2024-02-21_abf6b3eababb0dd1b36ea156ff6ac995_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-21_abf6b3eababb0dd1b36ea156ff6ac995_mafia
Size

9.9MB
MD5

abf6b3eababb0dd1b36ea156ff6ac995
SHA1

7ad954270cb52c4e5a8b935401830dcfb5edb91e
SHA256

347859c1a327c3c0e7318be0c0da84ad57f6a3033f185c9cb3ae9e9d6b063095
SHA512

1edcd54cc484f6d6c9890166cccfdb20b5807986de8ea664de0539be30a80fb6b7b5bd0841607ca11d385cf4ad3ecea73d25c5b20f1e8d3a436da85f1c5fe9d7
SSDEEP

196608:mYTCJ0EdNalyF8iwSJcuIodbp9mnLiJsv6tWKFdu9Cx:mEOF0iJsv6tWKFdu9C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-21_abf6b3eababb0dd1b36ea156ff6ac995_mafia

Files

2024-02-21_abf6b3eababb0dd1b36ea156ff6ac995_mafia
.exe windows:5 windows x86 arch:x86

780e62bca15aaef200b3457ff4df38e0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

SysAllocString
SystemTimeToVariantTime
VariantChangeType
VariantInit
SysAllocStringLen
SysFreeString
SysStringLen

imm32

ImmNotifyIME
ImmGetDefaultIMEWnd
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext

winmm

PlaySoundW

opengl32

glDrawArrays
glEnable
glFinish
glFlush
glFrontFace
glGenTextures
glGetBooleanv
glGetError
glGetFloatv
glGetIntegerv
glGetString
glGetTexParameterfv
glGetTexParameteriv
glHint
glIsEnabled
glIsTexture
glLineWidth
glPixelStorei
glPolygonOffset
glReadPixels
glScissor
glStencilFunc
glDisable
glDepthMask
glDepthFunc
glDeleteTextures
glCullFace
glCopyTexSubImage2D
glCopyTexImage2D
glColorMask
glClearStencil
glClearColor
glClear
glBlendFunc
glBindTexture
glStencilMask
glStencilOp
glTexImage2D
glTexParameterf
glTexParameterfv
glTexParameteri
glTexParameteriv
glTexSubImage2D
glViewport
glDepthRange
glClearDepth
glDrawElements

gdi32

GetDIBits
GetTextFaceW
SetTextColor
SetBkMode
SetTextAlign
ExtTextOutW
GetCharABCWidthsW
GetCharABCWidthsI
GetCharABCWidthsFloatW
SetGraphicsMode
SetWorldTransform
GetTextExtentPoint32W
GetGlyphOutlineW
GetOutlineTextMetricsW
CreateDCW
CreateCompatibleBitmap
GetBitmapBits
AddFontResourceExW
AddFontMemResourceEx
EnumFontFamiliesExW
GetTextMetricsW
RemoveFontResourceExW
RemoveFontMemResourceEx
GetObjectW
CreateFontIndirectW
GetFontData
GetStockObject
GetPixelFormat
DescribePixelFormat
ChoosePixelFormat
SetPixelFormat
SwapBuffers
OffsetRgn
GetDeviceCaps
BitBlt
SelectClipRgn
GetRegionData
DeleteDC
SelectObject
CreateCompatibleDC
CreateDIBSection
GdiFlush
CreateRectRgn
CombineRgn
DeleteObject
CreateBitmap

kernel32

WriteConsoleW
SetEnvironmentVariableA
GetStringTypeW
EnumSystemLocalesA
RtlUnwind
RaiseException
GetCommandLineA
HeapSetInformation
EncodePointer
DecodePointer
HeapFree
HeapAlloc
HeapReAlloc
ExitThread
SetStdHandle
InitializeCriticalSectionAndSpinCount
SetFileAttributesW
GetConsoleCP
GetConsoleMode
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameA
SetHandleCount
HeapCreate
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetFileAttributesA
GetLocaleInfoA
GetProcAddress
lstrcmpW
GetVolumeInformationW
GetLongPathNameW
GetLastError
LocalFree
IsValidLocale
IsValidLanguageGroup
FormatMessageW
GetModuleHandleW
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
LoadLibraryA
GetLocaleInfoW
GetProcessHeap
CloseHandle
CreateProcessW
GetUserDefaultLangID
CheckRemoteDebuggerPresent
OpenProcess
InterlockedIncrement
InterlockedDecrement
GetCurrentProcessId
ReadFile
WriteFile
SetFilePointer
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
CreateFileA
WideCharToMultiByte
CreateFileW
GetConsoleWindow
GetModuleHandleA
ExitProcess
lstrlenA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InterlockedExchangeAdd
InterlockedCompareExchange
InterlockedExchange
DeviceIoControl
LoadLibraryW
SetHandleInformation
CompareStringW
GetUserDefaultLCID
OutputDebugStringW
WaitForSingleObject
SetEvent
CreateEventW
GetCommandLineW
VerifyVersionInfoW
VerSetConditionMask
GetVersionExW
QueryPerformanceFrequency
GetTickCount
QueryPerformanceCounter
GetLocalTime
GetSystemTime
GetSystemDirectoryW
TlsFree
TlsSetValue
GetCurrentThreadId
GetSystemInfo
SwitchToThread
Sleep
SetThreadPriority
GetCurrentThread
TlsAlloc
TerminateThread
TlsGetValue
WaitForMultipleObjects
ResumeThread
GetThreadPriority
CreateThread
DuplicateHandle
GetCurrentProcess
ResetEvent
ConnectNamedPipe
CreateNamedPipeW
GetStdHandle
TerminateProcess
GetExitCodeProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileAttributesExW
GetStartupInfoW
GetModuleFileNameW
GetCurrencyFormatW
GetDateFormatW
GetTimeFormatW
GetUserDefaultUILanguage
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileInformationByHandle
SetErrorMode
FindClose
FindFirstFileW
CreateDirectoryW
RemoveDirectoryW
GetFileAttributesW
CopyFileW
MoveFileW
DeleteFileW
GetFullPathNameW
GetTempPathW
GetCurrentDirectoryW
GetLogicalDrives
FlushFileBuffers
GetFileType
SetFilePointerEx
MoveFileExW
SetEndOfFile
CreateMutexW
ReleaseMutex
VirtualFree
VirtualAlloc
MultiByteToWideChar
FindNextFileW
FindFirstFileExW
FreeLibrary
DeleteFileA
PeekNamedPipe
GetOverlappedResult
GetGeoInfoW
GetUserGeoID
GetTimeZoneInformation
PostQueuedCompletionStatus
CreateIoCompletionPort
CreateSemaphoreW
ReleaseSemaphore
GetQueuedCompletionStatus
ExpandEnvironmentStringsW
CancelIo

user32

LoadIconW
SetCaretPos
RegisterWindowMessageW
DestroyCaret
HideCaret
CreateCaret
ChangeClipboardChain
GetWindowThreadProcessId
SetClipboardViewer
DestroyCursor
GetAsyncKeyState
GetIconInfo
LoadCursorW
NotifyWinEvent
GetMonitorInfoW
EnumDisplayMonitors
TrackMouseEvent
GetMessageExtraInfo
GetCursorInfo
ToAscii
CreateIconIndirect
GetClientRect
GetWindowTextW
RealGetWindowClassW
EnumWindows
GetKeyState
DrawIconEx
SetTimer
KillTimer
UnhookWindowsHookEx
CallNextHookEx
GetQueueStatus
SetWindowsHookExW
RegisterClassW
DispatchMessageW
TranslateMessage
MsgWaitForMultipleObjectsEx
PostThreadMessageW
CharNextExA
GetMenu
PeekMessageW
GetKeyboardState
MapVirtualKeyW
IsZoomed
SetMenuItemInfoW
SetCursorPos
TrackPopupMenuEx
EnableMenuItem
ScreenToClient
GetCaretBlinkTime
GetDoubleClickTime
MessageBeep
SetWindowRgn
DefWindowProcW
DestroyWindow
ToUnicode
GetClipboardFormatNameW
RegisterClipboardFormatW
IsIconic
SetWindowPlacement
MoveWindow
SetParent
GetUpdateRect
BeginPaint
EndPaint
GetSystemMenu
ReleaseDC
GetDC
SetCapture
SetForegroundWindow
SetFocus
SetWindowTextW
AdjustWindowRectEx
ShowWindow
SetWindowPos
InvalidateRect
SendMessageW
FlashWindowEx
SetCursor
ReleaseCapture
PostMessageW
SetWindowLongW
GetForegroundWindow
IsChild
IsWindowVisible
GetAncestor
GetDesktopWindow
GetWindowPlacement
GetWindowRect
DestroyIcon
GetCapture
UnregisterClassW
GetSysColorBrush
CreateWindowExW
GetClassInfoW
LoadImageW
RegisterClassExW
ClientToScreen
GetCursorPos
GetFocus
ChildWindowFromPointEx
GetWindowLongW
GetParent
MessageBoxW
GetKeyboardLayoutList
GetSystemMetrics
SystemParametersInfoW
GetSysColor
CreateCursor

shell32

SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetMalloc
SHGetPathFromIDListW
ShellExecuteW
SHGetFileInfoW
CommandLineToArgvW

ole32

CoTaskMemAlloc
CoGetMalloc
DoDragDrop
CoCreateInstance
OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
OleGetClipboard
CoCreateGuid
CoUninitialize
CoInitialize
ReleaseStgMedium
CoTaskMemFree
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleUninitialize
OleInitialize

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegFlushKey
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
FreeSid
CopySid
GetLengthSid
GetTokenInformation
OpenProcessToken

ws2_32

WSASendTo
WSAAsyncSelect
getsockname
getpeername
WSAHtons
WSAHtonl
WSANtohs
WSANtohl
WSASend
closesocket
select
__WSAFDIsSet
WSARecv
bind
WSAAccept
listen
setsockopt
WSASocketW
WSAIoctl
WSACleanup
WSAStartup
inet_addr
gethostbyaddr
ntohl
gethostbyname
WSAGetLastError
getsockopt
htonl
WSARecvFrom
WSAConnect

Exports

Exports

z_adler32
z_adler32_combine
z_adler32_combine64
z_compress
z_compress2
z_compressBound
z_crc32
z_crc32_combine
z_crc32_combine64
z_deflate
z_deflateBound
z_deflateCopy
z_deflateEnd
z_deflateInit2_
z_deflateInit_
z_deflateParams
z_deflatePrime
z_deflateReset
z_deflateSetDictionary
z_deflateSetHeader
z_deflateTune
z_get_crc_table
z_inflate
z_inflateCopy
z_inflateEnd
z_inflateGetHeader
z_inflateInit2_
z_inflateInit_
z_inflateMark
z_inflatePrime
z_inflateReset
z_inflateReset2
z_inflateSetDictionary
z_inflateSync
z_inflateSyncPoint
z_inflateUndermine
z_uncompress
z_zError
z_zlibCompileFlags
z_zlibVersion

Sections

.text
Size: 6.8MB - Virtual size: 6.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 82KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 708B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 288KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

780e62bca15aaef200b3457ff4df38e0

Headers

DLL Characteristics

File Characteristics

Imports

oleaut32

imm32

winmm

opengl32

gdi32

kernel32

user32

shell32

ole32

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 6.8MB - Virtual size: 6.8MB

.rdata Size: 2.7MB - Virtual size: 2.7MB

.data Size: 82KB - Virtual size: 165KB

.qtmetad Size: 3KB - Virtual size: 3KB

.rsrc Size: 1024B - Virtual size: 708B

.reloc Size: 288KB - Virtual size: 288KB

.text
Size: 6.8MB - Virtual size: 6.8MB

.rdata
Size: 2.7MB - Virtual size: 2.7MB

.data
Size: 82KB - Virtual size: 165KB

.qtmetad
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1024B - Virtual size: 708B

.reloc
Size: 288KB - Virtual size: 288KB