2024-02-10_79d31027c986b4a882f3fa3175104312_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-02-10_79d31027c986b4a882f3fa3175104312_mafia
Size

461KB
MD5

79d31027c986b4a882f3fa3175104312
SHA1

d9fa32737040e1a8a1491d7d0924e6762969c304
SHA256

e1411426b34189a43481fe607bddd2f2d1c573d71db5328dcad0d2b94a0ef3e0
SHA512

7aaafbf7bbba9d09ddf2a747cfa1624a20f2e0d8595ed7a7660287bb825b79c4cb231218941ba14e43e75b4e3aa75c5c55a50a9b81d939e95a628b0d12b7576a
SSDEEP

12288:OIPMWEUD0Q2NPhnttpNHLgYWneskTedNO:r79D0ZPjzBLgY13TeH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
2024-02-10_79d31027c986b4a882f3fa3175104312_mafia

Files

2024-02-10_79d31027c986b4a882f3fa3175104312_mafia
.exe windows:5 windows x86 arch:x86

004549afd39c2a4ae14c54a6a72d4d61

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileType
FlushFileBuffers
CreateFileW
GetProfileStringA
lstrcpyA
MapUserPhysicalPages
WaitForSingleObject
Sleep
ResumeThread
SetThreadPriority
SetCommTimeouts
GetCommTimeouts
SetCommState
SetupComm
GetCurrentThread
FindResourceA
VirtualLock
VirtualAlloc
DeleteTimerQueueTimer
CreateTimerQueueTimer
GetModuleHandleW
GetCurrentThreadId
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetOEMCP
GetACP
HeapSize
SetFilePointer
GetConsoleCP
SetHandleCount
HeapCreate
GetLocaleInfoW
FormatMessageA
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
CreateThread
ExitThread
GetCPInfo
LCMapStringW
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetConsoleMode
RtlUnwind
HeapReAlloc
RaiseException
GetModuleFileNameW
GetStdHandle
WriteConsoleW
ExitProcess
InterlockedExchangeAdd
TlsSetValue
OpenEventA
GetCurrentProcessId
CreateWaitableTimerA
ResetEvent
GetProcAddress
SetWaitableTimer
TlsGetValue
TlsFree
TlsAlloc
DecodePointer
EncodePointer
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedExchange
LocalFree
GetTickCount
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
FindResourceW
CloseHandle
SetLastError
_lopen
GetUserDefaultLangID
FindResourceExW
LoadResource
FindResourceExA
GetLastError
SetEvent
GetCurrentProcess
DuplicateHandle
WaitForMultipleObjectsEx
HeapAlloc
InterlockedCompareExchange
InterlockedDecrement
InterlockedIncrement
WaitForSingleObjectEx
GetProcessHeap
HeapFree
QueryPerformanceFrequency
QueryPerformanceCounter
ReleaseSemaphore
CreateEventA
CreateSemaphoreA
GetModuleHandleA
WriteFile
CreateFileA
GetFileSize
GlobalAlloc
ReadFile
GlobalFree
LoadLibraryW

user32

SendMessageA
SendDlgItemMessageA
PostMessageA
GetDlgItem
DefWindowProcA
SetWindowPos
CreateWindowExA
DispatchMessageA
TranslateMessage
PostQuitMessage
GetWindowRect
GetClientRect
SetDlgItemTextA
GetMessageA
UpdateWindow
ShowWindow
RegisterClassExA
LoadCursorA
LoadIconA
IsWindow
EndPaint
DrawTextA
BeginPaint
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
DestroyWindow
GetClassInfoExW
GetDC
BeginDeferWindowPos
PostThreadMessageW
GetMessageW
CreateWindowExW
CloseWindow
SetRect
FillRect
IsDlgButtonChecked
SystemParametersInfoA
LoadImageA
CheckMenuItem
LookupIconIdFromDirectory
ClientToScreen
GetCursorPos
DialogBoxParamA
EndDialog
GetWindowLongA
SetActiveWindow
CharNextA
wsprintfA
GetParent
GetWindow
LoadAcceleratorsA
ReleaseDC
GetDesktopWindow
MessageBoxA
ShowCursor
AttachThreadInput
FindWindowExW
DrawFrameControl

gdi32

CreateCompatibleDC
CreateDIBSection
TextOutW
DeleteObject
Ellipse
MoveToEx
GetObjectA
CreateCompatibleBitmap
SetPixelV
StretchBlt
RestoreDC
GetTextCharsetInfo
SetDCPenColor
ExcludeClipRect
Pie
CreateSolidBrush
SelectObject
SetTextJustification
SetTextColor
GetStockObject
DeleteDC

winspool.drv

DeviceCapabilitiesA
SetPrinterDataExA

comdlg32

FindTextA
ChooseColorA
GetSaveFileNameA
GetOpenFileNameA

advapi32

OpenThreadToken
OpenProcessToken
PrivilegeCheck

shell32

ExtractAssociatedIconA
DragQueryFileA
Shell_NotifyIconA

ole32

StgCreateDocfile

odbc32

ord66
ord65
ord41

comctl32

InitCommonControlsEx
ord17

ws2_32

WSAStartup

setupapi

SetupDiClassGuidsFromNameA

urlmon

GetClassURL

netapi32

NetWkstaUserGetInfo
NetShareGetInfo

wininet

InternetConnectA
InternetOpenA
InternetGetLastResponseInfoA
InternetCloseHandle
InternetWriteFile
FtpOpenFileA

avifil32

AVIStreamGetFrameClose
AVISaveOptions

Sections

.text
Size: 174KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 181KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

004549afd39c2a4ae14c54a6a72d4d61

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

odbc32

comctl32

ws2_32

setupapi

urlmon

netapi32

wininet

avifil32

Sections

.text Size: 174KB - Virtual size: 174KB

.rdata Size: 71KB - Virtual size: 70KB

.data Size: 9KB - Virtual size: 20KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 181KB - Virtual size: 180KB

.reloc Size: 24KB - Virtual size: 23KB

.text
Size: 174KB - Virtual size: 174KB

.rdata
Size: 71KB - Virtual size: 70KB

.data
Size: 9KB - Virtual size: 20KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 181KB - Virtual size: 180KB

.reloc
Size: 24KB - Virtual size: 23KB