdipFree
GdipDeleteBrush
GdipCreateSolidFill
GdipDrawString
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeleteFont
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipDrawImageRectRect

ws2_32

WSACleanup
WSAStartup
closesocket
WSAGetLastError
WSASetLastError
ioctlsocket
setsockopt
WSASend
WSASocketW
getaddrinfo
freeaddrinfo
connect
__WSAFDIsSet
WSARecv
select
recvfrom
sendto
socket
getpeername
htons
ntohs
WSAIoctl
send
recv
getsockopt
bind
getsockname
inet_addr
listen
accept

kernel32

GetFileInformationByHandle
GetFullPathNameA
FlushFileBuffers
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetOEMCP
GetACP
GetConsoleMode
GetConsoleCP
GetLocaleInfoW
HeapCreate
GetStdHandle
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FindResourceW
LoadResource
FreeResource
SizeofResource
LockResource
GlobalAlloc
GlobalLock
GetSystemTimeAsFileTime
CreateEventA
HeapAlloc
GetProcessHeap
HeapFree
SetEvent
GetLastError
GetProcAddress
LoadLibraryW
FreeLibrary
GetTempPathW
CloseHandle
SetLastError
CreateMutexW
GetTickCount
ExpandEnvironmentStringsW
TerminateProcess
GetCurrentProcess
OpenMutexW
GlobalUnlock
CreateProcessW
WaitForSingleObject
lstrcpynW
lstrlenW
lstrcpynA
lstrlenA
GetVersionExW
MultiByteToWideChar
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
FindResourceExW
DeleteCriticalSection
InitializeCriticalSection
GetModuleHandleW
lstrcmpiW
RaiseException
LoadLibraryExW
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
CreateMutexA
FlushInstructionCache
MulDiv
lstrcmpW
CreateThread
CreateFileW
GetFileSize
SetFilePointer
WriteFile
Sleep
CreateIoCompletionPort
QueueUserAPC
TerminateThread
InterlockedExchangeAdd
WaitForMultipleObjects
GetQueuedCompletionStatus
SetWaitableTimer
InterlockedExchange
PostQueuedCompletionStatus
InterlockedCompareExchange
TlsFree
TlsAlloc
TlsSetValue
TlsGetValue
SleepEx
CreateEventW
CreateWaitableTimerW
PeekNamedPipe
FindFirstFileW
CreateDirectoryW
ReleaseSemaphore
CreateSemaphoreA
ReadFile
MoveFileW
FindClose
FindNextFileW
DeleteFileW
GetCurrentProcessId
DuplicateHandle
GetFileAttributesW
SetEndOfFile
WideCharToMultiByte
VerifyVersionInfoA
VerSetConditionMask
FormatMessageA
ExpandEnvironmentStringsA
MapViewOfFile
UnmapViewOfFile
ResumeThread
CreateFileMappingW
GetTempPathA
GetEnvironmentVariableA
GetModuleFileNameA
GetSystemDirectoryW
GetLogicalDriveStringsW
GetDriveTypeW
GetDiskFreeSpaceExW
GetVolumeInformationW
GetModuleHandleA
CreateFileA
QueryPerformanceCounter
QueryPerformanceFrequency
DeleteFileA
HeapDestroy
HeapReAlloc
HeapSize
GetStringTypeW
EncodePointer
DecodePointer
GetTimeZoneInformation
GetUserDefaultLCID
GetLocaleInfoA
GetCommandLineW
HeapSetInformation
GetStartupInfoW
ExitThread
SetConsoleCtrlHandler
RtlUnwind
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
GetTimeFormatA
GetDateFormatA
LCMapStringW
GetCPInfo
CompareStringW
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
OpenEventA
ResetEvent
SystemTimeToFileTime
CreateWaitableTimerA
LocalFree
DeviceIoControl
AreFileApisANSI
GetVersion
GlobalMemoryStatus
LoadLibraryA
GetVersionExA
FlushConsoleInputBuffer
GetVolumeInformationA
GlobalFree
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
InterlockedPushEntrySList
GetEnvironmentVariableW
GetCurrentDirectoryW
ReadConsoleInputA
SetConsoleMode
IsProcessorFeaturePresent

user32

TranslateMessage
DispatchMessageW
GetWindow
MonitorFromWindow
CharNextW
GetParent
CallWindowProcW
GetDlgItem
GetMonitorInfoW
MonitorFromPoint
GetMenuItemInfoW
RemoveMenu
GetMenuItemCount
AppendMenuW
TrackPopupMenuEx
DestroyMenu
CreatePopupMenu
PeekMessageW
MapWindowPoints
MessageBeep
DefWindowProcW
SetFocus
LoadStringA
CreateWindowExW
DestroyWindow
GetMessageW
GetWindowTextLengthW
GetWindowTextW
PostMessageW
PtInRect
ScreenToClient
GetWindowRect
IsIconic
FillRect
RegisterClassExW
UnregisterDeviceNotification
WaitForInputIdle
wvsprintfW
SetTimer
DrawTextW
EndPaint
BeginPaint
PostQuitMessage
SetWindowPos
SetWindowLongW
GetWindowLongW
ShowWindow
SendMessageW
SetRect
GetClientRect
SetWindowTextW
ClientToScreen
IsWindowVisible
LoadImageW
LoadAcceleratorsW
LoadMenuW
RegisterWindowMessageW
IsChild
GetFocus
GetClassNameW
GetSysColor
RedrawWindow
GetClassInfoExW
CreateAcceleratorTableW
MoveWindow
SetCapture
ReleaseCapture
InvalidateRgn
DestroyAcceleratorTable
TranslateAcceleratorW
GetCursorPos
KillTimer
LoadStringW
ReleaseDC
GetDC
GetDesktopWindow
InvalidateRect
IsWindow
IsRectEmpty
UnregisterClassA
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA
LoadCursorW

gdi32

GetObjectW
CreateCompatibleBitmap
BitBlt
Rectangle
GetStockObject
TextOutW
SetBkMode
CreatePen
CreateSolidBrush
DeleteDC
DeleteObject
SelectObject
CreateFontIndirectW
GetDeviceCaps
SetTextColor
CreateCompatibleDC

advapi32

CryptDestroyHash
RegCloseKey
RegCreateKeyW
RegQueryValueExW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegOpenKeyW
CryptGetHashParam
RegDeleteKeyW
CryptReleaseContext
CryptHashData
CryptAcquireContextA
CryptCreateHash
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW

shell32

SHGetPathFromIDListW
SHCreateDirectoryExW
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetSpecialFolderPathW
SHBrowseForFolderW
ord165

ole32

CoUninitialize
OleInitialize
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
OleUninitialize
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CreateStreamOnHGlobal
StringFromGUID2

oleaut32

VarUI4FromStr
SysFreeString
SysAllocString
OleCreateFontIndirect
SysStringLen
SysAllocStringLen
VariantInit
VariantClear
LoadTypeLi
LoadRegTypeLi

shlwapi

SHGetValueW
PathAppendW
PathFileExistsW

comctl32

_TrackMouseEvent
InitCommonControlsEx

iphlpapi

GetAdaptersInfo

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 284KB - Virtual size: 284KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

32dcf78386b87e9d8978bb21ad43d32e

Code Sign

32:5a:37:37:b8:92:6a:78:35:f0:23:96:3d:83:8f:ccCertificate

Extended Key Usages

Key Usages

22:80:0a:2b:4f:4b:11:30:18:ee:0a:7d:e3:be:19:00:c9:73:6a:31Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdiplus

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

iphlpapi

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 284KB - Virtual size: 284KB

.data Size: 40KB - Virtual size: 58KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 264KB - Virtual size: 263KB

.reloc Size: 90KB - Virtual size: 89KB

32:5a:37:37:b8:92:6a:78:35:f0:23:96:3d:83:8f:cc
Certificate

22:80:0a:2b:4f:4b:11:30:18:ee:0a:7d:e3:be:19:00:c9:73:6a:31
Signer

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 284KB - Virtual size: 284KB

.data
Size: 40KB - Virtual size: 58KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 264KB - Virtual size: 263KB

.reloc
Size: 90KB - Virtual size: 89KB