2024-01-01_929357485d7fd5a4fd13e4fd95ef3329_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-01_929357485d7fd5a4fd13e4fd95ef3329_mafia
Size

1024KB
MD5

929357485d7fd5a4fd13e4fd95ef3329
SHA1

fc825e35b7770e47fb24bffbff533b8360d9419b
SHA256

958067add141a87634257ad0c931835f192ec098a993d483bfb468c255324102
SHA512

2dccb8e670bda034460be17d0b19fbf54217c25088a54fd4b31f70b9f71a5f8dd6034875792291f2b77d7d2c94003c7f442aecf9cc4793d1775cfdf4415dbb53
SSDEEP

24576:+qgOqwqbYyHVpG5Yo/mP9t2v1C4j8mwwkDBjpkDnCEPA:+qvQA5Yo/mPGERmkDBjOnFPA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-01-01_929357485d7fd5a4fd13e4fd95ef3329_mafia

Files

2024-01-01_929357485d7fd5a4fd13e4fd95ef3329_mafia
.exe windows:5 windows x86 arch:x86

dbc3fb890aaf9720e6ca7cf6abcbd280

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileStringW
Sleep
Process32NextW
GetCurrentProcessId
Process32FirstW
CreateToolhelp32Snapshot
SetCurrentDirectoryW
GetDiskFreeSpaceExW
GetModuleFileNameW
GetLongPathNameW
OpenProcess
QueryDosDeviceW
TerminateProcess
ProcessIdToSessionId
lstrcmpW
CreateThread
GetLocalTime
InitializeCriticalSectionAndSpinCount
MapViewOfFileEx
ExitProcess
SetThreadPriority
GetCurrentThread
SetPriorityClass
CreateMutexW
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
LoadLibraryExW
TerminateThread
GetPrivateProfileIntW
GetUserDefaultLCID
MultiByteToWideChar
WaitForMultipleObjects
GetStdHandle
ReadFile
CreateDirectoryW
GetTickCount
GetDriveTypeW
GetFullPathNameA
FindFirstFileExA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
ExpandEnvironmentStringsA
PeekNamedPipe
FormatMessageA
VerSetConditionMask
VerifyVersionInfoW
DeleteFileW
MoveFileExW
CopyFileW
GetSystemDirectoryW
CreateFileMappingW
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedCompareExchange
SetEnvironmentVariableA
GlobalAlloc
GetProcessHeap
WriteConsoleW
FlushFileBuffers
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetStringTypeW
HeapSize
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetLocaleInfoW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
QueryPerformanceCounter
HeapDestroy
HeapCreate
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
HeapReAlloc
RtlUnwind
EncodePointer
DecodePointer
ExitThread
HeapFree
HeapAlloc
GetStartupInfoW
HeapSetInformation
GetCommandLineW
CreateFileA
DeviceIoControl
LoadLibraryA
InterlockedExchange
ResumeThread
GlobalLock
GlobalUnlock
GlobalFree
MapViewOfFile
UnmapViewOfFile
WriteFile
GetFileSize
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
FreeResource
SetLastError
WritePrivateProfileStringW
GetVersion
GetCurrentThreadId
lstrlenA
LoadLibraryW
FreeLibrary
GetCurrentProcess
FlushInstructionCache
RaiseException
GetModuleHandleW
GetProcAddress
GetSystemInfo
SetEndOfFile
SetFilePointer
GetTempFileNameW
GetTempPathW
GetCurrentDirectoryW
GetWindowsDirectoryW
MoveFileW
RemoveDirectoryW
SetFileAttributesW
CompareStringW
WideCharToMultiByte
lstrlenW
FindNextFileW
GetFileAttributesW
FindFirstFileW
FindClose
CreateFileW
GetFileInformationByHandle
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
WaitForSingleObject
CloseHandle
GetLastError
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetVersionExW
VirtualFree
SleepEx
VirtualAlloc

user32

GetWindowLongW
MoveWindow
SetWindowPos
GetWindowRect
RemoveMenu
GetSystemMetrics
ReleaseCapture
DestroyWindow
SetFocus
GetClientRect
InvalidateRect
IsChild
IsWindow
SetCapture
GetKeyState
WindowFromPoint
CreateWindowExW
SetWindowLongW
wsprintfW
GetNextDlgTabItem
IsWindowEnabled
GetScrollPos
OffsetRect
SetCursor
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetWindow
CharUpperW
FindWindowExW
UnregisterClassA
GetParent
GetClassInfoExW
LoadCursorW
CopyRect
SetRect
InflateRect
GetDlgItem
MessageBoxW
ShowWindow
IsDialogMessageW
GetFocus
ReleaseDC
GetDC
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
RegisterClassExW
LoadBitmapW
LoadImageW
SetActiveWindow
SetForegroundWindow
AttachThreadInput
SystemParametersInfoW
GetWindowThreadProcessId
GetForegroundWindow
EnableWindow
SendMessageW
DrawIconEx
LoadIconW
DrawFrameControl
EqualRect
DestroyIcon
DrawTextW
GetDlgCtrlID
PtInRect
UpdateLayeredWindow
PostThreadMessageW
SetRectEmpty
KillTimer
SetTimer
GetWindowDC
GetSystemMenu
PostQuitMessage
CallWindowProcW
EndPaint
BeginPaint
IsWindowVisible
DefWindowProcW
CharNextW
GetWindowTextW
SetWindowTextW
FindWindowW
GetActiveWindow
GetDesktopWindow
CharLowerW

gdi32

MoveToEx
GetClipRgn
RoundRect
RectInRegion
CombineRgn
CreateRectRgnIndirect
SetBkMode
CreateFontW
CreateFontIndirectW
GetStockObject
SetStretchBltMode
CreateCompatibleBitmap
CreateBitmap
StretchBlt
LineTo
GetObjectW
CreateCompatibleDC
CreateDIBSection
BitBlt
DeleteDC
DeleteObject
CreateRectRgn
CreatePen
SetBkColor
ExtTextOutW
Rectangle
SelectClipRgn
SelectObject
RestoreDC
SaveDC
TextOutW
SetTextColor
GetTextExtentPoint32W

shell32

ord680
SHGetSpecialFolderPathW
ShellExecuteW
ShellExecuteExW
SHGetFolderPathW
SHGetPathFromIDListW
SHBrowseForFolderW
SHChangeNotify

ole32

CoSetProxyBlanket
CoInitializeSecurity
CreateStreamOnHGlobal
CoUninitialize
CoCreateInstance
CoInitialize
StringFromGUID2
CoCreateGuid
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantInit
VarUI4FromStr
VariantCopy

advapi32

IsValidSid
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
GetTokenInformation
CloseServiceHandle
ChangeServiceConfig2W
CreateServiceW
OpenSCManagerW
StartServiceW
OpenServiceW
DeleteService
RevertToSelf
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegOpenKeyW
AdjustTokenPrivileges
RegOpenCurrentUser
ImpersonateLoggedOnUser
LookupPrivilegeValueW
OpenProcessToken
EqualSid
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
CryptCreateHash
CryptAcquireContextW
CryptHashData
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam

psapi

EnumProcessModules
GetModuleFileNameExW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

shlwapi

PathRemoveBackslashW
PathAddBackslashW
StrToIntA
PathFileExistsW
StrToIntW

comctl32

InitCommonControlsEx
_TrackMouseEvent

gdiplus

GdipCreateBitmapFromStream
GdipAlloc
GdipCloneBrush
GdipFillRectangleI
GdipCreatePathGradientFromPath
GdipAddPathEllipseI
GdipCreateLineBrushI
GdipTranslatePathGradientTransform
GdipSetPathGradientCenterPointI
GdipSetPathGradientSurroundColorsWithCount
GdipGetPathGradientPointCount
GdipSetPathGradientCenterColor
GdipDeletePath
GdipCreatePath
GdipDeleteBrush
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdiplusStartup
GdiplusShutdown
GdipCreateHBITMAPFromBitmap
GdipDeleteGraphics
GdipCloneImage
GdipDrawImageRectRectI
GdipDrawImageRectI
GdipCreateFromHDC
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipFree

wldap32

ord167
ord147
ord79
ord142
ord127
ord133
ord26
ord208
ord216
ord145
ord14
ord118
ord41
ord301
ord27
ord46

ws2_32

WSAGetLastError
select
recv
send
WSAIoctl
setsockopt
getsockname
ntohs
bind
htons
getsockopt
getpeername
closesocket
WSASetLastError
WSACleanup
__WSAFDIsSet
WSAStartup
socket
connect
freeaddrinfo
getaddrinfo
sendto
recvfrom
accept
listen
ioctlsocket
gethostname

Sections

.text
Size: 594KB - Virtual size: 593KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 186KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dbc3fb890aaf9720e6ca7cf6abcbd280

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

psapi

version

shlwapi

comctl32

gdiplus

wldap32

ws2_32

Sections

.text Size: 594KB - Virtual size: 593KB

.rdata Size: 119KB - Virtual size: 119KB

.data Size: 16KB - Virtual size: 36KB

.rsrc Size: 186KB - Virtual size: 186KB

.reloc Size: 41KB - Virtual size: 41KB

.text
Size: 594KB - Virtual size: 593KB

.rdata
Size: 119KB - Virtual size: 119KB

.data
Size: 16KB - Virtual size: 36KB

.rsrc
Size: 186KB - Virtual size: 186KB

.reloc
Size: 41KB - Virtual size: 41KB