2024-03-06_6e5111687c0ccf99926d3e33a13dd85c_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-03-06_6e5111687c0ccf99926d3e33a13dd85c_mafia
Size

2.7MB
MD5

6e5111687c0ccf99926d3e33a13dd85c
SHA1

e2f5fe56e532259391007700caf2dd8aa6788078
SHA256

3c97254b55f56e6f1f17b2df20f6f25357866e81706e4c18b02b8d2f44276747
SHA512

99dfdef276aef0e01c15e40cda3170c88e21fe84ee96f4cf9bf21d0dedd405e94d42994104cf0301305ade93f5d468b690cccd59a181afd15bb145dca9eca5f1
SSDEEP

49152:ymDo/BBaF9LkpljC6s1ohWqZaJCaiSdjrzeP1ZukOp+hBzCqwmt012YcFCcJT4rD:ym8/zc6jCdohWQaSSdjrzeP1ZukOp+hn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-06_6e5111687c0ccf99926d3e33a13dd85c_mafia

Files

2024-03-06_6e5111687c0ccf99926d3e33a13dd85c_mafia
.exe windows:5 windows x86 arch:x86

10919a7a1000dfb6c4383cd6adf50a4b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

skinseu

SkinSE_TreeCtrl_SetDrawItemSubItemImage
SkinSE_TreeCtrl_SetDrawItemSubItemValue
SkinSE_ListCtrl_SetDrawItemEventItemValue
SkinSE_TreeCtrl_SetDrawItemSkin
SkinSE_Edit_SetBackgroundColor
SkinSE_ListCtrl_CreateItemProgressCtrl
SkinSE_ListCtrl_SetItemProgressRange
SkinSE_ListCtrl_SetDrawItemSubItemVisible
SkinSE_ListCtrl_SetDrawItemSkin
SkinSE_RefreshAllControls
SkinSE_ListCtrl_SetItemProgressPos
SkinSE_ListCtrl_SetItemProgressCtrlVisible
SkinSE_ListCtrl_SetDrawItemSubItemValue
SkinSE_Menu_EnableSkin
SkinSE_LoadSkinResourceFromFolder
SkinSE_DirectUI_SetSubItemPlayAnimate
SkinSE_Button_SetToolTipText
SkinSE_HeaderCtrl_SetDrawItemSkin
SkinSE_HeaderCtrl_SetDrawItemSubItemValue
SkinSE_ListBox_SetItemProgressRange
SkinSE_ListBox_SetBackTransparent
SkinSE_ListBox_SetItemProgressPos
SkinSE_ListBox_CreateItemProgressCtrl
SkinSE_ListBox_SetDrawItemSubItemImage
SkinSE_ListBox_SetDrawItemEventItemVisible
SkinSE_ListBox_SetDrawItemSubItemVisible
SkinSE_SubclassWindow
SkinSE_Init
SkinSE_Static_SetToolTipText
SkinSE_UnsubclassWindow
SkinSE_DirectUI_SetSubItemImage
SkinSE_SetLayoutWindowPos
SkinSE_ListBox_SetDrawItemSkin
SkinSE_ListBox_SetDrawItemEventItemValue
SkinSE_ListBox_SetDrawItemSubItemValue
SkinSE_DirectUI_SetSubItemVisible
SkinSE_DirectUI_SetSubItemValue
SkinSE_DirectUI_SetDrawItemSubItemValue

sensapi

IsNetworkAlive

shlwapi

PathFindFileNameW
UrlUnescapeW
PathRemoveFileSpecW
PathIsUNCW
PathStripToRootW
PathIsDirectoryW
PathFileExistsW
PathFindExtensionW

dbghelp

MakeSureDirectoryPathExists

iphlpapi

GetAdaptersInfo
GetExtendedTcpTable

winio

GetPortVal
InitializeWinIo

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

setupapi

CM_Get_Child_Ex
CM_Locate_DevNode_ExW
CM_Get_DevNode_Registry_Property_ExW
CM_Connect_MachineW
CM_Get_Sibling_Ex
CM_Disconnect_Machine

rpcrt4

UuidFromStringW

libcurl

curl_easy_setopt
curl_global_init
curl_easy_strerror
curl_easy_perform
curl_easy_init

gdiplus

GdipFree
GdipDeletePen
GdipDeleteBrush
GdipCreateLineBrushFromRectWithAngleI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromStream
GdiplusShutdown
GdipDeleteStringFormat
GdipCreatePen1
GdipCreatePath
GdipCreateStringFormat
GdipCloneImage
GdipFillPath
GdipSetSolidFillColor
GdipCreateFromHDC
GdipCreateFontFamilyFromName
GdipDrawString
GdipGetGenericFontFamilySansSerif
GdipCreateBitmapFromHBITMAP
GdipDeletePath
GdipCreateFont
GdipDisposeImage
GdipAlloc
GdipDrawImageI
GdipCreateSolidFill
GdipAddPathArcI
GdipDeleteFontFamily
GdipDrawEllipseI
GdipClosePathFigure
GdipSetSmoothingMode
GdipGraphicsClear
GdipSetStringFormatAlign
GdipGetImageGraphicsContext
GdipAddPathEllipseI
GdipGetDpiY
GdipDeleteGraphics
GdipCreateBitmapFromScan0
GdipDeleteFont
GdipDrawPath
GdipSetTextRenderingHint
GdipSetStringFormatLineAlign
GdipCloneBrush
GdipResetPath
GdipSetLineSigmaBlend
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectI
GdiplusStartup
GdipSetInterpolationMode

pdh

PdhAddCounterW
PdhGetFormattedCounterValue
PdhCollectQueryData
PdhCloseQuery
PdhGetRawCounterValue
PdhOpenQueryW

kernel32

CopyFileW
ReadFile
GetPrivateProfileStringW
GetProfileIntW
InterlockedDecrement
FormatMessageW
LocalAlloc
LocalFree
MulDiv
FreeResource
GetCommandLineW
GetModuleFileNameW
SetCurrentDirectoryW
GetVersionExW
LeaveCriticalSection
GlobalMemoryStatusEx
EnterCriticalSection
GetCurrentProcessId
GetProfileStringW
FreeLibrary
CreateProcessW
WaitForSingleObject
GetComputerNameW
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
LoadLibraryA
ProcessIdToSessionId
GetDiskFreeSpaceA
CreatePipe
DeleteCriticalSection
GetLocalTime
CreateFileMappingW
SetLocalTime
lstrcpyW
GetSystemTimeAsFileTime
GetVolumeInformationW
CreateEventA
SetEvent
FormatMessageA
OpenEventA
ResetEvent
InitializeCriticalSection
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
GetCurrentThreadId
GlobalSize
lstrcmpW
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
CreateActCtxW
ReleaseActCtx
GetThreadLocale
lstrcmpiW
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
FindClose
FindFirstFileW
GetFullPathNameW
SetThreadPriority
ResumeThread
SuspendThread
CreateEventW
FindNextFileW
FileTimeToLocalFileTime
CreateMutexW
ReleaseMutex
InterlockedIncrement
GlobalFlags
InterlockedExchange
GetLocaleInfoW
GetSystemDefaultUILanguage
ConvertDefaultLocale
GetUserDefaultUILanguage
GetCurrentThread
lstrcmpA
WritePrivateProfileStringW
GetFileAttributesExW
GetFileAttributesW
GetFileSizeEx
GetFileTime
GlobalGetAtomNameW
GlobalReAlloc
GlobalHandle
GetFileSize
SetErrorMode
GetCurrentDirectoryW
GetWindowsDirectoryW
GetNumberFormatW
GetTickCount
GetTempFileNameW
GetTempPathW
GetUserDefaultLCID
SearchPathW
VirtualProtect
FindResourceExW
HeapSetInformation
EncodePointer
DecodePointer
ExitThread
CreateThread
ExitProcess
DeleteFileA
GetDriveTypeA
FindFirstFileExA
FindNextFileA
GetTimeFormatW
GetDateFormatW
HeapReAlloc
GetTimeZoneInformation
RaiseException
RtlUnwind
HeapQueryInformation
HeapSize
SetStdHandle
GetFileType
VirtualAlloc
VirtualQuery
SetUnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapCreate
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
IsProcessorFeaturePresent
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
LCMapStringW
GetFullPathNameA
GetFileInformationByHandle
PeekNamedPipe
CreateFileA
WriteConsoleW
SetEnvironmentVariableA
Process32FirstW
GetLongPathNameW
OpenProcess
GetProcessHeap
GetLogicalDrives
HeapFree
GetCurrentProcess
HeapAlloc
GetDriveTypeW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
Sleep
GetProcAddress
SetLastError
GetLastError
DeactivateActCtx
LoadLibraryW
ActivateActCtx
GetModuleHandleW
DeleteFileW
CloseHandle
QueryPerformanceFrequency
GlobalFree
GlobalUnlock
CreateFileW
GlobalAlloc
WriteFile
GlobalLock
QueryPerformanceCounter
lstrlenW
WideCharToMultiByte
LockResource
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
lstrlenA
TerminateProcess
RemoveDirectoryW
GetDiskFreeSpaceExW
CreateToolhelp32Snapshot
Process32NextW
LocalReAlloc
GetSystemInfo
GetPrivateProfileIntW

user32

GetSysColorBrush
UnregisterClassW
IsClipboardFormatAvailable
MessageBeep
CopyAcceleratorTableW
EnumDisplayMonitors
SetLayeredWindowAttributes
DestroyIcon
GetNextDlgGroupItem
GetMenuDefaultItem
GetAsyncKeyState
InvertRect
DrawFocusRect
HideCaret
EnableScrollBar
NotifyWinEvent
GetIconInfo
CopyImage
DrawIconEx
TranslateAcceleratorW
BringWindowToTop
InsertMenuItemW
LoadAcceleratorsW
ReuseDDElParam
UnpackDDElParam
RegisterClipboardFormatW
SetWindowRgn
SetParent
DestroyAcceleratorTable
SetClassLongW
DrawStateW
DrawEdge
DrawFrameControl
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
CreateAcceleratorTableW
SetCursorPos
IsCharLowerW
MapVirtualKeyExW
UnionRect
UpdateLayeredWindow
MonitorFromPoint
IsMenu
DefFrameProcW
DefMDIChildProcW
DrawMenuBar
TranslateMDISysAccel
CreateMenu
FrameRect
GetUpdateRect
CopyIcon
CharUpperBuffW
GetDoubleClickTime
SubtractRect
DestroyCursor
GetWindowRgn
WindowFromPoint
WaitMessage
SetWindowContextHelpId
MapDialogRect
ShowOwnedPopups
PostQuitMessage
RealChildWindowFromPoint
OffsetRect
CharNextW
MapVirtualKeyW
DestroyMenu
GetMenuItemInfoW
TranslateMessage
ValidateRect
IntersectRect
CharUpperW
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
IsWindowEnabled
MoveWindow
SetWindowTextW
IsDialogMessageW
SetDlgItemTextW
CheckDlgButton
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
IsWindow
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
GetWindowLongW
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
CheckMenuItem
GetMenuState
GetMenuStringW
GetMenuItemID
InsertMenuW
GetMenuItemCount
RemoveMenu
SetScrollPos
ShowScrollBar
GetScrollPos
FillRect
wsprintfA
GetSysColor
RemovePropW
LockWorkStation
RegisterWindowMessageW
PostMessageW
IsZoomed
LockWindowUpdate
SystemParametersInfoW
PeekMessageW
SetWindowLongW
ShowWindow
SetMenuDefaultItem
PostThreadMessageW
SetWindowsHookExW
UnhookWindowsHookEx
CloseWindow
GetPropW
GetWindowThreadProcessId
EnumThreadWindows
GetLastActivePopup
SetForegroundWindow
FindWindowW
GetSystemMenu
DeleteMenu
LoadIconW
SetWindowPos
MessageBoxExW
AppendMenuW
EnableMenuItem
CreatePopupMenu
GetMessageW
SetCapture
SetRectEmpty
GetCapture
InflateRect
EqualRect
ReleaseCapture
UpdateWindow
CopyRect
DispatchMessageW
GetParent
GetWindow
GetFocus
ScreenToClient
GetKeyNameTextW
wsprintfW
EnableWindow
SendMessageW
GetSystemMetrics
GetClientRect
GetMessagePos
MessageBoxW
IsWindowVisible
LoadBitmapW
InvalidateRect
GetSubMenu
LoadMenuW
SetTimer
KillTimer
SetCursor
CloseClipboard
GetWindowRect
IsIconic
LoadImageW
InvalidateRgn
LoadCursorW
DrawIcon
PtInRect
GetDC
SetRect
ReleaseDC
EmptyClipboard
GetCursorPos
OpenClipboard
SetClipboardData
IsRectEmpty
RedrawWindow

gdi32

LineTo
MoveToEx
GetTextFaceW
SetTextAlign
GetLayout
SetLayout
SelectClipRgn
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
GetObjectType
CreateHatchBrush
CreateFontIndirectW
SetRectRgn
GetMapMode
DPtoLP
GetBkColor
GetTextColor
GetRgnBox
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
CreateDIBSection
CreateRoundRectRgn
CreatePolygonRgn
CreateEllipticRgn
Polyline
Ellipse
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetTextColor
SetROP2
SetPolyFillMode
Polygon
SetDIBColorTable
StretchBlt
SetPixel
OffsetRgn
EnumFontFamiliesExW
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPixelV
SetBkColor
SetBkMode
RestoreDC
SaveDC
CopyMetaFileW
CreateSolidBrush
PatBlt
CreateBitmap
UnrealizeObject
DeleteObject
CreatePatternBrush
CreatePen
BitBlt
GetTextMetricsW
DeleteDC
GetDeviceCaps
GetDIBits
CreatePalette
CreateDCW
SelectObject
CreateCompatibleDC
CreateRectRgnIndirect
CombineRgn
CreateCompatibleBitmap
Rectangle
RealizePalette
SelectPalette
GetObjectW
CreateRectRgn
GetPixel
GetStockObject
GetTextExtentPoint32W
SetPaletteEntries

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW
EnumPrintersW

advapi32

RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
LookupAccountSidW
RegEnumValueW
AllocateAndInitializeSid
RegDeleteValueW
RegOpenKeyW
EqualSid
RegCreateKeyExW
GetTokenInformation
AdjustTokenPrivileges
RegOpenKeyExA
LookupPrivilegeValueW
RegQueryValueExA
OpenProcessToken
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

SHGetDesktopFolder
Shell_NotifyIconW
SHGetSpecialFolderPathW
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
DragFinish
DragQueryFileW
SHBrowseForFolderW
SHAppBarMessage
SHGetFileInfoW

comctl32

InitCommonControlsEx
ImageList_GetIconSize

ole32

OleGetClipboard
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
DoDragDrop
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CoInitializeEx
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoCreateGuid
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CoCreateInstance
CreateStreamOnHGlobal
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoTaskMemFree
CoInitialize
CoUninitialize

oleaut32

VarBstrFromDate
SysAllocString
SysAllocStringLen
SysFreeString
OleLoadPicture
VariantClear
VariantChangeType
VariantInit
OleCreateFontIndirect
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen

oledlg

OleUIBusyW

wsock32

accept
connect
WSAStartup
ioctlsocket
htons
setsockopt
socket
inet_addr
ntohs
WSAGetLastError
shutdown
WSACleanup
recv
listen
send
__WSAFDIsSet
select
getpeername
inet_ntoa
WSASetLastError
bind
closesocket
getsockopt

psapi

GetProcessMemoryInfo
GetModuleFileNameExW
EnumProcessModules

ws2_32

freeaddrinfo
getnameinfo
getaddrinfo

libxml2

xmlStrcmp
xmlGetProp
xmlReadFile
xmlDocGetRootElement
xmlFreeDoc

iconv

libiconv_open
libiconv
libiconv_close

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

wininet

HttpOpenRequestW
InternetCanonicalizeUrlW
InternetSetOptionExW
InternetQueryDataAvailable
InternetConnectW
HttpQueryInfoW
InternetCloseHandle
InternetGetLastResponseInfoW
InternetOpenW
InternetSetStatusCallbackW
InternetSetFilePointer
InternetWriteFile
InternetReadFile
HttpSendRequestW
InternetCrackUrlW

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

winmm

PlaySoundW

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 451KB - Virtual size: 450KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 860KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 246KB - Virtual size: 246KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

10919a7a1000dfb6c4383cd6adf50a4b

Headers

DLL Characteristics

File Characteristics

Imports

skinseu

sensapi

shlwapi

dbghelp

iphlpapi

winio

version

setupapi

rpcrt4

libcurl

gdiplus

pdh

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ole32

oleaut32

oledlg

wsock32

psapi

ws2_32

libxml2

iconv

wtsapi32

oleacc

wininet

imm32

winmm

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 451KB - Virtual size: 450KB

.data Size: 33KB - Virtual size: 860KB

.rsrc Size: 57KB - Virtual size: 56KB

.reloc Size: 246KB - Virtual size: 246KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 451KB - Virtual size: 450KB

.data
Size: 33KB - Virtual size: 860KB

.rsrc
Size: 57KB - Virtual size: 56KB

.reloc
Size: 246KB - Virtual size: 246KB