2024-02-22_f198f8e729b84b3a324a50b1025b10b3_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-22_f198f8e729b84b3a324a50b1025b10b3_mafia
Size

7.5MB
MD5

f198f8e729b84b3a324a50b1025b10b3
SHA1

7283e9af750509ed8488343155048a80f37b445f
SHA256

fdd5db9d88fda8e519a1eea3ad47e5fef93481670964f2e03778fb96bef537f5
SHA512

313d5b502c19cae194ece841138bece5d2329cbcf3fec178ab3c297590180f662ff48d1110d554476408d31f177975a18d18e4378ba429b9532e1530ab3d5555
SSDEEP

98304:nlifyy6N+NlhkvcjGITjrAUqlHmp/HrVNwdtRTdXNOfJLdQL9H6IpSi0cSMJzfsT:fM3hkvcxjruUivIdQL9R0cSMex4qaRA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-22_f198f8e729b84b3a324a50b1025b10b3_mafia

Files

2024-02-22_f198f8e729b84b3a324a50b1025b10b3_mafia
.exe windows:5 windows x86 arch:x86

fd26231bdc753d5bf2950286824f475b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\data\Software.MFC\Test\Ver32\Test.pdb

Imports

crypt32

CertFreeCertificateContext
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertCloseStore
CryptSignMessage

fontsub

CreateFontPackage

kernel32

HeapCreate
IsProcessorFeaturePresent
WriteConsoleW
GetLocaleInfoW
IsValidCodePage
SetHandleCount
CompareStringW
GetStringTypeW
EnumSystemLocalesA
IsValidLocale
SetEnvironmentVariableA
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetUnhandledExceptionFilter
FindResourceW
LoadResource
WideCharToMultiByte
SizeofResource
LockResource
CloseHandle
WriteFile
SetFilePointer
CreateFileW
GetCurrentProcessId
SetStdHandle
GetCurrentThreadId
CreateFileA
SetEndOfFile
LocalFree
FormatMessageA
GetLastError
InterlockedIncrement
InterlockedDecrement
lstrlenA
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetFileAttributesW
SetFileAttributesW
GetTempPathW
FindClose
FindFirstFileA
FindFirstFileW
FileTimeToSystemTime
SetFileTime
GetFileTime
Sleep
DeleteFileW
CreateDirectoryW
GetTickCount
HeapSize
HeapQueryInformation
GetDriveTypeW
SetConsoleMode
ReadConsoleInputA
FindFirstFileExA
GetDriveTypeA
SetConsoleCtrlHandler
PeekNamedPipe
CreateThread
ExitThread
HeapReAlloc
GetConsoleMode
GetConsoleCP
HeapAlloc
HeapFree
GetStartupInfoW
HeapSetInformation
DecodePointer
EncodePointer
FindResourceExW
GetUserDefaultLCID
VirtualProtect
SearchPathA
GetProfileIntA
GetNumberFormatA
GetTempPathA
GetTempFileNameA
GetFileAttributesExA
GetOEMCP
GlobalFlags
lstrcpyA
GetSystemDirectoryW
LocalReAlloc
GetVolumeInformationA
UnlockFile
LockFile
FlushFileBuffers
lstrcmpiA
ReleaseActCtx
CreateActCtxW
GlobalFindAtomA
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
lstrcmpW
GetPrivateProfileIntA
ResumeThread
SetThreadPriority
GetCurrentThread
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
ActivateActCtx
DeactivateActCtx
lstrcmpA
InterlockedExchange
lstrlenW
GetFileInformationByHandle
GetFileSize
DuplicateHandle
GetCurrentDirectoryA
CreateEventA
DeleteFileA
DisableThreadLibraryCalls
EnumCalendarInfoA
FileTimeToDosDateTime
GetACP
GetCPInfo
GetDateFormatA
GetDiskFreeSpaceA
GetFullPathNameA
GetFullPathNameW
GetProfileStringA
GetStringTypeExA
GlobalHandle
LoadLibraryW
LocalFileTimeToFileTime
ResetEvent
SetErrorMode
SetEvent
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
RaiseException
RtlUnwind
UnhandledExceptionFilter
ExitProcess
GetCommandLineA
GetLocaleInfoA
GetStartupInfoA
GetThreadLocale
LoadLibraryExA
lstrcpynA
VirtualQuery
LocalAlloc
VirtualAlloc
VirtualFree
DeleteCriticalSection
CompareStringA
GetFileAttributesA
GlobalSize
GlobalReAlloc
FindResourceA
FreeResource
GetCurrentProcess
GlobalLock
GlobalUnlock
GlobalFree
GetFileSizeEx
ReadFile
IsDebuggerPresent
GetLocalTime
GlobalGetAtomNameA
GlobalDeleteAtom
GlobalAddAtomA
WritePrivateProfileStringA
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CopyFileA
GetWindowsDirectoryA
GlobalAlloc
MulDiv
FlushConsoleInputBuffer
SetLastError
GetStdHandle
GetFileType
GetVersion
GetPrivateProfileStringA
GetSystemInfo
GetSystemTimeAsFileTime
GetVersionExA
ReleaseSemaphore
GetTimeZoneInformation
SystemTimeToFileTime
GetProcessHeap
GlobalMemoryStatus
FindNextFileW
GetCurrentDirectoryW
FileTimeToLocalFileTime
TerminateProcess
WaitForSingleObject

user32

GetNextDlgGroupItem
HideCaret
InvertRect
SetCursorPos
CreateAcceleratorTableA
LoadAcceleratorsW
GetKeyboardState
GetKeyboardLayout
ToAsciiEx
CopyAcceleratorTableA
DrawFocusRect
DrawFrameControl
DrawEdge
SetClassLongA
DestroyAcceleratorTable
SetParent
UnpackDDElParam
ReuseDDElParam
LoadMenuA
LoadImageA
LoadAcceleratorsA
InsertMenuItemA
BringWindowToTop
TranslateAcceleratorA
GetMenuDefaultItem
SetMenuDefaultItem
CreatePopupMenu
IsMenu
MonitorFromPoint
UpdateLayeredWindow
EnableScrollBar
IsRectEmpty
GetAsyncKeyState
NotifyWinEvent
MessageBeep
SetWindowRgn
GetSystemMenu
LoadMenuW
OffsetRect
IntersectRect
UnregisterClassA
CopyImage
DestroyMenu
GetMenuItemInfoA
InflateRect
KillTimer
SetTimer
RealChildWindowFromPoint
SetLayeredWindowAttributes
SystemParametersInfoA
SetRectEmpty
DeleteMenu
WaitMessage
ReleaseCapture
LoadCursorW
WindowFromPoint
SetCapture
LoadCursorA
GetSysColorBrush
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
MapVirtualKeyA
GetKeyNameTextA
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
CheckDlgButton
DrawStateA
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
IsWindow
LoadImageW
GetWindowTextA
GetForegroundWindow
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
RedrawWindow
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcA
SendMessageA
EnableWindow
LoadIconW
GetWindowTextLengthA
IsIconic
GetSystemMetrics
GetClientRect
DrawIcon
CallWindowProcA
GetMenu
SetWindowLongA
SetWindowPos
PtInRect
GetWindowThreadProcessId
GetLastActivePopup
IsWindowEnabled
ShowOwnedPopups
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
PostQuitMessage
PostMessageA
GetMenuState
GetMenuStringA
AppendMenuA
GetMenuItemID
InsertMenuA
GetMenuItemCount
GetSubMenu
RemoveMenu
CharUpperBuffA
CharLowerBuffA
CharUpperBuffW
CreateIcon
DestroyIcon
RegisterClipboardFormatA
FrameRect
CopyIcon
PostThreadMessageA
DefFrameProcA
DefMDIChildProcA
DrawMenuBar
TranslateMDISysAccel
CreateMenu
IsClipboardFormatAvailable
GetUpdateRect
GetDoubleClickTime
MapVirtualKeyExA
SubtractRect
DrawIconEx
GetIconInfo
LoadIconA
wvsprintfA
CharNextA
LoadStringA
GetKeyboardType
GetClassNameA
GetClipboardData
EmptyClipboard
DestroyCursor
GetWindowRgn
SetFocus
CharToOemA
OemToCharA
DispatchMessageA
TranslateMessage
PeekMessageA
CharUpperA
CharLowerA
GetUserObjectInformationW
GetProcessWindowStation
GetDesktopWindow
MessageBoxA
MapDialogRect
UpdateWindow
InvalidateRect
GetSysColor
GetWindowLongA
ShowScrollBar
ReleaseDC
GetDC
SetRect
GetMonitorInfoA
CopyRect
UnionRect
EnumDisplayMonitors
MonitorFromWindow
FillRect
IsZoomed
GetWindowRect
LockWindowUpdate
GetWindow
GetParent
OpenClipboard
CloseClipboard
SetClipboardData
IsCharLowerA

gdi32

GetWinMetaFileBits
GetTextMetricsA
GetTextFaceA
GetSystemPaletteEntries
GetPixel
GetPaletteEntries
GetOutlineTextMetricsW
GetOutlineTextMetricsA
GetKerningPairs
GetGlyphOutlineW
GetGlyphIndicesW
GetGlyphIndicesA
GetFontLanguageInfo
GetFontData
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileDescriptionA
GetEnhMetaFileBits
GetDIBColorTable
GetCurrentPositionEx
GetCharWidthW
GetCharWidth32W
GetBrushOrgEx
GdiFlush
FillPath
ExtTextOutA
ExtEscape
EnumFontsA
EnumFontFamiliesExA
EnumEnhMetaFile
EndPath
EndPage
EndDoc
DeleteEnhMetaFile
CreateScalableFontResourceW
CreatePenIndirect
CreatePalette
CreateICA
CreateEnhMetaFileA
CreateDIBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileA
CombineTransform
CloseFigure
CloseEnhMetaFile
BeginPath
AddFontResourceW
CopyMetaFileA
CreateRectRgnIndirect
SaveDC
RestoreDC
SetPolyFillMode
SetMapMode
GetClipBox
ExcludeClipRect
SetTextAlign
GetLayout
SetLayout
GetWindowOrgEx
SelectClipRgn
CreateRectRgn
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
CreatePatternBrush
GetObjectType
CreateHatchBrush
EnumFontFamiliesA
GetTextCharsetInfo
SetRectRgn
DPtoLP
CreateRoundRectRgn
CreatePolygonRgn
GetBkColor
GetTextColor
CreateEllipticRgn
Polyline
Ellipse
Polygon
GetNearestPaletteIndex
OffsetRgn
GetRgnBox
Rectangle
ExtFloodFill
LPtoDP
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
SetPixelV
IntersectClipRect
MaskBlt
PatBlt
PlayEnhMetaFile
PolyBezierTo
RemoveFontResourceW
SetAbortProc
SetBkColor
SetBkMode
SetBrushOrgEx
SetDIBColorTable
DeleteDC
DeleteObject
GetBitmapBits
BitBlt
GetObjectA
SelectObject
CreateCompatibleBitmap
GetDeviceCaps
CreateCompatibleDC
CreateDCA
CreateSolidBrush
CreateFontIndirectA
CreateHalftonePalette
GetTextExtentPoint32A
StretchBlt
LineTo
MoveToEx
CreatePen
CombineRgn
CreateDIBSection
GetDIBits
RealizePalette
SelectPalette
GetStockObject
UnrealizeObject
StrokePath
StrokeAndFillPath
StretchDIBits
StartPage
StartDocW
StartDocA
SetWinMetaFileBits
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetPaletteEntries
SetICMMode
SetEnhMetaFileBits

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleA

winspool.drv

GetJobA
EnumPrintersW
EnumPrintersA
OpenPrinterA
DeviceCapabilitiesA
ClosePrinter
ord203
DocumentPropertiesA
SetJobA

advapi32

CryptGetHashParam
DeregisterEventSource
ReportEventA
RegisterEventSourceA
RegCloseKey
RegQueryValueExA
RegQueryValueA
RegEnumKeyA
CryptAcquireContextW
CryptReleaseContext
CryptCreateHash
CryptDestroyHash
CryptHashData
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegEnumValueA
RegSetValueExA
RegDeleteValueA
RegCreateKeyExA

shell32

ShellExecuteA
SHGetFileInfoA
DragFinish
SHBrowseForFolderA
SHAppBarMessage
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetDesktopFolder
DragQueryFileA

comctl32

ImageList_GetIconSize

shlwapi

PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathRemoveFileSpecW
PathFindExtensionA

ole32

IsAccelerator
CoLockObjectExternal
CoCreateGuid
CoInitialize
CoUninitialize
CoInitializeEx
CoCreateInstance
CLSIDFromProgID
CoTaskMemFree
ReleaseStgMedium
CoTaskMemAlloc
OleDuplicateData
CreateStreamOnHGlobal
DoDragDrop
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
RegisterDragDrop
OleLockRunning
OleGetClipboard
RevokeDragDrop

oleaut32

VariantClear
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopyInd
VariantCopy
GetErrorInfo
VariantInit
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
VarBstrFromDate
SysFreeString
SysAllocString

gdiplus

GdipCreateBitmapFromStream
GdipDrawImageI
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipDrawImageRectI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipCreateBitmapFromHBITMAP
GdipCloneImage
GdipDisposeImage
GdipGetImageHeight
GdipGetImageWidth
GdiplusStartup
GdiplusShutdown
GdipFree
GdipAlloc
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetInterpolationMode

ws2_32

accept
select
__WSAFDIsSet
getsockopt
listen
ntohs
htonl
bind
ioctlsocket
setsockopt
inet_addr
inet_ntoa
WSACleanup
recv
send
WSAStartup
socket
WSAGetLastError
htons
gethostbyname
connect
gethostname
closesocket
shutdown
WSASetLastError

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundA

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

CODE
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 398KB - Virtual size: 463KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 400KB - Virtual size: 400KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd26231bdc753d5bf2950286824f475b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

fontsub

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

gdiplus

ws2_32

oleacc

imm32

winmm

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

CODE Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 398KB - Virtual size: 463KB

DATA Size: 134KB - Virtual size: 134KB

BSS Size: 12KB - Virtual size: 12KB

.rsrc Size: 83KB - Virtual size: 83KB

.reloc Size: 400KB - Virtual size: 400KB

.text
Size: 2.8MB - Virtual size: 2.8MB

CODE
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 398KB - Virtual size: 463KB

DATA
Size: 134KB - Virtual size: 134KB

BSS
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 83KB - Virtual size: 83KB

.reloc
Size: 400KB - Virtual size: 400KB