2024-02-04_5431b89afadc1a9332a6cd8f86eb3ace_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-04_5431b89afadc1a9332a6cd8f86eb3ace_mafia
Size

2.5MB
MD5

5431b89afadc1a9332a6cd8f86eb3ace
SHA1

3685994759d784928145838c748ef65494d7ee7e
SHA256

218701552efdfae51a12e28d80dac99883ffeb60db042282c1eb6e1eae9fe4cc
SHA512

7b1b71cca81f54adc8252bd82af6711f31dd352c9a117e34bb89e6b53ac405a81e790f2c2c7f82f4ec41e51d3aa1703943cc441122ef99fcca2fab869dc09b0c
SSDEEP

49152:K14mtJEnbrVq+I3bIN55u7LO3wU75h/cR1SubwF46U8V7+zZaU:KFtJEnb1I3bIN54HOFTcR1S8zZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-04_5431b89afadc1a9332a6cd8f86eb3ace_mafia

Files

2024-02-04_5431b89afadc1a9332a6cd8f86eb3ace_mafia
.exe windows:5 windows x86 arch:x86

7a3f51a5f6dd3275184349a512e6458c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\work\santa\bin\Toy Factory.pdb

Imports

kernel32

DeleteFileW
FindNextFileW
FindFirstFileW
WriteFile
SetEndOfFile
SetFilePointer
CloseHandle
ReadFile
CreateFileW
GetLastError
CreateDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
GetCurrentThread
SetThreadPriority
GetTickCount
LocalFree
GetProcessHeap
CompareStringW
WriteConsoleW
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
FlushFileBuffers
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
GetCurrentDirectoryW
HeapCreate
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetOEMCP
GetACP
SetCurrentDirectoryA
GetModuleFileNameA
GetModuleHandleA
TerminateThread
WideCharToMultiByte
lstrcmpiA
lstrlenA
MultiByteToWideChar
MapViewOfFile
CreateFileMappingA
GetCurrentProcessId
GetFileSize
CreateFileA
FindFirstFileA
FindNextFileA
FindClose
EnterCriticalSection
LeaveCriticalSection
MulDiv
LoadLibraryA
FileTimeToSystemTime
GetFileTime
GetSystemDirectoryA
Sleep
GetVersionExA
OutputDebugStringA
DeleteFileA
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
GetCommandLineA
GetCurrentThreadId
CreateMutexW
SetUnhandledExceptionFilter
GetCurrentProcess
VirtualQuery
QueryPerformanceCounter
QueryPerformanceFrequency
GetThreadPriority
InitializeCriticalSection
DeleteCriticalSection
IsBadWritePtr
SetErrorMode
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
EncodePointer
DecodePointer
ExitThread
ResumeThread
CreateThread
HeapSetInformation
GetStartupInfoW
RtlUnwind
RaiseException
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
GetModuleHandleW
ExitProcess
GetDriveTypeW
GetFullPathNameA
GetLocalTime
CreateDirectoryA
SetEnvironmentVariableA
GetCurrentDirectoryA
RemoveDirectoryA
HeapReAlloc
GetCPInfo
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetStdHandle
GetModuleFileNameW
GetLocaleInfoW
HeapSize
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError

user32

ShowWindow
ChangeDisplaySettingsA
EnumDisplaySettingsA
SetCaretPos
ShowCaret
CreateCaret
DestroyCaret
HideCaret
ClientToScreen
GetClientRect
ReleaseDC
GetDC
DrawTextExW
FillRect
OffsetRect
MoveWindow
AdjustWindowRectEx
GetWindowInfo
SystemParametersInfoA
DestroyWindow
SetForegroundWindow
GetCursorPos
GetWindowPlacement
ReleaseCapture
ScreenToClient
LoadCursorA
SetCursor
MessageBoxA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
MessageBoxW
EndDialog
GetDlgItem
DialogBoxIndirectParamA
SetCapture
WindowFromPoint
DispatchMessageA
TranslateMessage
PeekMessageA
SetFocus
SetWindowTextA
GetWindowTextA
DefWindowProcW
DefWindowProcA
EndPaint
BeginPaint
GetWindowLongA
GetClipboardData
GetWindowRect
IsWindowVisible
IsIconic
EnumWindows
SetTimer
GetActiveWindow
AdjustWindowRect
CreateWindowExW
CreateWindowExA
SetWindowLongA
CreateCursor
RegisterClassW
RegisterClassA
LoadImageA
RegisterWindowMessageW
DestroyCursor
GetSysColorBrush
GetMessageA
LoadIconA
SendMessageA
GetSystemMetrics
wsprintfW
PostMessageA

ole32

CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

SysStringLen
VariantInit
VariantClear
SysFreeString
SysAllocString

squall

SQUALL_Channel_SetWorker
SQUALL_Channel_Pause
SQUALL_ChannelGroup_SetVolume
SQUALL_Sample_LoadFile
SQUALL_Sample_Unload
SQUALL_Sample_PlayEx
SQUALL_Sample_Stop
SQUALL_Sample_Pause
SQUALL_Channel_Start
SQUALL_Pause
SQUALL_Stop
SQUALL_Free
SQUALL_Init
SQUALL_SetSpeakerMode
SQUALL_SetFileCallbacks
SQUALL_SetMemoryCallbacks
SQUALL_Channel_Stop
SQUALL_Channel_Status
SQUALL_Channel_SetVolume

lua5.1

lua_setfield
lua_close
luaL_newstate
luaL_loadbuffer
lua_tolstring
lua_settop
lua_createtable
luaL_openlibs
lua_pushnumber
lua_rawset
lua_pcall

winmm

timeEndPeriod
PlaySoundA
timeGetTime
timeBeginPeriod

wsock32

gethostbyname
htons
connect
ioctlsocket
send
recv
closesocket
inet_ntoa
socket
WSAStartup
WSAGetLastError
select
__WSAFDIsSet
WSACleanup

gdi32

GetDeviceCaps
GetTextExtentPoint32W
GetStockObject
CreateDIBSection
CreateFontA
SetTextColor
IntersectClipRect
SetBkMode
GetTextMetricsA
DeleteObject
CreateFontIndirectA
GetObjectA
CreateCompatibleDC
SelectObject
DeleteDC
TextOutW

advapi32

RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyA
RegOpenKeyExA
RegDeleteValueA
RegCloseKey

shell32

ShellExecuteA

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 265KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 411KB - Virtual size: 411KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7a3f51a5f6dd3275184349a512e6458c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

ole32

oleaut32

squall

lua5.1

winmm

wsock32

gdi32

advapi32

shell32

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 265KB - Virtual size: 265KB

.data Size: 24KB - Virtual size: 260KB

.rsrc Size: 411KB - Virtual size: 411KB

.reloc Size: 94KB - Virtual size: 93KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 265KB - Virtual size: 265KB

.data
Size: 24KB - Virtual size: 260KB

.rsrc
Size: 411KB - Virtual size: 411KB

.reloc
Size: 94KB - Virtual size: 93KB