2024-03-06_64eeea6e6fbe136c6bbc27ea15343696_backswap_mafia_wapomi

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-06_64eeea6e6fbe136c6bbc27ea15343696_backswap_mafia_wapomi
Size

11.6MB
MD5

64eeea6e6fbe136c6bbc27ea15343696
SHA1

db61fa9e81809ff34375262f95b697da999be19c
SHA256

6d9e9a16f81bb6e7929a7fbfbfd03354ef3e1051b2a9d64a0f2869206dbe8af0
SHA512

bb126b4d01f7481c2742c2de04fa1f9a43a3c4cd32cf6e57c47a4c618617f8e02ee6d80c58a1ebeb3a8f2f0c110bba5376e9d8711b4301f10391c52db3e33521
SSDEEP

196608:4ABZotsEcIul2uAFDUvSk2WLuZylgdjdaWwJsv6tWKFdu9CAw2DQ:dZUuWJdMJsv6tWKFdu9C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-06_64eeea6e6fbe136c6bbc27ea15343696_backswap_mafia_wapomi

Files

2024-03-06_64eeea6e6fbe136c6bbc27ea15343696_backswap_mafia_wapomi
.exe windows:5 windows x86 arch:x86

6bc9478298c95bfc3ecf3405730e66c6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

EnumProcesses
GetProcessImageFileNameW

oleaut32

SysStringLen
SysFreeString
SysAllocStringLen
VariantInit
VariantChangeType
SystemTimeToVariantTime
SysAllocString

imm32

ImmGetVirtualKey
ImmReleaseContext
ImmNotifyIME
ImmGetContext
ImmAssociateContext
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmGetDefaultIMEWnd
ImmGetCompositionStringW

winmm

PlaySoundW

opengl32

glDepthMask
glDisable
glDrawArrays
glDrawElements
glEnable
glFinish
glFlush
glFrontFace
glGenTextures
glGetBooleanv
glGetError
glGetFloatv
glGetIntegerv
glGetString
glGetTexParameterfv
glGetTexParameteriv
glHint
glDepthFunc
glIsTexture
glLineWidth
glPixelStorei
glPolygonOffset
glReadPixels
glScissor
glStencilFunc
glStencilMask
glStencilOp
glTexImage2D
glTexParameterf
glDeleteTextures
glCullFace
glCopyTexSubImage2D
glCopyTexImage2D
glTexParameterfv
glTexParameteri
glTexParameteriv
glTexSubImage2D
glViewport
glDepthRange
glClearDepth
glColorMask
glClearStencil
glClearColor
glClear
glBlendFunc
glBindTexture
glIsEnabled

gdi32

GetCharABCWidthsFloatW
SetGraphicsMode
SetWorldTransform
GetTextExtentPoint32W
GetGlyphOutlineW
GetCharABCWidthsI
GetCharABCWidthsW
SetTextAlign
SetBkMode
SetTextColor
GetTextFaceW
ExtTextOutW
GetDIBits
CreateBitmap
GetOutlineTextMetricsW
CreateDCW
CreateCompatibleBitmap
GetBitmapBits
GetPixelFormat
DescribePixelFormat
SwapBuffers
ChoosePixelFormat
SetPixelFormat
AddFontMemResourceEx
GetTextMetricsW
AddFontResourceExW
RemoveFontResourceExW
RemoveFontMemResourceEx
GetObjectW
EnumFontFamiliesExW
CreateFontIndirectW
GetFontData
GetStockObject
OffsetRgn
GetDeviceCaps
BitBlt
SelectClipRgn
GetRegionData
DeleteDC
SelectObject
CreateCompatibleDC
CreateDIBSection
GdiFlush
CreateRectRgn
CombineRgn
DeleteObject

kernel32

HeapCreate
GetModuleFileNameA
HeapSize
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
IsProcessorFeaturePresent
SetFileAttributesW
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetConsoleMode
GetConsoleCP
GetSystemTimeAsFileTime
ExitThread
DeleteFileA
HeapReAlloc
HeapAlloc
HeapFree
HeapSetInformation
GetCommandLineA
EncodePointer
DecodePointer
RtlUnwind
RaiseException
VirtualAlloc
VirtualFree
GetProcessHeap
GetCPInfo
SetEnvironmentVariableA
LCMapStringW
IsValidCodePage
GetOEMCP
InterlockedExchange
GetACP
SetHandleCount
CloseHandle
GetLastError
CreateMutexW
GetProcAddress
LoadLibraryA
FreeLibrary
OpenProcess
GetFileAttributesA
QueryDosDeviceW
GetLogicalDriveStringsW
GetVolumeInformationW
GetLongPathNameW
GetDriveTypeW
lstrcmpW
GetConsoleWindow
GetModuleHandleA
ExitProcess
LoadLibraryW
WaitForMultipleObjects
CreateEventW
SetHandleInformation
CompareStringW
GetUserDefaultLCID
GetCurrentProcessId
LocalFree
GetCommandLineW
GetLocalTime
GetSystemTime
OutputDebugStringW
TlsFree
TlsSetValue
GetCurrentThreadId
GetSystemInfo
SwitchToThread
Sleep
SetThreadPriority
GetCurrentThread
TlsAlloc
TerminateThread
WaitForSingleObject
TlsGetValue
ResumeThread
GetThreadPriority
SetEvent
CreateThread
DuplicateHandle
GetCurrentProcess
VerifyVersionInfoW
VerSetConditionMask
GetVersionExW
FormatMessageW
QueryPerformanceFrequency
GetModuleHandleW
GetTickCount
QueryPerformanceCounter
GetSystemDirectoryW
ResetEvent
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileInformationByHandle
SetErrorMode
FindClose
FindFirstFileW
CreateFileW
CreateDirectoryW
RemoveDirectoryW
GetFileAttributesW
CopyFileW
MoveFileW
DeleteFileW
DeviceIoControl
GetFullPathNameW
GetTempPathW
GetCurrentDirectoryW
GetLogicalDrives
GetFileAttributesExW
FlushFileBuffers
GetFileType
SetFilePointerEx
ReadFile
WriteFile
MoveFileExW
SetEndOfFile
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
GetStartupInfoW
GetModuleFileNameW
ConnectNamedPipe
CreateNamedPipeW
GetStdHandle
TerminateProcess
GetExitCodeProcess
SetFilePointer
CreateProcessW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrencyFormatW
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetUserDefaultUILanguage
MultiByteToWideChar
WideCharToMultiByte
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
FindNextFileW
FindFirstFileExW
GetGeoInfoW
GetUserGeoID
GetTimeZoneInformation
CancelIo
PeekNamedPipe
GetOverlappedResult
PostQueuedCompletionStatus
CreateIoCompletionPort
CreateSemaphoreW
ReleaseMutex
ReleaseSemaphore
GetQueuedCompletionStatus
IsValidLocale
IsValidLanguageGroup
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetUserDefaultLangID
ExpandEnvironmentStringsW
WriteConsoleW
InterlockedIncrement
InterlockedDecrement
CreateFileA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetStringTypeW
EnumSystemLocalesA
GetLocaleInfoA
CheckRemoteDebuggerPresent

user32

ToUnicode
GetKeyState
TrackPopupMenuEx
SetMenuItemInfoW
IsZoomed
MapVirtualKeyW
GetKeyboardState
GetMenu
ToAscii
LoadIconW
SetCaretPos
RegisterWindowMessageW
DestroyCaret
HideCaret
CreateCaret
ChangeClipboardChain
GetClipboardFormatNameW
DestroyCursor
GetAsyncKeyState
GetIconInfo
LoadCursorW
NotifyWinEvent
GetMonitorInfoW
EnumDisplayMonitors
TrackMouseEvent
GetMessageExtraInfo
GetCursorInfo
SetCursorPos
CreateIconIndirect
CreateCursor
GetCursor
GetWindowTextW
RealGetWindowClassW
RegisterClipboardFormatW
IsIconic
SetWindowPlacement
MoveWindow
SetParent
GetUpdateRect
SetClipboardViewer
BeginPaint
GetDC
ReleaseDC
GetSystemMenu
EnableMenuItem
GetSysColor
SystemParametersInfoW
GetSystemMetrics
DestroyWindow
DefWindowProcW
SetWindowRgn
MessageBoxW
UnregisterClassW
SetTimer
KillTimer
PeekMessageW
UnhookWindowsHookEx
CallNextHookEx
PostMessageW
GetQueueStatus
EndPaint
SetCapture
SetForegroundWindow
SetFocus
SetWindowTextW
AdjustWindowRectEx
GetWindowPlacement
GetWindowRect
ShowWindow
SetWindowPos
InvalidateRect
SendMessageW
FlashWindowEx
SetCursor
ReleaseCapture
GetForegroundWindow
IsChild
IsWindowVisible
SetWindowsHookExW
GetWindowLongW
RegisterClassW
SetWindowLongW
CreateWindowExW
DispatchMessageW
TranslateMessage
MsgWaitForMultipleObjectsEx
GetWindowThreadProcessId
PostThreadMessageW
EnumWindows
CharNextExA
MessageBeep
GetDoubleClickTime
GetCaretBlinkTime
ScreenToClient
GetClientRect
GetKeyboardLayoutList
GetParent
ChildWindowFromPointEx
GetFocus
GetCursorPos
ClientToScreen
RegisterClassExW
LoadImageW
GetClassInfoW
GetSysColorBrush
GetCapture
DestroyIcon
GetDesktopWindow
GetAncestor
DrawIconEx

shell32

SHGetMalloc
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
CommandLineToArgvW
SHGetSpecialFolderPathW
SHBrowseForFolderW

ole32

DoDragDrop
OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
OleGetClipboard
ReleaseStgMedium
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleUninitialize
OleInitialize
CoCreateGuid
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoGetMalloc

advapi32

RegOpenKeyExW
RegCloseKey
FreeSid
CopySid
GetLengthSid
GetTokenInformation
OpenProcessToken
RegCreateKeyExW
RegFlushKey
RegEnumKeyExW
RegSetValueExW
RegDeleteValueW
RegQueryValueExW
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumValueW

ws2_32

gethostbyaddr
gethostbyname
WSASendTo
ntohl
bind
WSAConnect
getsockname
getpeername
WSAHtons
WSAHtonl
WSANtohs
WSANtohl
WSASend
inet_addr
closesocket
select
__WSAFDIsSet
WSARecv
WSARecvFrom
WSAAccept
listen
setsockopt
WSAIoctl
WSACleanup
WSAStartup
WSAGetLastError
getsockopt
htonl
WSAAsyncSelect
WSASocketW

Exports

Exports

z_adler32
z_adler32_combine
z_adler32_combine64
z_compress
z_compress2
z_compressBound
z_crc32
z_crc32_combine
z_crc32_combine64
z_deflate
z_deflateBound
z_deflateCopy
z_deflateEnd
z_deflateInit2_
z_deflateInit_
z_deflateParams
z_deflatePrime
z_deflateReset
z_deflateSetDictionary
z_deflateSetHeader
z_deflateTune
z_get_crc_table
z_inflate
z_inflateCopy
z_inflateEnd
z_inflateGetHeader
z_inflateInit2_
z_inflateInit_
z_inflateMark
z_inflatePrime
z_inflateReset
z_inflateReset2
z_inflateSetDictionary
z_inflateSync
z_inflateSyncPoint
z_inflateUndermine
z_uncompress
z_zError
z_zlibCompileFlags
z_zlibVersion

Sections

.text
Size: 7.5MB - Virtual size: 7.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 85KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 312KB - Virtual size: 312KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

�:��u�
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6bc9478298c95bfc3ecf3405730e66c6

Headers

DLL Characteristics

File Characteristics

Imports

psapi

oleaut32

imm32

winmm

opengl32

gdi32

kernel32

user32

shell32

ole32

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 7.5MB - Virtual size: 7.5MB

.rdata Size: 3.6MB - Virtual size: 3.6MB

.data Size: 85KB - Virtual size: 160KB

.qtmetad Size: 3KB - Virtual size: 3KB

.rsrc Size: 32KB - Virtual size: 32KB

.reloc Size: 312KB - Virtual size: 312KB

�:��u� Size: 16KB - Virtual size: 20KB

.text
Size: 7.5MB - Virtual size: 7.5MB

.rdata
Size: 3.6MB - Virtual size: 3.6MB

.data
Size: 85KB - Virtual size: 160KB

.qtmetad
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 32KB - Virtual size: 32KB

.reloc
Size: 312KB - Virtual size: 312KB

�:��u�
Size: 16KB - Virtual size: 20KB