2024-09-13_6dc2890b5186e9a1673691e0f17a3004_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-09-13_6dc2890b5186e9a1673691e0f17a3004_mafia
Size

2.2MB
MD5

6dc2890b5186e9a1673691e0f17a3004
SHA1

0f17c183a82480c9c94e07c19712f44534ca683b
SHA256

72675f80c2878628d05a22ee1b06f07e7c760513eae49cb179158759ed44715d
SHA512

bedc85760f517c412ceab93bdce779993e6d9660a7df191c3bc0ab3739b31ee2b6b77f4c10ede63121888dc0c1634e502c4a73cf7b974a888191209891cac7d6
SSDEEP

49152:hTEFVxVbtrlYI9xq0oL4nnWKEtStHbPC6SAExuYJ8NGBKCUTjxLdTp4RCF:mVbtrKI9xFo0nPEWC3VxuYWGMF+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-09-13_6dc2890b5186e9a1673691e0f17a3004_mafia

Files

2024-09-13_6dc2890b5186e9a1673691e0f17a3004_mafia
.exe windows:5 windows x86 arch:x86

6f64bae6b9a63a634034ab6e00dd5fdf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

J:\TFSProjects\PCMaster\Hao123\bin\Hao123Downloader.pdb

Imports

kernel32

lstrcatW
lstrcmpiW
GetVersionExW
MoveFileExW
CreateProcessW
FileTimeToLocalFileTime
Module32NextW
Module32FirstW
GetFileTime
WriteProcessMemory
VirtualProtect
FindNextFileW
FindClose
GetStartupInfoW
InterlockedDecrement
GetFileSizeEx
lstrcmpW
DeviceIoControl
MoveFileW
SetFileAttributesW
GetDiskFreeSpaceExW
GetDriveTypeW
GetLogicalDrives
IsBadCodePtr
FileTimeToDosDateTime
SetLastError
FindFirstFileW
GetComputerNameW
GetVolumeInformationW
GetSystemDirectoryW
GetTempFileNameW
GetNumberFormatW
GetLocaleInfoW
GlobalMemoryStatusEx
FreeResource
MoveFileA
WritePrivateProfileStringW
CopyFileW
GetCommandLineW
GetCurrentThreadId
GetLocalTime
SetUnhandledExceptionFilter
GetPrivateProfileStringW
lstrcmpiA
SetEvent
UnlockFileEx
WaitForMultipleObjects
InterlockedIncrement
TerminateThread
GetExitCodeThread
ResumeThread
CreateDirectoryW
CreateSemaphoreW
ReleaseSemaphore
LocalFileTimeToFileTime
GetCurrentDirectoryW
SetFileTime
GetFileInformationByHandle
lstrcpynW
lstrcmpA
lstrlenA
LoadLibraryExW
UnmapViewOfFile
WriteFile
WaitForSingleObject
LoadLibraryExA
BeginUpdateResourceW
BeginUpdateResourceA
EndUpdateResourceW
UnlockFile
UpdateResourceW
InitializeCriticalSection
InterlockedCompareExchange
DeleteCriticalSection
AreFileApisANSI
CreateFileA
CreateFileW
CreateFileMappingA
CreateFileMappingW
OutputDebugStringA
OutputDebugStringW
QueryPerformanceFrequency
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
GetSystemTimeAsFileTime
QueryPerformanceCounter
WideCharToMultiByte
GetWindowsDirectoryW
GetModuleFileNameW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetProcessHeap
HeapAlloc
LocalAlloc
HeapFree
IsBadReadPtr
FreeLibrary
GetLastError
LocalFree
lstrcpyW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CloseHandle
ExpandEnvironmentStringsW
lstrlenW
GetFileAttributesW
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetModuleHandleW
GetProcAddress
GetCurrentProcess
MultiByteToWideChar
CreateMutexW
DeleteFileA
DeleteFileW
FlushFileBuffers
FormatMessageA
FormatMessageW
GetCurrentProcessId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetFileAttributesA
GetFileAttributesExW
GetFileSize
GetFullPathNameA
GetFullPathNameW
GetSystemInfo
GetSystemTime
GetTempPathA
GetTempPathW
GetTickCount
GetVersionExA
HeapCreate
HeapDestroy
HeapReAlloc
HeapSize
HeapValidate
LoadLibraryA
LockFile
LockFileEx
MapViewOfFile
ReadFile
SetEndOfFile
SetFilePointer
GetUserDefaultUILanguage
Sleep
CreateEventW
MulDiv
IsBadStringPtrW
SetEnvironmentVariableA
CompareStringW
WriteConsoleW
SetStdHandle
SetConsoleCtrlHandler
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
SetHandleCount
GetConsoleMode
GetConsoleCP
SetCurrentDirectoryW
GetFileType
PeekNamedPipe
GetTimeZoneInformation
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
FatalAppExitA
ExitProcess
GetStdHandle
IsProcessorFeaturePresent
GetStringTypeW
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
HeapQueryInformation
TlsAlloc
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
OpenEventW
RaiseException
IsValidCodePage
GetOEMCP
GetACP
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
GetCPInfo
LCMapStringW
HeapSetInformation
GetCommandLineA
CreateThread
ExitThread
FindFirstFileExW
RtlUnwind
InitializeCriticalSectionAndSpinCount
InterlockedExchange
EncodePointer
DecodePointer

user32

GetFocus
PostMessageW
GetDesktopWindow
MessageBoxW
PtInRect
IntersectRect
OffsetRect
SetCursor
LoadCursorW
GetSystemMetrics
CharNextW
SetTimer
wsprintfW
SetWindowLongW
GetWindowLongW
PostQuitMessage
DispatchMessageW
TranslateMessage
PeekMessageW
DestroyWindow
IsZoomed
ScreenToClient
GetWindowRect
InflateRect
UnionRect
DefWindowProcW
IsWindow
SetWindowPos
MapWindowPoints
GetClientRect
GetMonitorInfoW
MonitorFromWindow
GetWindow
GetParent
SendMessageW
LoadImageW
CallWindowProcW
GetPropW
SetPropW
AdjustWindowRectEx
GetMenu
EnumChildWindows
IsWindowVisible
FindWindowExW
ShowWindow
RegisterClassW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
UpdateLayeredWindow
InvalidateRect
SetCapture
ReleaseCapture
SystemParametersInfoW
GetDC
SetWindowRgn
SetFocus
GetKeyState
GetClassNameW
GetCursorPos
IsRectEmpty
EndPaint
BeginPaint
GetUpdateRect
ReleaseDC
GetMessageW
EnableWindow
DrawFocusRect
DrawTextW
DrawIconEx
CharPrevW
SetRect
IsIconic
UpdateWindow
DestroyIcon
GetIconInfo
KillTimer
CreateCaret
HideCaret
ShowCaret
SetCaretPos
ClientToScreen
GetSysColor
DestroyMenu
TrackPopupMenu
EnableMenuItem
AppendMenuW
CreatePopupMenu
GetCaretPos
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
FillRect
InvalidateRgn
MoveWindow
CreateAcceleratorTableW

advapi32

CryptGetHashParam
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
LookupAccountNameW
DuplicateTokenEx
ConvertStringSidToSidW
SetTokenInformation
RegDeleteValueW
AllocateAndInitializeSid
FreeSid
LookupPrivilegeValueW
AdjustTokenPrivileges
CreateProcessAsUserW
SaferCreateLevel
SaferComputeTokenFromLevel
SaferCloseLevel
RegEnumValueW
CryptAcquireContextW
CryptCreateHash
CryptHashData
RegEnumKeyExW
CryptDestroyHash
CryptReleaseContext
OpenProcessToken
ConvertSidToStringSidW
GetTokenInformation
GetLengthSid
CopySid
IsValidSid
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
DeleteAce
SetEntriesInAclW
SetNamedSecurityInfoW
RegFlushKey

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteExW
ShellExecuteW
SHGetMalloc

ole32

CoCreateInstance
CoInitializeEx
CoInitialize
OleLockRunning
CLSIDFromString
CLSIDFromProgID
StgCreateDocfile
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
OleSetContainedObject
OleCreateStaticFromData
OleDuplicateData
ReleaseStgMedium
CreateStreamOnHGlobal
OleUninitialize
OleInitialize
CoSetProxyBlanket
CoUninitialize

oleaut32

VariantClear
VariantInit
SysAllocString
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo
SysFreeString

shlwapi

PathFindFileNameW
StrStrIA
PathFindExtensionW
PathFileExistsA
PathAppendW
PathFileExistsW
PathAppendA

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

iphlpapi

GetAdaptersInfo

wininet

InternetCloseHandle
InternetCheckConnectionW
InternetGetCookieW
InternetGetCookieExW
HttpSendRequestW
InternetSetCookieW
InternetReadFile
InternetOpenUrlW
InternetOpenW
HttpEndRequestW
InternetWriteFile
HttpSendRequestExW
HttpOpenRequestW
InternetConnectW
GetUrlCacheEntryInfoW
HttpQueryInfoW
InternetSetOptionW

psapi

GetModuleInformation

winhttp

WinHttpQueryHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpCrackUrl
WinHttpReadData
WinHttpOpenRequest
WinHttpConnect
WinHttpSetTimeouts
WinHttpOpen

crypt32

CertGetNameStringW
CertFindCertificateInStore
CryptDecodeObject
CryptMsgGetParam
CryptProtectData
CryptQueryObject

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

urlmon

URLDownloadToFileW
ObtainUserAgentString

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wintrust

WinVerifyTrust

dbghelp

MiniDumpWriteDump

gdi32

CreateSolidBrush
GetTextMetricsW
SelectObject
DeleteObject
CreateFontIndirectW
CreateRoundRectRgn
SetWindowOrgEx
RestoreDC
BitBlt
SaveDC
CreateCompatibleDC
DeleteDC
OffsetRgn
PtInRegion
SelectClipRgn
ExtSelectClipRgn
CreateRectRgnIndirect
GetClipBox
CombineRgn
StretchBlt
SetStretchBltMode
GetDIBits
GetObjectW
CreateRectRgn
GetBitmapBits
CreateDIBSection
LineTo
MoveToEx
CreatePen
Rectangle
GetStockObject
RoundRect
GetTextExtentPoint32W
SetBkMode
SetTextColor
GdiFlush
TextOutW
GetCharABCWidthsW
SetBkColor
GetDeviceCaps
SetBitmapBits
CreateCompatibleBitmap
CreatePatternBrush
CreateDCW
SetDIBColorTable

comctl32

ord17
_TrackMouseEvent

gdiplus

GdipCreateFromHDC
GdipSaveGraphics
GdipDrawImageI
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipGetImageGraphicsContext
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipSaveImageToStream
GdipSaveImageToFile
GdiplusStartup
GdiplusShutdown
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipDeleteBrush
GdipFree
GdipAlloc
GdipCreatePen1
GdipDeletePen
GdipCreateStringFormat
GdipDeleteStringFormat
GdipCreatePath
GdipDeletePath
GdipDeleteGraphics
GdipDeleteFont
GdipGetImageWidth
GdipDrawImageRectI
GdipSetImageAttributesColorMatrix
GdipSetImageAttributesColorKeys
GdipSetImageAttributesWrapMode
GdipCreateSolidFill
GdipSetPenDashStyle
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatHotkeyPrefix
GdipSetStringFormatTrimming
GdipAddPathLineI
GdipAddPathArcI
GdipGetImageHeight
GdipReleaseDC
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipDrawLineI
GdipDrawRectangleI
GdipDrawPath
GdipDrawString
GdipMeasureString
GdipDrawImageRectRectI
GdipCreateFontFromDC
GdipCloneBrush
GdipGraphicsClear
GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCloneImage
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 397KB - Virtual size: 396KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 142KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6f64bae6b9a63a634034ab6e00dd5fdf

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

iphlpapi

wininet

psapi

winhttp

crypt32

winmm

urlmon

userenv

wintrust

dbghelp

gdi32

comctl32

gdiplus

imm32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 397KB - Virtual size: 396KB

.data Size: 36KB - Virtual size: 49KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 142KB - Virtual size: 141KB

.reloc Size: 92KB - Virtual size: 92KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 397KB - Virtual size: 396KB

.data
Size: 36KB - Virtual size: 49KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 142KB - Virtual size: 141KB

.reloc
Size: 92KB - Virtual size: 92KB