2024-01-24_b21574054ba5197f8616b11345380885_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-24_b21574054ba5197f8616b11345380885_mafia
Size

2.8MB
MD5

b21574054ba5197f8616b11345380885
SHA1

3ae0648f1f1eabdc4faac828e49d49674c80bdf4
SHA256

33921e67b07100312a2f1000589a2941e750a8fb22b9c18ed70efc5f267234ee
SHA512

6972609fa78d90646cee9b75693e5be0d1bfba48b0a137cc6d3df1c4e3f6819920f798a96970052385dd6f9861fe5189ab38940f2ea32c2f099a53006ceb2367
SSDEEP

49152:UHNMnIX4tHIU0DC5z8Cdbp4lseJjIAsm1yCrAJVZcXsnMr/56uPG/0Or2YQucRgv:dIM0DCndbp4BJjI1m1TAfZcXsnMr/56N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-01-24_b21574054ba5197f8616b11345380885_mafia

Files

2024-01-24_b21574054ba5197f8616b11345380885_mafia
.exe windows:5 windows x86 arch:x86

577d668f3b19a9ef42a9d170a0b06b2a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
GetSystemDirectoryW
FindFirstFileW
FindResourceExW
UnmapViewOfFile
InterlockedPopEntrySList
VirtualFree
InterlockedPushEntrySList
InterlockedCompareExchange
lstrcpyW
MapViewOfFile
FindResourceW
LoadResource
CreateDirectoryW
GetModuleHandleW
CopyFileW
SizeofResource
GetModuleFileNameW
GetTempPathW
OpenMutexW
GetLastError
FindClose
LockResource
RemoveDirectoryW
FindNextFileW
CloseHandle
DeleteFileW
SetFileAttributesW
FreeLibrary
CreateProcessW
WaitForSingleObject
LoadLibraryW
GetModuleFileNameA
GetCurrentProcess
LeaveCriticalSection
FlushInstructionCache
RaiseException
SetLastError
EnterCriticalSection
GetCurrentThreadId
LoadLibraryExW
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
lstrlenW
GetProcAddress
lstrcmpiW
DeleteCriticalSection
EncodePointer
DecodePointer
GetFileAttributesW
GetCommandLineW
HeapSetInformation
GetStartupInfoW
HeapAlloc
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GlobalLock
GlobalAlloc
CreateEventA
SetEvent
Sleep
IsProcessorFeaturePresent
HeapSize
ExitProcess
WriteFile
GetStdHandle
GetLocaleInfoW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
WideCharToMultiByte
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
LocalAlloc
LocalFree
GlobalReAlloc
GlobalUnlock
GlobalHandle
InitializeCriticalSection
LocalReAlloc
GlobalFree
DeactivateActCtx
ReleaseActCtx
ActivateActCtx
lstrlenA
HeapReAlloc
InterlockedExchange
LCMapStringW
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetFilePointer
GetConsoleCP
GetConsoleMode
MulDiv
GlobalSize
CopyFileA
SetThreadPriority
ResumeThread
SetStdHandle
WriteConsoleW
GetModuleHandleA
CompareStringA
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GlobalGetAtomNameA
lstrcmpA
FileTimeToSystemTime
lstrcmpW
LoadLibraryA
GetVersionExA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
FreeResource
FindResourceA
ExitThread
CreateThread
CreateFileW
FlushFileBuffers
CompareStringW
SetEnvironmentVariableA
ReadFile
lstrcmpiA
CreateFileA
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
FindFirstFileA
GetVolumeInformationA
GetFullPathNameA
GlobalFlags
GetUserDefaultUILanguage
GetFileAttributesExA
FileTimeToLocalFileTime
GetFileAttributesA
GetFileSizeEx
GetFileTime
HeapQueryInformation
GetCurrentDirectoryA
lstrcpyA
GetWindowsDirectoryA
GetNumberFormatA
GetTempFileNameA
GetTempPathA
GetProfileIntA
SearchPathA
GetCurrentDirectoryW
SetCurrentDirectoryW
OutputDebugStringW
DeviceIoControl
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
GetVersionExW
GetLocalTime
GetModuleHandleExW
CreateFileMappingW
CreateMutexW

user32

DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
SystemParametersInfoA
DestroyMenu
GetMenuItemInfoA
InflateRect
RealChildWindowFromPoint
ClientToScreen
CharUpperA
SetWindowTextA
IsDialogMessageA
CheckDlgButton
RegisterWindowMessageA
LoadIconW
LoadIconA
SendDlgItemMessageA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SetFocus
GetForegroundWindow
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
UpdateWindow
PostMessageA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetWindowTextLengthA
GetWindowTextA
LoadCursorA
GetSysColor
GetSysColorBrush
SetWindowsHookExA
CallNextHookEx
GetMessageA
DispatchMessageA
GetActiveWindow
PeekMessageA
ValidateRect
UnregisterClassA
GetMenuState
GetMenuStringA
AppendMenuA
GetMenuItemID
InsertMenuA
GetMenuItemCount
GetSystemMenu
RemoveMenu
SetRectEmpty
GetWindowThreadProcessId
SendMessageW
GrayStringA
GetClipboardData
SendInput
GetMessageExtraInfo
SendMessageA
GetParent
GetWindowLongA
GetLastActivePopup
MessageBoxA
UnhookWindowsHookEx
EndPaint
TranslateAcceleratorW
GetKeyState
BeginPaint
GetUpdateRect
GetDlgItem
ShowWindow
IsWindowVisible
GetMessagePos
SetTimer
KillTimer
CallWindowProcW
GetDC
IntersectRect
ReleaseDC
LoadImageW
GetIconInfo
DestroyIcon
CharNextW
DestroyWindow
SetWindowPlacement
SetCursor
SetWindowRgn
ScreenToClient
GetWindowRect
GetMessageW
PostQuitMessage
IsIconic
IsChild
SetCapture
PostMessageW
SetForegroundWindow
LoadCursorW
IsWindowEnabled
GetClientRect
PtInRect
GetClassInfoExW
SetPropW
TranslateMessage
RegisterClassExW
GetWindowDC
ShowOwnedPopups
DeleteMenu
EnumDisplayMonitors
GetMenuDefaultItem
CreatePopupMenu
IsRectEmpty
MapVirtualKeyA
GetAsyncKeyState
InvertRect
DrawFocusRect
HideCaret
EnableScrollBar
NotifyWinEvent
MessageBeep
GetNextDlgTabItem
CopyImage
LoadImageA
GetWindowTextLengthW
GetWindowTextW
RegisterWindowMessageW
DrawTextW
GetMenuItemInfoW
ModifyMenuW
CharLowerW
AppendMenuW
GetClassNameW
SetMenuInfo
GetMenuInfo
SetWindowsHookExW
SetMenuItemInfoW
WaitForInputIdle
DispatchMessageW
MoveWindow
CopyRect
DefWindowProcW
GetPropW
GetNextDlgGroupItem
DrawIconEx
EndDialog
CreateDialogIndirectParamA
TranslateAcceleratorA
BringWindowToTop
InsertMenuItemA
LoadAcceleratorsA
LoadMenuA
ReuseDDElParam
SetWindowTextW
EnableWindow
DrawStateA
DrawEdge
SetCursorPos
DrawFrameControl
CopyAcceleratorTableA
ToAsciiEx
GetKeyboardLayout
GetKeyboardState
LoadAcceleratorsW
GetSystemMetrics
ReleaseCapture
CreateWindowExW
SetLayeredWindowAttributes
CreateAcceleratorTableA
GetMonitorInfoW
GetCursorPos
SetWindowPos
GetDesktopWindow
RedrawWindow
SetWindowLongW
PeekMessageW
SystemParametersInfoW
GetAncestor
GetWindowLongW
InvalidateRect
OffsetRect
GetWindowPlacement
UnpackDDElParam
SetRect
WindowFromPoint
IsZoomed
SetParent
DestroyAcceleratorTable
SetClassLongA
IsWindow
LoadMenuW
wsprintfW
GetWindowRgn
DestroyCursor
DrawIcon
MapDialogRect
SubtractRect
GetDoubleClickTime
CharUpperBuffA
CopyIcon
RegisterClipboardFormatA
FrameRect
IsClipboardFormatAvailable
SetMenuDefaultItem
CreateMenu
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcA
DefFrameProcA
WaitMessage
PostThreadMessageA
IsMenu
MonitorFromPoint
UpdateLayeredWindow
UnionRect
MapVirtualKeyExA
IsCharLowerA
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
GetKeyNameTextA
LockWindowUpdate
GetSubMenu

gdi32

CreateCompatibleDC
CreateCompatibleBitmap
DeleteObject
ExtTextOutW
GetObjectW
ExcludeClipRect
SelectObject
GetTextFaceA
SetPixelV
SetPaletteEntries
ExtFloodFill
GetBoundsRect
FrameRgn
FillRgn
PtInRegion
GetViewportOrgEx
GetWindowOrgEx
LPtoDP
EnumFontFamiliesExA
GetRgnBox
OffsetRgn
Rectangle
SetPixel
StretchBlt
SetDIBColorTable
Polygon
Ellipse
Polyline
CreateEllipticRgn
GetTextColor
CreatePolygonRgn
CreateDIBSection
GetSystemPaletteEntries
RealizePalette
GetNearestPaletteIndex
GetPaletteEntries
CreatePalette
GetBkColor
GetTextCharsetInfo
EnumFontFamiliesA
GetTextMetricsA
CreateDIBitmap
DPtoLP
PatBlt
CombineRgn
SetRectRgn
CreateRectRgnIndirect
CreateHatchBrush
CreateSolidBrush
CreatePen
GetObjectType
SelectPalette
GetStockObject
CreatePatternBrush
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
Escape
TextOutA
RectVisible
PtVisible
GetPixel
GetWindowExtEx
GetViewportExtEx
CreateRectRgn
SelectClipRgn
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
DeleteDC
GetClipBox
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
GetTextExtentPoint32A
ExtTextOutA
CreateFontIndirectA
SetBkColor
SetTextColor
CreateBitmap
GetObjectA
CreateDCA
CopyMetaFileA
GetDeviceCaps
GetTextMetricsW
GetTextExtentPoint32W
CreateFontIndirectW
SaveDC
RestoreDC
BitBlt
SetViewportOrgEx
CreateRoundRectRgn

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

comdlg32

GetFileTitleA

advapi32

RegCloseKey
RegSetValueExA
RegQueryValueExA
RegDeleteValueW
RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegOpenKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegQueryValueExW
RegDeleteValueA
RegEnumKeyExA

shell32

SHGetPathFromIDListA
ShellExecuteW
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFileInfoA
SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHAppBarMessage
SHBrowseForFolderA
DragQueryFileA
DragFinish
ShellExecuteA

ole32

OleGetClipboard
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
DoDragDrop
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoInitializeEx
CoCreateGuid
OleDuplicateData
ReleaseStgMedium
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemFree
CoInitialize
CoTaskMemRealloc
CoUninitialize
CoCreateInstance

oleaut32

VariantChangeType
VariantClear
SysStringLen
VarUI4FromStr
SysFreeString
VarBstrFromDate
VariantInit
SysAllocString
SysAllocStringLen
VariantTimeToSystemTime
SystemTimeToVariantTime

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathFindExtensionA
PathFindFileNameA
PathIsUNCA
PathFindExtensionW
PathStripToRootA

comctl32

InitCommonControlsEx
_TrackMouseEvent
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_Destroy

msimg32

TransparentBlt
AlphaBlend

gdiplus

GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipDrawImageRectI
GdipSetInterpolationMode
GdipBitmapUnlockBits
GdipDrawImageI
GdipGetImagePalette
GdiplusShutdown
GdiplusStartup
GdipLoadImageFromStream
GdipFree
GdipGetImageHeight
GdipCreateBitmapFromHICON
GdipGetImagePixelFormat
GdipCreateBitmapFromScan0
GdipLoadImageFromFile
GdipAlloc
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipBitmapLockBits
GdipCloneImage
GdipGetImageWidth
GdipDeleteFont
GdipCreateFontFromLogfontW
GdipCreateFontFromDC
GdipDrawImageRectRect
GdipDeleteGraphics
GdipSetClipRectI
GdipGetImageGraphicsContext
GdipSetImageAttributesWrapMode
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipDrawRectangle
GdipDrawString
GdipGetDC
GdipFillRectangle
GdipCreateFromHDC
GdipDrawLineI
GdipReleaseDC
GdipDeletePen
GdipCreatePen2
GdipCreatePen1
GdipDeleteBrush
GdipCloneBrush
GdipCreateSolidFill
GdipSetSolidFillColor
GdipSetStringFormatLineAlign
GdipGetStringFormatAlign
GdipSetStringFormatAlign
GdipGetStringFormatLineAlign
GdipCreateStringFormat
GdipDeleteStringFormat

imm32

ImmGetOpenStatus
ImmGetContext
ImmAssociateContext
ImmReleaseContext
ImmNotifyIME

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

winmm

PlaySoundA

netapi32

Netbios
NetWkstaTransportEnum
NetApiBufferFree

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

psapi

GetModuleBaseNameW

Exports

Exports

??0CDownloadPure@QMNetwork@@QAE@ABV01@@Z
??0CDownloadPure@QMNetwork@@QAE@PAVITaskCallback@1@@Z
??0ITaskCallback@QMNetwork@@QAE@ABV01@@Z
??0ITaskCallback@QMNetwork@@QAE@XZ
??1CDownloadPure@QMNetwork@@UAE@XZ
??4CDownloadPure@QMNetwork@@QAEAAV01@ABV01@@Z
??4ITaskCallback@QMNetwork@@QAEAAV01@ABV01@@Z
??_7CDownloadPure@QMNetwork@@6B@
??_7ITaskCallback@QMNetwork@@6B@
?OnTaskNotify2@ITaskCallback@QMNetwork@@UAEXPADH@Z

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 322KB - Virtual size: 321KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 797KB - Virtual size: 797KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 193KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

577d668f3b19a9ef42a9d170a0b06b2a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

imm32

oleacc

winmm

netapi32

version

psapi

Exports

Exports

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 322KB - Virtual size: 321KB

.data Size: 33KB - Virtual size: 66KB

.rsrc Size: 797KB - Virtual size: 797KB

.reloc Size: 193KB - Virtual size: 192KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 322KB - Virtual size: 321KB

.data
Size: 33KB - Virtual size: 66KB

.rsrc
Size: 797KB - Virtual size: 797KB

.reloc
Size: 193KB - Virtual size: 192KB