2024-04-16_7057a259a012b9d70cd8d9fc3186998f_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-16_7057a259a012b9d70cd8d9fc3186998f_mafia
Size

1.8MB
MD5

7057a259a012b9d70cd8d9fc3186998f
SHA1

fc51c85138790ebc978f1cdac3069d87285f598d
SHA256

5b588bd654ec02a48e9a31e46fd41c6e4029526da480b448709d53feed2e7b19
SHA512

060e2b2feb92d241951f5f2ed6e79c56067fd4541678e629f15a5ecea7d4cc70d17e0b0da8bccf21c19cc176b9b06fba522ff66f4e09386e5d6778a8a26a5cbb
SSDEEP

49152:QkkNbVWBEiypnFHExcRIi65igJy/7V3QWm6mbYn+hp:QkvypFFIi5ySO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-16_7057a259a012b9d70cd8d9fc3186998f_mafia

Files

2024-04-16_7057a259a012b9d70cd8d9fc3186998f_mafia
.exe windows:5 windows x86 arch:x86

cfbf020a04a46068dbbe4ee36d037c81

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\kkowalczyk\src\sumatrapdf-1.7\obj-rel\SumatraPDF-no-MuPDF.pdb

Imports

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
SetFileSecurityA
SetFileSecurityW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegQueryValueExA
RegOpenKeyExA

kernel32

InterlockedIncrement
InterlockedDecrement
GlobalLock
GetProfileStringW
GetPrivateProfileStringW
FormatMessageW
GetFileAttributesW
MulDiv
GlobalUnlock
GetPrivateProfileIntW
GetLastError
GlobalFree
LocalFree
SetFileAttributesW
GetUserDefaultUILanguage
ReadDirectoryChangesW
GetOverlappedResult
ResetEvent
WaitForMultipleObjects
GlobalDeleteAtom
GlobalAddAtomW
GetTickCount
Sleep
QueryPerformanceCounter
SetThreadExecutionState
QueryPerformanceFrequency
GetSystemTime
GetLogicalDrives
GetModuleFileNameW
GetTempFileNameW
GetExitCodeProcess
GetTempPathW
GetShortPathNameW
GetDriveTypeW
CreateDirectoryW
WriteFile
ReadFile
GetFileSizeEx
GetLongPathNameW
GetFileTime
GetFileAttributesExW
DeleteFileW
GetFileInformationByHandle
WideCharToMultiByte
MultiByteToWideChar
AllocConsole
CreateProcessW
SetConsoleScreenBufferSize
GlobalAlloc
GetSystemDirectoryW
LoadLibraryW
GetStdHandle
GetConsoleScreenBufferInfo
GetVersion
CreateFileA
SetFilePointer
SetFileTime
MoveFileW
FlushFileBuffers
SetEndOfFile
GetFileType
CreateDirectoryA
GetModuleHandleW
GetFileAttributesA
SetFileAttributesA
DeviceIoControl
FindNextFileA
FindFirstFileA
GetFullPathNameA
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
IsDBCSLeadByte
GetCPInfo
InterlockedExchange
CreateEventA
InterlockedCompareExchange
DeleteFileA
GetTimeZoneInformation
GetProcessHeap
CreateProcessA
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetConsoleMode
GetConsoleCP
SetHandleCount
GetCurrentDirectoryW
PeekNamedPipe
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
HeapSize
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
GetCommandLineA
SetCurrentDirectoryA
GetCurrentDirectoryA
SetEnvironmentVariableA
DuplicateHandle
WriteConsoleW
MoveFileA
RaiseException
ExitProcess
RtlUnwind
InitializeCriticalSectionAndSpinCount
SetStdHandle
HeapReAlloc
FindFirstFileExW
HeapAlloc
EncodePointer
DecodePointer
HeapFree
SystemTimeToFileTime
GetSystemTimeAsFileTime
GetLocaleInfoW
GetEnvironmentVariableW
GetThreadContext
GetLocaleInfoA
VirtualQuery
SetUnhandledExceptionFilter
CompareStringW
GetCurrentProcess
WaitForSingleObject
SetEvent
GetCurrentThread
FormatMessageA
Thread32First
GetVersionExW
TerminateProcess
Thread32Next
CreateFileW
GetProcAddress
OpenThread
GlobalMemoryStatusEx
CreateEventW
Module32FirstW
GetSystemInfo
GetModuleFileNameA
GetModuleHandleA
CreateToolhelp32Snapshot
GetCurrentThreadId
Module32NextW
CloseHandle
GetCurrentProcessId
SuspendThread
ResumeThread
CreateThread
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
lstrcpyW
FindFirstFileW
FindClose
FindNextFileW
FindResourceW
LoadResource
SizeofResource
LockResource
GetDateFormatW
GetTimeFormatW
GetFullPathNameW
GetCommandLineW
CopyFileExW
SetErrorMode

user32

OemToCharA
CharUpperW
CharToOemA
CharLowerA
CharUpperA
HideCaret
GetMessageW
PostQuitMessage
TrackPopupMenu
GetWindowDC
ShowWindowAsync
IsIconic
GetMenuItemID
LoadImageW
SetCapture
PostMessageW
KillTimer
IsZoomed
GetKeyState
SetForegroundWindow
CopyImage
GetFocus
GetParent
TrackMouseEvent
LoadCursorW
MessageBeep
SetParent
CreateMenu
ModifyMenuW
ShowCaret
IsCharUpperW
GetCapture
TranslateMessage
LoadAcceleratorsW
GetForegroundWindow
RegisterClassExW
LoadIconW
CheckMenuRadioItem
GetScrollInfo
InvalidateRect
AppendMenuW
SystemParametersInfoW
SetClassLongW
EnableMenuItem
EmptyClipboard
MonitorFromWindow
RedrawWindow
GetSysColor
SetWindowPos
GetDesktopWindow
DdeInitializeW
DdeCreateStringHandleW
DdeFreeStringHandle
DdeUninitialize
DdeCreateDataHandle
DdeClientTransaction
DdeConnect
DdeDisconnect
DdeFreeDataHandle
FindWindowW
SetMenu
ReuseDDElParam
CharToOemBuffW
UnpackDDElParam
GetSystemMetrics
MessageBoxW
wsprintfA
ReleaseDC
GetDC
FillRect
IsCharAlphaNumericW
CharLowerW
MoveWindow
DefWindowProcW
SendMessageW
CreateWindowExW
ShowWindow
GetCursorPos
BeginPaint
GetClientRect
DrawTextW
SetActiveWindow
GetWindowRect
ScreenToClient
SetCursor
DestroyWindow
EndPaint
EnableWindow
MapWindowPoints
SetDlgItemTextW
CheckRadioButton
IsDlgButtonChecked
CheckDlgButton
SendDlgItemMessageW
EndDialog
SetWindowLongW
GetDlgItem
GetWindowLongW
SetFocus
DialogBoxParamW
DialogBoxIndirectParamW
DispatchMessageW
MonitorFromRect
GetMessagePos
CheckMenuItem
CreatePopupMenu
LoadBitmapW
IsWindow
FindWindowExW
ShowScrollBar
RemoveMenu
GetCursor
InsertMenuW
CloseClipboard
TranslateAcceleratorW
CallWindowProcW
GetMonitorInfoW
GetScrollPos
SetScrollInfo
SetMenuItemInfoW
DrawFrameControl
DestroyMenu
SetClipboardData
UpdateWindow
IsWindowVisible
ReleaseCapture
OpenClipboard
SetTimer
OemToCharBuffA
RemovePropW
SetPropW
DeferWindowPos
BeginDeferWindowPos
EndDeferWindowPos
IsWindowUnicode
GetPropW

gdi32

CreateRectRgn
MoveToEx
SetGraphicsMode
LineTo
SetWorldTransform
BitBlt
GetDIBits
SetDIBits
EndPage
StartPage
CreateFontIndirectW
GetDeviceCaps
SetBkColor
CreateDCW
SetMapMode
GetObjectW
StartDocW
EndDoc
AbortDoc
GetTextExtentPoint32W
SetTextColor
StretchBlt
SetBkMode
SelectClipRgn
Rectangle
SetStretchBltMode
CreateRoundRectRgn
CreatePen
RoundRect
TextOutW
GetStockObject
DeleteDC
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateDIBitmap
CreateSolidBrush
DeleteObject

comdlg32

CommDlgExtendedError
PrintDlgExW
GetSaveFileNameW
GetOpenFileNameW

shell32

SHBindToParent
ShellExecuteExW
SHGetDesktopFolder
SHGetSpecialFolderPathW
DragFinish
DragQueryFileW
DragAcceptFiles
SHAddToRecentDocs
SHChangeNotify
SHGetFileInfoW

gdiplus

GdipCreatePen1
GdipFillEllipseI
GdipAlloc
GdiplusStartup
GdipGetImageHorizontalResolution
GdipCloneBitmapAreaI
GdipScaleMatrix
GdipGetImageHeight
GdipCreateBitmapFromStream
GdipCreateSolidFill
GdipSetClipRectI
GdipSetWorldTransform
GdipDrawLineI
GdipDrawImageI
GdipTranslateMatrix
GdipGetImageEncodersSize
GdipDisposeImage
GdipRotateMatrix
GdipGetImageEncoders
GdipCreateHBITMAPFromBitmap
GdipTransformMatrixPoints
GdipSaveImageToFile
GdipDeleteMatrix
GdipCloneImage
GdipInvertMatrix
GdipGetImageWidth
GdipFillRectangleI
GdipSetCompositingQuality
GdipCreateFromHDC
GdipGetImageVerticalResolution
GdipSetPageUnit
GdipCloneBrush
GdipDeletePen
GdipFree
GdipDeleteBrush
GdiplusShutdown
GdipCreateMatrix
GdipDeleteGraphics
GdipSetSmoothingMode

comctl32

ImageList_Create
InitCommonControlsEx
ImageList_AddMasked
ImageList_Destroy
CreatePropertySheetPageW
ImageList_GetIconSize
ImageList_Draw

msimg32

AlphaBlend

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter
ord203

wininet

InternetReadFile
InternetCloseHandle
InternetConnectW
InternetSetOptionW
InternetOpenW
InternetOpenUrlW
HttpOpenRequestW
HttpQueryInfoW
HttpSendRequestA

ole32

CoUninitialize
CoInitialize
CreateStreamOnHGlobal
CoTaskMemFree
CoCreateInstance

shlwapi

StrStrW
StrStrIW
PathIsRelativeW
SHDeleteKeyW
PathAppendW
SHSetValueW
StrRStrIW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

libmupdf

fz_to_name
fz_strdup
fz_is_name
pdf_get_crypt_revision
fz_array_len
pdf_load_outline
pdf_get_crypt_key
fz_list_is_single_image
fz_md5_init
fz_find_device_colorspace
pdf_lookup_dest
fz_new_stream
pdf_load_page_tree
fz_new_null
xml_parse_document
fz_clear_pixmap_with_color
fz_rotate
fz_dict_gets
fz_to_str_buf
fz_warn
pdf_has_permission
pdf_load_stream
pdf_find_page_number
xps_free_context
fz_new_draw_device
fz_is_int
pdf_count_pages
fz_dict_getsa
fz_open_file_w
fz_free_display_list
fz_dict_get_val
fz_open_buffer
pdf_authenticate_password
fz_is_string
fz_new_bbox_device
fz_catch_imp
xps_parse_outline
fz_free
pdf_open_xref_with_stream
fz_dict_len
fz_md5_update
xps_count_pages
fz_new_list_device
pdf_load_name_tree
fz_close
pdf_to_rect
fz_to_gen
xps_free_page
pdf_free_page
fz_execute_display_list
pdf_needs_password
fz_seek
fz_is_dict
pdf_run_page_with_usage
pdf_free_xref
fz_copy_dict
xps_open_stream
fz_drop_buffer
xps_free_named_dest
fz_to_real
fz_scale
pdf_load_page
fz_new_gdiplus_device
fz_free_glyph_cache
pdf_to_ucs2
xps_load_page
xps_parse_named_dests
fz_free_text_span
pdf_age_store
xps_free_outline
gzread
gzclose
gzwopen
inflateInit2_
inflate
crc32
inflateEnd
gzerror
gztell
gzopen
gzseek
jpeg_finish_decompress
jpeg_read_scanlines
jpeg_start_decompress
jpeg_read_header
jpeg_CreateDecompress
jpeg_destroy_decompress
jpeg_std_error
jpeg_resync_to_restart
fz_throw_imp
fz_is_null
fz_free_device
fz_transform_rect
fz_dict_get_key
fz_matrix_expansion
fz_accelerate
fz_dict_puts
pdf_from_ucs2
fz_new_buffer
fz_new_text_span
xml_att
pdf_resolve_indirect
fz_round_rect
fz_is_indirect
fz_tell
fz_convert_pixmap
fz_transform_point
fz_to_int
xps_free_part
fz_new_glyph_cache
fz_new_pixmap_with_limit
fz_md5_final
xps_read_part
xps_parse_fixed_page
fz_malloc
fz_is_array
fz_translate
fz_keep_stream
fz_to_num
pdf_free_outline
fz_new_string
xml_tag
fz_invert_matrix
fz_new_text_device
fz_drop_obj
xps_extract_doc_props
fz_dict_dels
xps_free_link
fz_concat
fz_array_get
fz_read_all
fz_keep_obj
pdf_run_page
xml_free_element
fz_drop_pixmap
pdf_is_stream
fz_new_display_list

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 463KB - Virtual size: 462KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 78KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 137KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cfbf020a04a46068dbbe4ee36d037c81

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

gdi32

comdlg32

shell32

gdiplus

comctl32

msimg32

winspool.drv

wininet

ole32

shlwapi

version

libmupdf

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 463KB - Virtual size: 462KB

.data Size: 78KB - Virtual size: 128KB

.rsrc Size: 137KB - Virtual size: 137KB

.reloc Size: 79KB - Virtual size: 79KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 463KB - Virtual size: 462KB

.data
Size: 78KB - Virtual size: 128KB

.rsrc
Size: 137KB - Virtual size: 137KB

.reloc
Size: 79KB - Virtual size: 79KB