2024-04-09_642983fc221b6acc7dfc2662b0d63b1c_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-04-09_642983fc221b6acc7dfc2662b0d63b1c_mafia
Size

24.5MB
MD5

642983fc221b6acc7dfc2662b0d63b1c
SHA1

a37d5af1e7767cf0527bbc14090c1f0809f8d1b3
SHA256

cbbc86e344d7b660dba5f9f4775abb6052ed19f7709f7ebd5a76f143bf67b136
SHA512

dc9c02273395b6f6530b2ed78ae36e743836ae354d225afb630b0dc9a68467c50ce698564381bc4f189cc6c9abbb977d29fdfc2a417651d31b83640d23440f0c
SSDEEP

393216:wHu49w9fd2fpGblhGGb5l4iDJsv6tWKFdu9C4N9E/BVeXt2vLyCXIF/ct8VIvyRd:wUbhGKlQvE20vLVI9aG6Kqmpy0UQd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-09_642983fc221b6acc7dfc2662b0d63b1c_mafia

Files

2024-04-09_642983fc221b6acc7dfc2662b0d63b1c_mafia
.exe windows:5 windows x86 arch:x86

ee85f276430af95b0e8eb2db59edf20e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

ExtTextOutW
GdiFlush
CombineRgn
CreateRectRgn
GetCharABCWidthsFloatW
GetTextExtentPoint32W
SetTextAlign
CreateBitmap
GetCharABCWidthsI
AddFontMemResourceEx
GetFontData
GetRegionData
GetGlyphOutlineW
OffsetRgn
CreateCompatibleBitmap
DeleteDC
GetDeviceCaps
GetCharABCWidthsW
GetObjectW
SelectClipRgn
GetStockObject
CreateCompatibleDC
SetBkMode
GetDIBits
AddFontResourceExW
CreateFontIndirectW
SetGraphicsMode
GetOutlineTextMetricsW
EnumFontFamiliesExW
GetTextFaceW
RemoveFontResourceExW
GetTextMetricsW
SelectObject
DeleteObject
BitBlt
SetWorldTransform
CreateDCW
SetTextColor
CreateDIBSection
RemoveFontMemResourceEx

oleaut32

SystemTimeToVariantTime
VariantChangeType
VariantInit
SysAllocStringLen
SysFreeString
SysStringLen
SysAllocString

imm32

ImmGetContext
ImmGetDefaultIMEWnd
ImmReleaseContext
ImmNotifyIME
ImmGetCompositionStringW
ImmSetCompositionWindow
ImmSetCandidateWindow

winmm

PlaySoundW

kernel32

WideCharToMultiByte
CreateFileW
GetUserDefaultUILanguage
GetCurrentProcessId
GetStartupInfoW
GetModuleFileNameA
UnmapViewOfFile
IsValidCodePage
SetEndOfFile
HeapSize
CopyFileW
LCMapStringW
GetLogicalDrives
GetLocaleInfoW
SetHandleCount
SetErrorMode
ResumeThread
InterlockedIncrement
HeapAlloc
CreateFileMappingW
IsDebuggerPresent
WriteFile
GetCurrentThread
OutputDebugStringW
GetFileAttributesExW
GetFullPathNameW
LoadLibraryA
MoveFileExW
GlobalSize
OutputDebugStringA
ExitThread
IsProcessorFeaturePresent
TlsAlloc
GetDateFormatW
GetDateFormatA
TerminateThread
SetUnhandledExceptionFilter
LoadLibraryW
GetStringTypeW
GetTimeZoneInformation
TerminateProcess
VerifyVersionInfoW
GetFileInformationByHandle
PeekNamedPipe
GetEnvironmentVariableA
VirtualFree
OpenProcess
FileTimeToSystemTime
SetThreadPriority
OpenFileMappingW
ReleaseMutex
GetStdHandle
EnumSystemLocalesA
GetModuleHandleW
GetFileSize
VirtualQuery
GetVersionExW
GetUserDefaultLangID
ExitProcess
MultiByteToWideChar
GetProcessHeap
FreeLibrary
GetCPInfo
FormatMessageW
FindFirstFileExW
EncodePointer
SleepEx
TlsFree
IsValidLocale
ReadFile
CloseHandle
LocalFree
DuplicateHandle
HeapReAlloc
WriteConsoleW
SetEnvironmentVariableA
FindNextFileW
TlsSetValue
SystemTimeToTzSpecificLocalTime
GetTimeFormatA
DeleteFileW
GetThreadPriority
FindClose
RemoveDirectoryW
GetSystemInfo
InitializeCriticalSectionAndSpinCount
GetConsoleCP
SetEvent
CreateMutexW
CreateThread
EnterCriticalSection
GetProcAddress
FileTimeToLocalFileTime
GetCurrentDirectoryW
CreateProcessW
GetFileType
FlushFileBuffers
GetSystemTimeAsFileTime
DeviceIoControl
GetDriveTypeW
InitializeCriticalSection
GetVolumeInformationW
TlsGetValue
GetModuleFileNameW
IsValidLanguageGroup
SetStdHandle
GetConsoleMode
LeaveCriticalSection
GetTickCount64
lstrcmpW
GetUserDefaultLCID
GetEnvironmentStringsW
DeleteFileA
CreateFileA
RtlUnwind
SetLastError
GetLocalTime
UnhandledExceptionFilter
HeapFree
GetCurrentProcess
GetCurrencyFormatW
GetLastError
GetFileSizeEx
GetLocaleInfoA
GetOEMCP
lstrlenA
MapViewOfFile
SetFileAttributesW
WaitForMultipleObjects
CreateDirectoryW
QueryPerformanceCounter
GetSystemDirectoryW
GetTickCount
HeapCreate
InterlockedDecrement
GetCommandLineA
WaitForSingleObject
CheckRemoteDebuggerPresent
FindFirstFileW
GetACP
CreateSemaphoreW
GetCommandLineW
GlobalLock
GetTimeFormatW
RaiseException
CreateEventW
ReleaseSemaphore
MoveFileW
SetFilePointer
GetFileAttributesW
GetCurrentThreadId
QueryPerformanceFrequency
Sleep
CompareStringW
GetLongPathNameW
ExpandEnvironmentStringsW
InterlockedExchange
GetSystemTime
DeleteCriticalSection
VerSetConditionMask
DecodePointer
FreeEnvironmentStringsW
GetModuleHandleA
GlobalUnlock
HeapSetInformation
SetFilePointerEx
GlobalAlloc
ResetEvent

user32

GetCaretBlinkTime
SetCaretPos
RegisterWindowMessageW
SetWindowPos
GetKeyState
HideCaret
GetWindowRect
SetMenuItemInfoW
GetDesktopWindow
DestroyWindow
GetSysColorBrush
NotifyWinEvent
TranslateMessage
RegisterClassW
SetFocus
GetMonitorInfoW
GetKeyboardState
GetDC
CreateCaret
SendMessageW
ClientToScreen
GetSystemMetrics
GetAsyncKeyState
LoadIconW
ChildWindowFromPointEx
PeekMessageW
EnumDisplayMonitors
MapVirtualKeyW
UnhookWindowsHookEx
ScreenToClient
GetParent
GetActiveWindow
GetMessageExtraInfo
SetCapture
GetFocus
TrackMouseEvent
GetMenu
MsgWaitForMultipleObjectsEx
ReleaseCapture
GetWindowLongW
ShowWindow
EnableMenuItem
IsChild
MessageBeep
SetClipboardViewer
TrackPopupMenuEx
GetUpdateRect
AdjustWindowRectEx
BeginPaint
CharNextExA
KillTimer
PostMessageW
CreateIconIndirect
GetQueueStatus
SetWindowLongW
SetWindowTextW
SetParent
InvalidateRect
RegisterClipboardFormatW
IsIconic
SetWindowsHookExW
GetKeyboardLayoutList
GetDoubleClickTime
SetCursorPos
GetClientRect
UnregisterClassW
GetClipboardFormatNameW
CallNextHookEx
IsWindowVisible
MoveWindow
DestroyCursor
DestroyCaret
DispatchMessageW
GetAncestor
CreateWindowExW
SetWindowRgn
GetCursorPos
DestroyIcon
DefWindowProcW
ToAscii
CreateCursor
ChangeClipboardChain
GetCapture
GetWindowPlacement
SetCursor
SystemParametersInfoW
ToUnicode
FlashWindowEx
SetTimer
GetWindowThreadProcessId
LoadImageW
GetSysColor
GetIconInfo
DrawIconEx
GetSystemMenu
EndPaint
GetClassInfoW
RegisterClassExW
SetForegroundWindow
IsZoomed
ReleaseDC

shell32

SHGetMalloc
SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW
SHGetFileInfoW

ole32

CoTaskMemFree
DoDragDrop
ReleaseStgMedium
CoTaskMemAlloc
RevokeDragDrop
OleIsCurrentClipboard
CoLockObjectExternal
CoInitialize
CoCreateGuid
RegisterDragDrop
OleInitialize
OleFlushClipboard
OleSetClipboard
OleGetClipboard
CoCreateInstance
OleUninitialize
CoGetMalloc
CoUninitialize

advapi32

GetTokenInformation
OpenProcessToken
FreeSid
RegOpenKeyExW
CryptEncrypt
RegEnumValueW
RegFlushKey
RegCloseKey
RegEnumKeyExW
CryptGetHashParam
CryptDestroyHash
RegDeleteValueW
RegQueryValueExW
CryptHashData
GetLengthSid
RegSetValueExW
RegDeleteKeyW
CryptCreateHash
RegCreateKeyExW
CryptGenRandom
CryptImportKey
CryptReleaseContext
RegQueryInfoKeyW
CryptDestroyKey
CopySid
CryptAcquireContextW

ws2_32

htons
getsockopt
getpeername
socket
connect
WSASetLastError
WSAEnumNetworkEvents
bind
accept
listen
htonl
sendto
recvfrom
select
__WSAFDIsSet
ioctlsocket
gethostname
ntohs
getsockname
setsockopt
WSAIoctl
recv
WSAWaitForMultipleEvents
WSACreateEvent
getaddrinfo
WSACloseEvent
freeaddrinfo
WSAResetEvent
WSAStartup
WSACleanup
WSAGetLastError
send
closesocket
WSAAsyncSelect
WSAEventSelect

crypt32

CertFindCertificateInStore
CertFindExtension
CryptQueryObject
CertEnumCertificatesInStore
CertFreeCertificateContext
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertOpenStore
CertCloseStore
CertCreateCertificateChainEngine
CryptStringToBinaryW
PFXImportCertStore
CertAddCertificateContextToStore
CryptDecodeObjectEx

wldap32

ord117
ord216
ord73
ord301
ord167
ord79
ord142
ord46
ord27
ord127
ord147
ord133
ord26
ord208
ord145
ord219
ord14
ord41

Exports

Exports

z_adler32
z_adler32_combine
z_adler32_combine64
z_compress
z_compress2
z_compressBound
z_crc32
z_crc32_combine
z_crc32_combine64
z_deflate
z_deflateBound
z_deflateCopy
z_deflateEnd
z_deflateInit2_
z_deflateInit_
z_deflateParams
z_deflatePrime
z_deflateReset
z_deflateSetDictionary
z_deflateSetHeader
z_deflateTune
z_get_crc_table
z_inflate
z_inflateCopy
z_inflateEnd
z_inflateGetHeader
z_inflateInit2_
z_inflateInit_
z_inflateMark
z_inflatePrime
z_inflateReset
z_inflateReset2
z_inflateSetDictionary
z_inflateSync
z_inflateSyncPoint
z_inflateUndermine
z_uncompress
z_zError
z_zlibCompileFlags
z_zlibVersion

Sections

.text
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 240KB - Virtual size: 239KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ee85f276430af95b0e8eb2db59edf20e

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

oleaut32

imm32

winmm

kernel32

user32

shell32

ole32

advapi32

ws2_32

crypt32

wldap32

Exports

Exports

Sections

.text Size: 6.0MB - Virtual size: 6.0MB

.rdata Size: 2.2MB - Virtual size: 2.2MB

.data Size: 49KB - Virtual size: 62KB

.qtmetad Size: 512B - Virtual size: 272B

.rsrc Size: 67KB - Virtual size: 67KB

.reloc Size: 240KB - Virtual size: 239KB

.text
Size: 6.0MB - Virtual size: 6.0MB

.rdata
Size: 2.2MB - Virtual size: 2.2MB

.data
Size: 49KB - Virtual size: 62KB

.qtmetad
Size: 512B - Virtual size: 272B

.rsrc
Size: 67KB - Virtual size: 67KB

.reloc
Size: 240KB - Virtual size: 239KB