2024-03-19_e3a2a3873a6d56105f2341668a79cdf2_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-03-19_e3a2a3873a6d56105f2341668a79cdf2_mafia
Size

223KB
MD5

e3a2a3873a6d56105f2341668a79cdf2
SHA1

e6ec67bef30d2991686fbc7097f31332cf40ec9c
SHA256

bea329de6a2cd32b633062f68af14b657f0336d0f9fb2246348c5a5b73b596a5
SHA512

ef8a18797ed1b0b7bb1200b17737c593f7762dee49a343e4ef41d9bc8ad8501f1895724b609efc16c4db5fa7ab3988eca353b8f7d67d78d4e0408aaf5b74072f
SSDEEP

3072:x1vKB9I1lcxTB6ZuCQlXT9cvhcX2LONgGwZLxxB2rJoIhgGsYrlyl24Cp+L:HvKB9hTkXQlX8cXYGY/B2rrXsYrrd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-19_e3a2a3873a6d56105f2341668a79cdf2_mafia

Files

2024-03-19_e3a2a3873a6d56105f2341668a79cdf2_mafia
.exe windows:5 windows x86 arch:x86

e1c86eda041580c9bd6a0515bb8afd20

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

focuswatch

_WatchFocusChanges@8
_StopWatchingFocusChanges@0

comctl32

ord17
ImageList_Create
ImageList_Add

shlwapi

PathFileExistsA

version

VerQueryValueA

rpcrt4

UuidToStringA
RpcStringFreeA

kernel32

GlobalDeleteAtom
GlobalAddAtomA
Sleep
GetUserDefaultLangID
LockResource
LoadResource
FindResourceA
GlobalUnlock
GlobalLock
GlobalAlloc
LocalFree
WideCharToMultiByte
SetEnvironmentVariableA
CompareStringW
CreateFileW
GetProcessHeap
SetEndOfFile
WriteConsoleW
FlushFileBuffers
SetStdHandle
CreateFileA
HeapReAlloc
GetConsoleMode
GetConsoleCP
GetStringTypeW
LoadLibraryW
CloseHandle
GetModuleFileNameA
ReadFile
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DeleteCriticalSection
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
GetTimeZoneInformation
IsProcessorFeaturePresent
LeaveCriticalSection
EnterCriticalSection
LCMapStringW
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleW
GetProcAddress
GetCurrentProcess
TerminateProcess
lstrlenA
SetFilePointer
MultiByteToWideChar
GetLastError
InterlockedDecrement
InterlockedIncrement
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapCreate
GetStartupInfoW
HeapSetInformation
GetCommandLineA
DecodePointer
EncodePointer
GetDateFormatA
GetTimeFormatA
GetSystemTimeAsFileTime
RaiseException
HeapFree
RtlUnwind
HeapAlloc

user32

GetDlgItemTextA
SetWindowLongA
SetDlgItemTextA
GetDlgItem
EndDialog
DialogBoxParamA
LoadCursorA
SetCursor
LoadIconA
LoadStringA
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
RegisterClassExA
PostQuitMessage
DefWindowProcA
SetMenuItemInfoA
DestroyWindow
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
CreateWindowExA
LoadBitmapA
UpdateWindow
GetWindowRect
GetWindowTextA
keybd_event
PeekMessageA
TranslateMessage
DispatchMessageA
IsDlgButtonChecked
GetClientRect
FindWindowA
GetLastActivePopup
ShowWindow
GetParent
GetCursorPos
ScreenToClient
LoadMenuA
GetSubMenu
EnableMenuItem
SetForegroundWindow
TrackPopupMenu
DestroyMenu
RegisterHotKey
GetKeyNameTextA
UnregisterHotKey
MapVirtualKeyA
CreateMenu
AppendMenuA
MessageBoxA
SetFocus
CallWindowProcA
GetWindowLongA
LoadImageA
DestroyIcon
SetWindowPos
SendDlgItemMessageA
CheckDlgButton
SendMessageA

gdi32

DeleteObject
CreateFontA

comdlg32

GetOpenFileNameA

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegFlushKey

shell32

Shell_NotifyIconA
ShellExecuteA

ole32

OleRun
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
CoInitialize
CoCreateGuid
CoUninitialize

oleaut32

SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysStringLen
SysFreeString
VariantInit
VariantCopy
VariantChangeType
VariantClear
GetErrorInfo

Sections

.text
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e1c86eda041580c9bd6a0515bb8afd20

Headers

DLL Characteristics

File Characteristics

Imports

focuswatch

comctl32

shlwapi

version

rpcrt4

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 147KB - Virtual size: 147KB

.rdata Size: 26KB - Virtual size: 25KB

.data Size: 5KB - Virtual size: 13KB

.rsrc Size: 32KB - Virtual size: 31KB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 147KB - Virtual size: 147KB

.rdata
Size: 26KB - Virtual size: 25KB

.data
Size: 5KB - Virtual size: 13KB

.rsrc
Size: 32KB - Virtual size: 31KB

.reloc
Size: 11KB - Virtual size: 11KB