2024-04-29_da3b89ab6451d45b46c995526ce2d085_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-29_da3b89ab6451d45b46c995526ce2d085_mafia
Size

23.3MB
MD5

da3b89ab6451d45b46c995526ce2d085
SHA1

3faec46bb34e1f7648582a72f5cb1295d086c4dd
SHA256

d1457afb8f346894ff9fd686d57a132bcc5af4bdcb603868d3d443067f965f89
SHA512

bf9256ffc8fb1ee018d1fe5eaf7ccf71b779e10c0a9110231e8fedca30d2d3f93a240fd1def5dac6174e6be5a881b9bc2af03e12dca2de7eaeb0d22c2843f11c
SSDEEP

393216:AQlk7Jsv6tWKFdu9CurOHj/2PgFhA2EvpR/vmjEqaA/SPy/Zl9gmZmKcvnaDAX3z:AQlij/agw2EvPvIaAqiLUS0XD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-29_da3b89ab6451d45b46c995526ce2d085_mafia

Files

2024-04-29_da3b89ab6451d45b46c995526ce2d085_mafia
.exe windows:5 windows x86 arch:x86

24ba527f78bbc620a23abe15ada53d03

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

GetCharABCWidthsFloatW
CreateDIBSection
GetDeviceCaps
CreateFontIndirectW
GdiFlush
SetBkMode
GetTextFaceW
CreateBitmap
GetObjectW
GetOutlineTextMetricsW
SetTextAlign
AddFontResourceExW
CombineRgn
SelectClipRgn
RemoveFontResourceExW
CreateCompatibleBitmap
GetCharABCWidthsI
BitBlt
GetCharABCWidthsW
GetDIBits
GetFontData
ExtTextOutW
SetWorldTransform
GetTextExtentPoint32W
RemoveFontMemResourceEx
DeleteObject
CreateRectRgn
OffsetRgn
EnumFontFamiliesExW
GetGlyphOutlineW
SelectObject
GetStockObject
SetTextColor
CreateCompatibleDC
SetGraphicsMode
GetRegionData
GetTextMetricsW
CreateDCW
DeleteDC
AddFontMemResourceEx

oleaut32

SystemTimeToVariantTime
VariantChangeType
VariantInit
SysAllocStringLen
SysFreeString
SysStringLen
SysAllocString

imm32

ImmGetContext
ImmSetCompositionWindow
ImmGetCompositionStringW
ImmGetDefaultIMEWnd
ImmSetCandidateWindow
ImmNotifyIME
ImmReleaseContext

winmm

PlaySoundW

kernel32

GetCurrencyFormatW
IsDebuggerPresent
InitializeCriticalSection
TlsAlloc
CopyFileW
EncodePointer
IsValidLanguageGroup
VirtualFree
HeapSize
HeapSetInformation
GetLastError
InterlockedDecrement
GetFileAttributesExW
GlobalAlloc
CreateFileA
SetFilePointer
SetEndOfFile
HeapCreate
DecodePointer
EnterCriticalSection
CreateSemaphoreW
GetVolumeInformationW
OutputDebugStringW
GlobalUnlock
GetLocaleInfoW
lstrcmpW
FlushFileBuffers
ResumeThread
GetModuleFileNameA
CreateThread
UnmapViewOfFile
IsProcessorFeaturePresent
GetTimeZoneInformation
GetStartupInfoW
GetLocaleInfoA
FileTimeToSystemTime
CreateDirectoryW
FileTimeToLocalFileTime
GlobalLock
SystemTimeToTzSpecificLocalTime
FindNextFileW
HeapReAlloc
GetSystemTime
GetSystemInfo
MapViewOfFile
TerminateProcess
TlsSetValue
lstrlenA
GetSystemDirectoryW
VerSetConditionMask
GetOEMCP
GetTickCount
GetProcAddress
GetEnvironmentStringsW
GetCurrentDirectoryW
GetCurrentProcessId
GetProcessHeap
SetHandleCount
IsValidCodePage
CloseHandle
ReadFile
CreateEventW
FreeEnvironmentStringsW
GetTimeFormatA
OpenProcess
ReleaseMutex
CompareStringW
SetFileAttributesW
DuplicateHandle
RtlUnwind
InterlockedIncrement
GetSystemTimeAsFileTime
SetLastError
OpenFileMappingW
GetTickCount64
MoveFileExW
LoadLibraryW
GetFileType
GetConsoleCP
GetACP
GetUserDefaultUILanguage
SetFilePointerEx
DeleteFileW
GetCommandLineA
SetEnvironmentVariableA
InitializeCriticalSectionAndSpinCount
GetLongPathNameW
GetCurrentProcess
DeviceIoControl
TerminateThread
CreateFileMappingW
LocalFree
GetFileSizeEx
WideCharToMultiByte
ReleaseSemaphore
WaitForSingleObject
GetFileSize
WriteConsoleW
FindClose
Sleep
SetStdHandle
ExitProcess
GetModuleHandleW
HeapAlloc
SetEvent
MoveFileW
SetUnhandledExceptionFilter
GetVersionExW
GetEnvironmentVariableA
GetTimeFormatW
CreateFileW
FormatMessageW
GetThreadPriority
GetFileAttributesW
TlsFree
DeleteCriticalSection
PeekNamedPipe
QueryPerformanceCounter
GetLocalTime
FindFirstFileW
GetModuleFileNameW
GetDateFormatW
InterlockedExchange
GetModuleHandleA
TlsGetValue
SleepEx
GetLogicalDrives
CreateMutexW
LeaveCriticalSection
RemoveDirectoryW
LCMapStringW
ResetEvent
SetErrorMode
GetCPInfo
UnhandledExceptionFilter
GlobalSize
CreateProcessW
IsValidLocale
RaiseException
EnumSystemLocalesA
GetStringTypeW
FreeLibrary
GetUserDefaultLCID
GetDateFormatA
SetThreadPriority
GetFullPathNameW
GetConsoleMode
ExpandEnvironmentStringsW
VirtualQuery
WriteFile
QueryPerformanceFrequency
GetUserDefaultLangID
GetCommandLineW
FindFirstFileExW
ExitThread
DeleteFileA
GetDriveTypeW
WaitForMultipleObjects
GetStdHandle
HeapFree
GetCurrentThread
GetCurrentThreadId
CheckRemoteDebuggerPresent
OutputDebugStringA
MultiByteToWideChar
GetFileInformationByHandle
VerifyVersionInfoW

user32

DrawIconEx
ClientToScreen
SetWindowLongW
TrackMouseEvent
EndPaint
AdjustWindowRectEx
KillTimer
IsChild
MsgWaitForMultipleObjectsEx
GetDoubleClickTime
SetCursorPos
HideCaret
DestroyIcon
GetKeyboardLayoutList
SetWindowPos
NotifyWinEvent
SetWindowRgn
ReleaseCapture
GetMonitorInfoW
IsWindowVisible
SetWindowsHookExW
DestroyCursor
ScreenToClient
GetWindowRect
CreateCaret
ReleaseDC
ToAscii
CallNextHookEx
SetMenuItemInfoW
GetAncestor
GetSysColorBrush
CharNextExA
SetCapture
GetIconInfo
GetClientRect
InvalidateRect
ChangeClipboardChain
CreateWindowExW
SetClipboardViewer
EnumDisplayMonitors
CreateIconIndirect
UnhookWindowsHookEx
GetCapture
TranslateMessage
SystemParametersInfoW
UnregisterClassW
GetMenu
MapVirtualKeyW
DefWindowProcW
RegisterClipboardFormatW
ShowWindow
GetClassInfoW
GetWindowLongW
RegisterWindowMessageW
BeginPaint
IsIconic
GetFocus
EnableMenuItem
GetSystemMenu
ToUnicode
DestroyWindow
GetUpdateRect
GetQueueStatus
ChildWindowFromPointEx
GetActiveWindow
FlashWindowEx
GetCursorPos
MoveWindow
SetFocus
PeekMessageW
GetCaretBlinkTime
SetForegroundWindow
CreateCursor
GetDC
SetTimer
LoadImageW
SetCaretPos
RegisterClassExW
GetParent
SetParent
GetDesktopWindow
IsZoomed
SetWindowTextW
MessageBeep
GetMessageExtraInfo
GetSysColor
RegisterClassW
SetCursor
DispatchMessageW
GetClipboardFormatNameW
GetAsyncKeyState
GetWindowPlacement
GetKeyState
GetWindowThreadProcessId
LoadIconW
DestroyCaret
PostMessageW
TrackPopupMenuEx
GetKeyboardState
GetSystemMetrics
SendMessageW

shell32

ShellExecuteW
SHBrowseForFolderW
SHGetMalloc
SHGetPathFromIDListW
SHGetFileInfoW

ole32

OleInitialize
OleFlushClipboard
RevokeDragDrop
DoDragDrop
CoTaskMemAlloc
CoTaskMemFree
RegisterDragDrop
CoUninitialize
OleIsCurrentClipboard
CoCreateGuid
OleGetClipboard
CoInitialize
OleSetClipboard
CoCreateInstance
OleUninitialize
CoLockObjectExternal
CoGetMalloc
ReleaseStgMedium

advapi32

CryptGetHashParam
CryptAcquireContextW
GetLengthSid
RegSetValueExW
RegQueryInfoKeyW
CryptCreateHash
RegDeleteValueW
RegFlushKey
RegCreateKeyExW
FreeSid
CryptReleaseContext
RegCloseKey
CryptGenRandom
CryptHashData
RegEnumKeyExW
CryptDestroyKey
RegOpenKeyExW
GetTokenInformation
RegEnumValueW
CryptImportKey
CryptEncrypt
RegDeleteKeyW
RegQueryValueExW
CryptDestroyHash
CopySid
OpenProcessToken

ws2_32

htons
getsockopt
getpeername
socket
connect
WSASetLastError
getaddrinfo
bind
accept
listen
htonl
sendto
recvfrom
select
__WSAFDIsSet
ioctlsocket
gethostname
ntohs
getsockname
setsockopt
WSAResetEvent
recv
WSAIoctl
WSAEnumNetworkEvents
freeaddrinfo
WSACloseEvent
WSACreateEvent
WSAEventSelect
WSAStartup
WSACleanup
WSAGetLastError
send
closesocket
WSAAsyncSelect
WSAWaitForMultipleEvents

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertGetCertificateChain
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
CertFindExtension
CertCreateCertificateChainEngine
CryptQueryObject
CertFindCertificateInStore
CryptStringToBinaryW
PFXImportCertStore
CryptDecodeObjectEx
CertFreeCertificateContext

wldap32

ord117
ord216
ord73
ord301
ord167
ord142
ord127
ord46
ord27
ord133
ord79
ord147
ord26
ord208
ord145
ord219
ord14
ord41

Exports

Exports

z_adler32
z_adler32_combine
z_adler32_combine64
z_compress
z_compress2
z_compressBound
z_crc32
z_crc32_combine
z_crc32_combine64
z_deflate
z_deflateBound
z_deflateCopy
z_deflateEnd
z_deflateInit2_
z_deflateInit_
z_deflateParams
z_deflatePrime
z_deflateReset
z_deflateSetDictionary
z_deflateSetHeader
z_deflateTune
z_get_crc_table
z_inflate
z_inflateCopy
z_inflateEnd
z_inflateGetHeader
z_inflateInit2_
z_inflateInit_
z_inflateMark
z_inflatePrime
z_inflateReset
z_inflateReset2
z_inflateSetDictionary
z_inflateSync
z_inflateSyncPoint
z_inflateUndermine
z_uncompress
z_zError
z_zlibCompileFlags
z_zlibVersion

Sections

.text
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 237KB - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

24ba527f78bbc620a23abe15ada53d03

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

oleaut32

imm32

winmm

kernel32

user32

shell32

ole32

advapi32

ws2_32

crypt32

wldap32

Exports

Exports

Sections

.text Size: 5.8MB - Virtual size: 5.8MB

.rdata Size: 2.2MB - Virtual size: 2.2MB

.data Size: 49KB - Virtual size: 62KB

.qtmetad Size: 512B - Virtual size: 272B

.rsrc Size: 67KB - Virtual size: 67KB

.reloc Size: 237KB - Virtual size: 237KB

.text
Size: 5.8MB - Virtual size: 5.8MB

.rdata
Size: 2.2MB - Virtual size: 2.2MB

.data
Size: 49KB - Virtual size: 62KB

.qtmetad
Size: 512B - Virtual size: 272B

.rsrc
Size: 67KB - Virtual size: 67KB

.reloc
Size: 237KB - Virtual size: 237KB