2024-01-01_4c1ee144a2e62dc1493668f3f408df7f_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-01_4c1ee144a2e62dc1493668f3f408df7f_mafia
Size

615KB
MD5

4c1ee144a2e62dc1493668f3f408df7f
SHA1

45c4b54d6f98eee627fe3f4e67fcd4785dae3be0
SHA256

6f399c78caa62799b40375ce3c87bd3c7d6e538f2274ab6d1ce067f69e44708e
SHA512

06f8277a83188b28a8ca8feb6826ab39c02203e1eb1359d2ca9f7783f4458c8d3e41c78eb08f4c266494a88c95dc2c86a538397d13386a77a87078d5ab775a3e
SSDEEP

12288:/E22aUaqOLA6r2rACggCILDRV0ZnX76VIp3IAY9+ZkVr/CGf1:TUYPrRdILDanXSIp4TMZkVr/CG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-01-01_4c1ee144a2e62dc1493668f3f408df7f_mafia

Files

2024-01-01_4c1ee144a2e62dc1493668f3f408df7f_mafia
.exe windows:5 windows x86 arch:x86

c3e107fa267dd2aa35b3b7abef01cfab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindFirstFileW
DeleteFileA
GetSystemDirectoryA
GetWindowsDirectoryA
LoadLibraryW
GetFileAttributesA
RemoveDirectoryA
ReadFile
WriteFile
IsBadStringPtrA
SetFileAttributesA
CreateDirectoryA
CopyFileExA
FindNextFileA
FindFirstFileA
CreateFileW
ReleaseMutex
CreateMutexA
WaitForMultipleObjects
InitializeCriticalSection
SuspendThread
ResetEvent
TerminateThread
PulseEvent
OutputDebugStringA
GetCurrentProcessId
GetACP
GetStringTypeExW
SetEnvironmentVariableA
CompareStringW
SetEndOfFile
WriteConsoleW
SetStdHandle
FindNextFileW
GetDriveTypeW
GetCurrentDirectoryW
InterlockedExchange
FlushFileBuffers
CreateFileA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
GetStringTypeW
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetLocaleInfoW
GetStdHandle
ExitProcess
HeapCreate
TlsFree
IsValidCodePage
GetOEMCP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ExitThread
GetFullPathNameW
GetStartupInfoW
HeapSetInformation
GetSystemTimeAsFileTime
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualProtect
EncodePointer
FindClose
lstrcmpA
ExpandEnvironmentStringsA
GetLongPathNameA
GetLongPathNameW
GetCurrentThread
LocalAlloc
LocalFree
GetExitCodeProcess
UnmapViewOfFile
CreateFileMappingA
MapViewOfFileEx
CreateProcessW
ResumeThread
TerminateProcess
OpenProcess
LoadLibraryA
SetLastError
GetCurrentProcess
FlushInstructionCache
GetCommandLineA
GetCurrentThreadId
GetModuleFileNameW
TlsAlloc
GetTickCount
TlsSetValue
LoadLibraryExW
GetModuleFileNameA
LoadLibraryExA
SizeofResource
FindResourceA
FreeLibrary
Sleep
IsDBCSLeadByte
LeaveCriticalSection
EnterCriticalSection
InterlockedIncrement
TlsGetValue
CreateEventA
CreateThread
WaitForSingleObject
CloseHandle
SetEvent
lstrcmpiA
lstrlenA
InterlockedDecrement
GetModuleHandleA
GetProcAddress
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
IsBadCodePtr
FindResourceExW
DecodePointer
RtlUnwind
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
FindResourceW
LoadResource
LockResource
SetFilePointer

user32

SetWindowLongA
GetWindowLongA
CallWindowProcA
DefWindowProcA
DispatchMessageA
TranslateMessage
SendMessageA
GetParent
PeekMessageA
ShowWindow
CreateDialogParamA
GetClassNameA
MessageBoxA
IsWindow
DestroyWindow
PostThreadMessageA
CharNextA
UnregisterClassA
LoadStringW
GetFocus
TranslateAcceleratorA
MsgWaitForMultipleObjects
WaitForInputIdle
GetDesktopWindow
GetSysColor
SetClassLongA
EnumChildWindows
GetKeyState
CreateWindowExA
RegisterClassExA
IsWindowUnicode
SetWindowPos
LoadCursorA
GetClassInfoExA
SetActiveWindow
ScreenToClient
GetClientRect
GetWindowRect
MoveWindow
IsIconic
SetWindowTextA
PostMessageA
SetWindowLongW
SystemParametersInfoA
GetSystemMetrics
SetRect

gdi32

CreateSolidBrush

advapi32

SetSecurityDescriptorGroup
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
CryptEncrypt
CryptDecrypt
CryptDestroyKey
CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDeriveKey
CryptDestroyHash
GetTokenInformation
ImpersonateSelf
OpenThreadToken
OpenProcessToken
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
AccessCheck
RevertToSelf
FreeSid
SetSecurityDescriptorDacl
GetSecurityDescriptorLength
MakeSelfRelativeSD
InitializeSecurityDescriptor
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
MakeAbsoluteSD
GetSecurityDescriptorControl
RegOpenKeyA
RegQueryValueExA
OpenSCManagerW
OpenServiceW
ControlService
QueryServiceStatus
CloseServiceHandle
RegEnumKeyExA
RegQueryInfoKeyW
RegSetValueExA
RegCloseKey
RegOpenKeyExA

shell32

SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation

ole32

CoRevokeClassObject
CoTaskMemRealloc
CoTaskMemAlloc
CLSIDFromProgID
CoCreateInstance
CoInitialize
CoRegisterClassObject
CoTaskMemFree
CoRegisterChannelHook
CoInitializeSecurity
CoInitializeEx
CoUninitialize
OleInitialize

oleaut32

SysStringByteLen
SysAllocStringLen
VariantInit
VarBstrCmp
SysFreeString
VariantClear
SysAllocString
SysAllocStringByteLen
SysStringLen
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi
VarBstrCat

shlwapi

PathFindOnPathA
PathAppendA
PathAppendW
PathCanonicalizeA
PathCanonicalizeW
PathFileExistsA
PathFileExistsW
PathUnquoteSpacesW
PathIsDirectoryA
PathIsFileSpecA
PathIsFileSpecW
PathIsRelativeA
PathIsRelativeW
PathIsRootA
PathIsRootW
PathIsUNCA
PathIsUNCW
PathQuoteSpacesA
PathRemoveBackslashA
PathSkipRootA
PathSkipRootW
PathStripPathA
PathStripPathW
PathUnquoteSpacesA
PathGetCharTypeW
PathRemoveFileSpecW
PathRemoveArgsW
PathAddBackslashW
PathGetDriveNumberA

crypt32

CertNameToStrA
CryptVerifyMessageSignature
CertFreeCertificateContext

imagehlp

ImageEnumerateCertificates
ImageGetCertificateHeader
ImageGetCertificateData

wintrust

WinVerifyTrust

Sections

.text
Size: 407KB - Virtual size: 407KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c3e107fa267dd2aa35b3b7abef01cfab

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

crypt32

imagehlp

wintrust

Sections

.text Size: 407KB - Virtual size: 407KB

.rdata Size: 123KB - Virtual size: 123KB

.data Size: 12KB - Virtual size: 20KB

.rsrc Size: 17KB - Virtual size: 17KB

.reloc Size: 53KB - Virtual size: 53KB

.text
Size: 407KB - Virtual size: 407KB

.rdata
Size: 123KB - Virtual size: 123KB

.data
Size: 12KB - Virtual size: 20KB

.rsrc
Size: 17KB - Virtual size: 17KB

.reloc
Size: 53KB - Virtual size: 53KB