2024-04-11_5ca38bbb3f2ce0a450a7661f2af2a4d4_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-11_5ca38bbb3f2ce0a450a7661f2af2a4d4_mafia
Size

2.4MB
MD5

5ca38bbb3f2ce0a450a7661f2af2a4d4
SHA1

e5ce3bda5b690ae4a9881d94abb1d47555f88333
SHA256

8bd14a0fb16a814c354b05dbc8a73acc4741987c25f1ec3c778ea53bd06b47e0
SHA512

5f27e007264bd237929874dee534b6d6a4263882946d60b5060e3641fd819520f98c7d1de5ed79a5cbfb44a33b36b502e840ff43eb9e9a34b2f572196558087d
SSDEEP

49152:bMQ9btNa4JvIADQ5SPucaCugKVZphbW+OKzjFGnpQBa+upns31c5iL/jXnHKb6oq:QQDNa4JvtQLcaCuvVZbbW+OKzwpnsFGh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-11_5ca38bbb3f2ce0a450a7661f2af2a4d4_mafia

Files

2024-04-11_5ca38bbb3f2ce0a450a7661f2af2a4d4_mafia
.exe windows:5 windows x86 arch:x86

370800f653d1a9e8a490f19c6770e6f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\phe3\msip-win\Release\MSIPMonitor.pdb

Imports

kernel32

GetDriveTypeW
GetFullPathNameA
EnumSystemLocalesA
GetDriveTypeA
GetFileInformationByHandle
GetDateFormatA
GetTimeFormatA
ExpandEnvironmentStringsA
LoadLibraryA
PeekNamedPipe
GetProcessHeap
SleepEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
ReleaseSemaphore
CreateSemaphoreW
WaitForMultipleObjects
GetExitCodeThread
CreateFileA
GetModuleFileNameA
IsValidLocale
SetEnvironmentVariableA
FormatMessageA
GetLocaleInfoA
WriteConsoleW
LCMapStringW
GetTimeZoneInformation
GetStringTypeW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetConsoleMode
GetConsoleCP
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
HeapCreate
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
SetUnhandledExceptionFilter
GetFileType
SetStdHandle
GetSystemTimeAsFileTime
HeapSize
HeapQueryInformation
CreateThread
ExitThread
VirtualQuery
GetSystemInfo
VirtualAlloc
ExitProcess
HeapReAlloc
RaiseException
RtlUnwind
HeapAlloc
HeapFree
DecodePointer
EncodePointer
GetStartupInfoW
HeapSetInformation
GetCommandLineW
FindResourceExW
GetUserDefaultLCID
VirtualProtect
SetErrorMode
SearchPathW
Sleep
GetProfileIntW
GetTickCount
InitializeCriticalSectionAndSpinCount
GetNumberFormatW
GetWindowsDirectoryW
GetTempPathW
GetTempFileNameW
GetFileTime
GetFileSizeEx
GetFileAttributesW
FileTimeToLocalFileTime
GetFileAttributesExW
GetFullPathNameW
GetVolumeInformationW
FindFirstFileW
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileW
lstrcmpiW
DeleteFileW
GetCurrentDirectoryW
GlobalFlags
FileTimeToSystemTime
GetThreadLocale
lstrlenA
GlobalGetAtomNameW
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
InterlockedIncrement
lstrcpyW
CreateEventW
SetEvent
WaitForSingleObject
ResumeThread
SetThreadPriority
CloseHandle
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
lstrcmpA
GetCurrentThread
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoW
InterlockedExchange
InterlockedDecrement
ReleaseActCtx
CreateActCtxW
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetVersionExW
GetModuleHandleW
FreeLibrary
GetProcAddress
CompareStringW
LoadLibraryW
lstrcmpW
GetCurrentThreadId
GetCurrentProcessId
GetModuleFileNameW
SizeofResource
ActivateActCtx
DeactivateActCtx
FreeResource
MultiByteToWideChar
WideCharToMultiByte
SetLastError
GlobalFree
CopyFileW
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageW
LocalFree
lstrlenW
MulDiv
GetLastError
CreateMutexW
FindResourceW
LoadResource
LockResource
FindFirstFileExA

user32

GetAsyncKeyState
NotifyWinEvent
MessageBeep
ReleaseCapture
WindowFromPoint
SetCapture
RedrawWindow
GetSystemMenu
DeleteMenu
OffsetRect
RealChildWindowFromPoint
GetSysColorBrush
LoadCursorW
SetLayeredWindowAttributes
EnumDisplayMonitors
SetRectEmpty
IntersectRect
InflateRect
ShowOwnedPopups
SetCursor
GetMessageW
TranslateMessage
ValidateRect
SetWindowContextHelpId
MapDialogRect
WaitMessage
PostQuitMessage
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
CheckMenuItem
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongW
GetForegroundWindow
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
GetMessageTime
GetMessagePos
PeekMessageW
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
TrackPopupMenu
IsZoomed
SetMenu
SetScrollRange
GetScrollRange
ShowScrollBar
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
DrawFrameControl
SetWindowLongW
SetWindowPos
GetWindowTextLengthW
GetWindowTextW
GetScrollPos
SetScrollPos
SetFocus
DrawFocusRect
ToUnicodeEx
MapVirtualKeyW
SetWindowsHookExW
UnhookWindowsHookEx
EnableWindow
CopyRect
SendMessageW
GetClientRect
LoadBitmapW
CallNextHookEx
GetFocus
GetSysColor
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetWindowThreadProcessId
GetLastActivePopup
MessageBoxW
GetActiveWindow
CharUpperW
IsRectEmpty
UnionRect
EnableScrollBar
UpdateLayeredWindow
MonitorFromPoint
IsMenu
CreatePopupMenu
GetMenuItemInfoW
GetMenuDefaultItem
UnregisterClassW
CharNextW
CopyAcceleratorTableW
SetRect
InvalidateRgn
GetNextDlgGroupItem
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
GetMenuState
GetMenuStringW
AppendMenuW
DestroyIcon
SetParent
DestroyAcceleratorTable
SetClassLongW
DrawIconEx
GetKeyState
DrawEdge
InvalidateRect
PostMessageW
SystemParametersInfoW
GetWindowRect
IsIconic
GetSystemMetrics
DrawIcon
GetDC
SetWindowRgn
ReleaseDC
SetTimer
KillTimer
GetCursorPos
PtInRect
LoadIconW
PostThreadMessageW
GetDesktopWindow
LoadMenuW
GetSubMenu
SetForegroundWindow
TrackPopupMenuEx
DestroyMenu
SetMenuDefaultItem
ModifyMenuW
GetMenuItemCount
EnableMenuItem
GetParent
ScreenToClient
GetPropW
SetPropW
RemovePropW
GetTopWindow
IsWindowVisible
GetWindow
DrawStateW
FillRect
UpdateWindow
GetClassNameW
RemoveMenu
InsertMenuW
GetMenuItemID
GetKeyboardLayout
GetKeyboardState
LoadAcceleratorsW
CreateAcceleratorTableW
SetCursorPos
BringWindowToTop
LockWindowUpdate
InvertRect
HideCaret
GetIconInfo
CopyImage
LoadImageW
OpenClipboard
SetClipboardData
CloseClipboard
EmptyClipboard
RegisterClipboardFormatW
FrameRect
TranslateAcceleratorW
InsertMenuItemW
ReuseDDElParam
UnpackDDElParam
CopyIcon
CharUpperBuffW
GetWindowRgn
DestroyCursor
SubtractRect
MapVirtualKeyExW
GetKeyNameTextW
IsCharLowerW
GetDoubleClickTime
GetUpdateRect
IsClipboardFormatAvailable
CreateMenu
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
GetMenu

gdi32

PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
CreateBitmap
SelectPalette
GetObjectType
CreatePen
CreateHatchBrush
CreateFontIndirectW
CreateRectRgnIndirect
SetRectRgn
CombineRgn
GetMapMode
PatBlt
DPtoLP
CreateDIBitmap
GetTextMetricsW
EnumFontFamiliesW
GetTextCharsetInfo
GetTextExtentPoint32W
CreateDIBSection
GetBkColor
GetTextColor
CreatePolygonRgn
CreateEllipticRgn
Polyline
GetWindowExtEx
Polygon
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
OffsetRgn
SetDIBColorTable
SetPixel
Rectangle
EnumFontFamiliesExW
ExtFloodFill
SetPaletteEntries
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
GetTextFaceW
SetPixelV
GetRgnBox
GetPixel
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetTextColor
SetROP2
SetPolyFillMode
SetBkMode
GetViewportExtEx
CreateRectRgn
SelectClipRgn
SetLayout
GetLayout
Ellipse
CreateCompatibleDC
SetBkColor
RestoreDC
SaveDC
CreateDCW
CopyMetaFileW
GetDeviceCaps
GetStockObject
CreateSolidBrush
DeleteObject
StretchBlt
CreateRoundRectRgn
GetObjectW
BitBlt
SelectObject
CreateCompatibleBitmap

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

CloseServiceHandle
StartServiceA
ControlService
OpenServiceA
OpenSCManagerA
RegCreateKeyExA
RegSetValueExA
QueryServiceStatus
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

shell32

DragFinish
Shell_NotifyIconW
SHGetFileInfoW
SHGetDesktopFolder
SHBrowseForFolderW
DragQueryFileW
ShellExecuteA
SHAppBarMessage
ShellExecuteW
SHGetSpecialFolderLocation
SHGetPathFromIDListW

comctl32

ImageList_GetIconSize
InitCommonControlsEx
_TrackMouseEvent

shlwapi

PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathFindExtensionW
PathRemoveFileSpecW

ole32

OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleGetClipboard
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
CoRevokeClassObject
CoRegisterMessageFilter
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
DoDragDrop
OleFlushClipboard
OleIsCurrentClipboard
CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoInitialize
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateGuid

oleaut32

SysFreeString
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrFromDate
OleCreateFontIndirect
SysAllocStringLen
VariantClear
VariantInit
VariantChangeType
SysAllocString
SysStringLen

oledlg

OleUIBusyW

gdiplus

GdipGetImageGraphicsContext
GdipDrawImageI
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipBitmapUnlockBits
GdipFree

wsock32

ntohs
WSAStartup
WSACleanup
closesocket
htons
ioctlsocket
accept
socket
select
bind
WSAGetLastError
getsockname
getpeername
WSASetLastError
connect
sendto
recvfrom
send
recv

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundW

ws2_32

__WSAFDIsSet
listen
freeaddrinfo
getsockopt
getaddrinfo
getprotobyname
setsockopt
ioctlsocket
gethostname

wldap32

ord143
ord60
ord50
ord26
ord30
ord32
ord35
ord79
ord200
ord33
ord211
ord27
ord41
ord46
ord301
ord22

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 344KB - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 325KB - Virtual size: 325KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 190KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

370800f653d1a9e8a490f19c6770e6f8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

gdiplus

wsock32

oleacc

imm32

winmm

ws2_32

wldap32

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 344KB - Virtual size: 344KB

.data Size: 29KB - Virtual size: 60KB

.rsrc Size: 325KB - Virtual size: 325KB

.reloc Size: 190KB - Virtual size: 190KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 344KB - Virtual size: 344KB

.data
Size: 29KB - Virtual size: 60KB

.rsrc
Size: 325KB - Virtual size: 325KB

.reloc
Size: 190KB - Virtual size: 190KB