2024-04-17_a9d7ce50f892646e5f1ee3ea3a6f5ff9_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-17_a9d7ce50f892646e5f1ee3ea3a6f5ff9_mafia
Size

23.6MB
MD5

a9d7ce50f892646e5f1ee3ea3a6f5ff9
SHA1

6fa65da957fdf83d7c36ad9768b794310569011e
SHA256

c941fbc360026fca2ba8cf53a78d62a1a0ea9664e5b505226a0d9279e4344d44
SHA512

0cf8a074e651a6d57263b171094df8b4b100b1c89a1bc77f4f48e70c07e61dfa8897b523c2285fb06336c21e300d8d60bde594861276b359b3c5c5fb0cad1d9d
SSDEEP

393216:hcyAz2mbS1YWJsv6tWKFdu9C1tlkqfUK25nPSyyK0Uz5yt3qgFE6sibuVrwx9AOt:h+z2mbS1Ysky2gUvYtpCZyn9AOZKMks

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-17_a9d7ce50f892646e5f1ee3ea3a6f5ff9_mafia

Files

2024-04-17_a9d7ce50f892646e5f1ee3ea3a6f5ff9_mafia
.exe windows:5 windows x86 arch:x86

68593c339513cf67adcf67c51bb977e7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

GetGlyphOutlineW
SetTextAlign
GdiFlush
GetObjectW
RemoveFontMemResourceEx
GetStockObject
GetCharABCWidthsI
DeleteDC
CreateDIBSection
DeleteObject
OffsetRgn
GetOutlineTextMetricsW
CreateFontIndirectW
CreateCompatibleBitmap
SelectObject
GetRegionData
AddFontMemResourceEx
GetCharABCWidthsW
GetFontData
AddFontResourceExW
CreateDCW
SetBkMode
RemoveFontResourceExW
GetDIBits
CreateBitmap
GetTextExtentPoint32W
GetTextFaceW
SetWorldTransform
CreateRectRgn
SelectClipRgn
GetTextMetricsW
ExtTextOutW
EnumFontFamiliesExW
BitBlt
SetGraphicsMode
CreateCompatibleDC
SetTextColor
GetDeviceCaps
GetCharABCWidthsFloatW
CombineRgn

oleaut32

SystemTimeToVariantTime
VariantChangeType
VariantInit
SysAllocStringLen
SysFreeString
SysStringLen
SysAllocString

imm32

ImmGetContext
ImmNotifyIME
ImmSetCompositionWindow
ImmGetCompositionStringW
ImmSetCandidateWindow
ImmGetDefaultIMEWnd
ImmReleaseContext

winmm

PlaySoundW

kernel32

TlsFree
lstrcmpW
MapViewOfFile
GetSystemDirectoryW
InitializeCriticalSectionAndSpinCount
GetCurrencyFormatW
GetProcAddress
OpenProcess
GetDateFormatW
GetTimeFormatA
CreateThread
GetDriveTypeW
SetFilePointer
TerminateThread
CloseHandle
IsValidCodePage
GetFileType
ReleaseSemaphore
GetCommandLineA
FormatMessageW
GetModuleHandleA
ExitProcess
TlsAlloc
GetUserDefaultUILanguage
GetFileSize
OutputDebugStringA
VerSetConditionMask
TlsSetValue
LoadLibraryW
InterlockedIncrement
GlobalSize
TlsGetValue
HeapAlloc
ReadFile
FindFirstFileExW
MultiByteToWideChar
GetACP
MoveFileW
GetVersionExW
GetStdHandle
DeviceIoControl
GetFileInformationByHandle
GetConsoleCP
FreeLibrary
LoadLibraryA
CreateFileMappingW
SetFileAttributesW
UnmapViewOfFile
FileTimeToLocalFileTime
FlushFileBuffers
GetTimeFormatW
GetFullPathNameW
IsValidLanguageGroup
GetCurrentProcess
GetModuleFileNameW
ExitThread
SetHandleCount
DeleteCriticalSection
IsDebuggerPresent
HeapReAlloc
GetVolumeInformationW
GetLogicalDrives
GetCPInfo
HeapFree
SetEndOfFile
GlobalAlloc
DuplicateHandle
InitializeCriticalSection
GetTimeZoneInformation
EnterCriticalSection
DeleteFileA
VirtualQuery
GetCurrentThread
GetLocaleInfoA
VirtualFree
GetConsoleMode
UnhandledExceptionFilter
lstrlenA
GetOEMCP
ReleaseMutex
GetFileSizeEx
Sleep
DecodePointer
FreeEnvironmentStringsW
GetCurrentThreadId
VerifyVersionInfoW
FileTimeToSystemTime
LCMapStringW
GetDateFormatA
CreateSemaphoreW
RemoveDirectoryW
SetEvent
CopyFileW
GetProcessHeap
OpenFileMappingW
ResumeThread
GetFileAttributesW
CreateEventW
InterlockedDecrement
InterlockedExchange
RaiseException
FindNextFileW
CreateProcessW
WriteFile
LeaveCriticalSection
GetCommandLineW
WaitForMultipleObjects
CreateMutexW
CompareStringW
SetUnhandledExceptionFilter
GetSystemTime
OutputDebugStringW
GetStartupInfoW
WriteConsoleW
SetStdHandle
GlobalLock
DeleteFileW
HeapCreate
CheckRemoteDebuggerPresent
GetLongPathNameW
HeapSetInformation
GetEnvironmentVariableA
SetFilePointerEx
SetEnvironmentVariableA
GetFileAttributesExW
GetLocaleInfoW
GetUserDefaultLCID
GetTickCount64
TerminateProcess
IsValidLocale
SetLastError
SetErrorMode
GetModuleHandleW
MoveFileExW
EnumSystemLocalesA
EncodePointer
GetStringTypeW
LocalFree
RtlUnwind
GetLastError
CreateDirectoryW
CreateFileA
PeekNamedPipe
WideCharToMultiByte
HeapSize
SetThreadPriority
WaitForSingleObject
CreateFileW
GetCurrentDirectoryW
QueryPerformanceCounter
SystemTimeToTzSpecificLocalTime
ResetEvent
GetThreadPriority
GlobalUnlock
GetEnvironmentStringsW
GetUserDefaultLangID
GetSystemTimeAsFileTime
FindFirstFileW
IsProcessorFeaturePresent
QueryPerformanceFrequency
SleepEx
FindClose
GetCurrentProcessId
ExpandEnvironmentStringsW
GetTickCount
GetLocalTime
GetModuleFileNameA
GetSystemInfo

user32

CreateCaret
RegisterClassW
GetActiveWindow
DestroyCaret
GetClientRect
SetTimer
GetQueueStatus
MapVirtualKeyW
GetParent
DestroyWindow
MoveWindow
GetMenu
CreateIconIndirect
RegisterClassExW
DestroyCursor
SetForegroundWindow
FlashWindowEx
MessageBeep
CallNextHookEx
TranslateMessage
GetSysColor
SetCapture
PeekMessageW
GetDesktopWindow
ToAscii
CreateWindowExW
SetWindowsHookExW
IsIconic
GetKeyboardLayoutList
EnumDisplayMonitors
SetParent
SendMessageW
ScreenToClient
GetWindowPlacement
DrawIconEx
HideCaret
SetWindowRgn
RegisterWindowMessageW
TrackPopupMenuEx
GetKeyState
NotifyWinEvent
SetMenuItemInfoW
SetFocus
GetClassInfoW
GetSystemMetrics
InvalidateRect
GetWindowThreadProcessId
SetClipboardViewer
GetCaretBlinkTime
UnregisterClassW
ReleaseCapture
PostMessageW
GetWindowRect
ClientToScreen
GetMessageExtraInfo
ChangeClipboardChain
GetCursorPos
KillTimer
GetCapture
IsZoomed
CharNextExA
SetCursorPos
GetWindowLongW
GetAsyncKeyState
GetDC
GetSysColorBrush
EnableMenuItem
GetClipboardFormatNameW
SetCursor
RegisterClipboardFormatW
GetSystemMenu
GetMonitorInfoW
LoadIconW
BeginPaint
GetKeyboardState
IsChild
CreateCursor
ToUnicode
DispatchMessageW
SetCaretPos
ChildWindowFromPointEx
GetDoubleClickTime
DestroyIcon
SetWindowPos
GetAncestor
LoadImageW
GetIconInfo
GetUpdateRect
SystemParametersInfoW
GetFocus
TrackMouseEvent
UnhookWindowsHookEx
DefWindowProcW
IsWindowVisible
EndPaint
ShowWindow
AdjustWindowRectEx
SetWindowLongW
MsgWaitForMultipleObjectsEx
ReleaseDC
SetWindowTextW

shell32

SHGetMalloc
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW

ole32

ReleaseStgMedium
CoCreateInstance
CoLockObjectExternal
OleUninitialize
CoGetMalloc
OleSetClipboard
CoCreateGuid
OleIsCurrentClipboard
CoTaskMemFree
CoInitialize
OleFlushClipboard
CoTaskMemAlloc
CoUninitialize
OleInitialize
RevokeDragDrop
RegisterDragDrop
OleGetClipboard
DoDragDrop

advapi32

CryptDestroyKey
CryptGenRandom
CryptDestroyHash
CryptImportKey
CryptReleaseContext
RegCreateKeyExW
RegEnumValueW
RegOpenKeyExW
CryptGetHashParam
OpenProcessToken
CryptEncrypt
RegQueryValueExW
RegFlushKey
CryptHashData
RegCloseKey
CopySid
RegDeleteValueW
GetTokenInformation
CryptCreateHash
RegDeleteKeyW
GetLengthSid
CryptAcquireContextW
RegQueryInfoKeyW
FreeSid
RegSetValueExW
RegEnumKeyExW

ws2_32

htons
getsockopt
getpeername
socket
connect
WSASetLastError
WSAEnumNetworkEvents
bind
accept
listen
htonl
sendto
recvfrom
select
__WSAFDIsSet
ioctlsocket
gethostname
ntohs
getsockname
setsockopt
WSACloseEvent
recv
WSAResetEvent
WSAWaitForMultipleEvents
WSACreateEvent
freeaddrinfo
WSAIoctl
getaddrinfo
WSAStartup
WSACleanup
WSAGetLastError
send
closesocket
WSAAsyncSelect
WSAEventSelect

crypt32

CertFindCertificateInStore
CryptQueryObject
CertOpenStore
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertCloseStore
CertAddCertificateContextToStore
CertFreeCertificateChain
CryptDecodeObjectEx
CertEnumCertificatesInStore
PFXImportCertStore
CertCreateCertificateChainEngine
CryptStringToBinaryW
CertGetCertificateChain
CertFindExtension

wldap32

ord117
ord216
ord73
ord301
ord167
ord79
ord142
ord46
ord27
ord127
ord147
ord133
ord26
ord208
ord145
ord219
ord14
ord41

Exports

Exports

z_adler32
z_adler32_combine
z_adler32_combine64
z_compress
z_compress2
z_compressBound
z_crc32
z_crc32_combine
z_crc32_combine64
z_deflate
z_deflateBound
z_deflateCopy
z_deflateEnd
z_deflateInit2_
z_deflateInit_
z_deflateParams
z_deflatePrime
z_deflateReset
z_deflateSetDictionary
z_deflateSetHeader
z_deflateTune
z_get_crc_table
z_inflate
z_inflateCopy
z_inflateEnd
z_inflateGetHeader
z_inflateInit2_
z_inflateInit_
z_inflateMark
z_inflatePrime
z_inflateReset
z_inflateReset2
z_inflateSetDictionary
z_inflateSync
z_inflateSyncPoint
z_inflateUndermine
z_uncompress
z_zError
z_zlibCompileFlags
z_zlibVersion

Sections

.text
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 240KB - Virtual size: 239KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

68593c339513cf67adcf67c51bb977e7

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

oleaut32

imm32

winmm

kernel32

user32

shell32

ole32

advapi32

ws2_32

crypt32

wldap32

Exports

Exports

Sections

.text Size: 6.0MB - Virtual size: 6.0MB

.rdata Size: 2.2MB - Virtual size: 2.2MB

.data Size: 49KB - Virtual size: 62KB

.qtmetad Size: 512B - Virtual size: 272B

.rsrc Size: 68KB - Virtual size: 67KB

.reloc Size: 240KB - Virtual size: 239KB

.text
Size: 6.0MB - Virtual size: 6.0MB

.rdata
Size: 2.2MB - Virtual size: 2.2MB

.data
Size: 49KB - Virtual size: 62KB

.qtmetad
Size: 512B - Virtual size: 272B

.rsrc
Size: 68KB - Virtual size: 67KB

.reloc
Size: 240KB - Virtual size: 239KB