2024-05-03_0a6c2c592eb41fe3665cafd542e0ae9a_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-03_0a6c2c592eb41fe3665cafd542e0ae9a_mafia
Size

1.6MB
MD5

0a6c2c592eb41fe3665cafd542e0ae9a
SHA1

b97cea256984f8fcad29b599b51c3fce7538a98c
SHA256

4df8dc301b013d26cb51fa976247759e24b36758b5f9e860f9b56d0fbe1bd506
SHA512

5d3999a12bcf472438e5559fa2876c1417075e3e76cdd5c8506e33dd1afbec40f4e28dabd3eb459708a0d88f046ef43641eac75c005a26062413ed9b93a1db94
SSDEEP

24576:Iw1QZ8alQBcgkCODFUDlBBhheEE2cb9kMDSYuRVOljoemh:RQNKVkCrDl1h2tBkMDSYEVO3m

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-03_0a6c2c592eb41fe3665cafd542e0ae9a_mafia

Files

2024-05-03_0a6c2c592eb41fe3665cafd542e0ae9a_mafia
.exe windows:5 windows x86 arch:x86

e151fdce4dbefdb7ee12c2976598f2b5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\docs\Visual Studio 2010\Projects\epp\Explorer++\Explorer++\Release\Explorer++.pdb

Imports

shell32

SHBindToParent
ord152
SHBrowseForFolderW
ShellExecuteExW
ord23
ord2
SHGetFolderLocation
ord18
ord17
SHGetDesktopFolder
ord727
SHGetFolderPathW
SHFreeNameMappings
SHGetPathFromIDListW
SHFileOperationW
SHGetSpecialFolderPathW
ord25
SHGetFileInfoW
ord71
DragQueryFileW
ord16
ShellExecuteW

gdiplus

GdipGetAllPropertyItems
GdipGetPropertySize
GdipDrawLineI
GdipDeletePen
GdipCreatePen1
GdipFillRectangleI
GdipGetPathGradientPointCount
GdipCreateBitmapFromScan0
GdipSetPathGradientCenterColor
GdipSetPathGradientCenterPointI
GdipCloneBrush
GdipDeleteBrush
GdipGetImageVerticalResolution
GdipAddPathRectangleI
GdipDeleteGraphics
GdipCloneImage
GdipCreateSolidFill
GdipGetImagePixelFormat
GdipSetPathGradientSurroundColorsWithCount
GdipCreateHBITMAPFromBitmap
GdipDisposeImage
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipAlloc
GdipFree
GdipCreateFromHDC
GdipDeletePath
GdipCreatePath
GdiplusShutdown
GdiplusStartup
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipGetImageWidth
GdipCreatePathGradientFromPath

shlwapi

PathIsSameRootW
StrCmpIW
PathRemoveBlanksW
SHDeleteKeyW
PathIsRootW
StrCmpW
PathIsUNCW
PathCombineW
StrCmpLogicalW
PathRemoveFileSpecW
StrChrW
PathAppendW
PathFindExtensionW
PathStripToRootW
StrRetToBufW
PathRemoveBackslashW
PathIsDirectoryW
StrCatW
PathStripPathW
PathRemoveExtensionW
PathRenameExtensionW
SHStrDupW
PathIsRelativeW
PathIsURLW
PathCanonicalizeW
SHAutoComplete

psapi

GetModuleFileNameExW

mpr

WNetGetUniversalNameW

uxtheme

SetWindowTheme

winmm

PlaySoundW

kernel32

GlobalFree
GetModuleHandleW
SetLastError
GetLastError
OutputDebugStringA
LoadLibraryW
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetFileAttributesW
GetVersion
LoadLibraryA
GlobalUnlock
lstrlenW
GlobalLock
lstrcmpiW
GetFileAttributesExW
GetLogicalDriveStringsW
lstrcmpW
GetVersionExW
InitializeCriticalSection
FreeLibrary
InterlockedIncrement
InterlockedDecrement
CloseHandle
SetThreadPriority
CreateThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetFileInformationByHandle
ReadFile
GetFileSizeEx
CreateFileW
GetDriveTypeW
GetCurrentDirectoryW
GlobalMemoryStatusEx
MultiByteToWideChar
GetComputerNameW
GetVolumeInformationW
GetDiskFreeSpaceExW
SleepEx
QueueUserAPC
FindClose
FindNextFileW
FindFirstFileW
GetUserDefaultUILanguage
SetCurrentDirectoryW
GetLocaleInfoW
SetFileTime
SetFileAttributesW
WideCharToMultiByte
GlobalAlloc
CreateMutexW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
SetUnhandledExceptionFilter
GetCommandLineW
OpenProcess
WriteFile
GetLocaleInfoA
lstrcpyW
GetSystemTime
CreateFileA
LocalFree
SetFilePointer
GetDiskFreeSpaceW
GetCurrentThread
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
GetFileSize
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FormatMessageA
GetFullPathNameW
GetCurrentDirectoryA
GetProcessHeap
GetSystemInfo
SwitchToThread
SetEnvironmentVariableA
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
SetFilePointerEx
GetUserDefaultLCID
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
GetACP
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
HeapSize
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsProcessorFeaturePresent
GetStdHandle
ExitProcess
HeapCreate
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetCPInfo
GetDateFormatA
GetTimeFormatA
GetStartupInfoW
HeapSetInformation
GetCommandLineA
RaiseException
RtlUnwind
HeapReAlloc
HeapAlloc
HeapFree
DecodePointer
EncodePointer
Sleep
GetStringTypeW
InterlockedExchange
InterlockedCompareExchange
CompareFileTime
ResetEvent
CancelIo
ReadDirectoryChangesW
SetEvent
SetErrorMode
WaitForSingleObject
CreateEventW
ExitThread
GlobalSize
DeleteFileW
CreateHardLinkW
LocalFileTimeToFileTime
CreateDirectoryW
CompareStringW
LCMapStringW
FlushFileBuffers
SetFileValidData
SetEndOfFile
GetUserDefaultLangID

user32

DrawEdge
GetMenuState
FrameRect
GetSysColor
GetTabbedTextExtentW
GetMenuStringW
SystemParametersInfoW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetSysColorBrush
UnregisterDeviceNotification
GetWindowTextW
RegisterDeviceNotificationW
AppendMenuW
MessageBoxW
ScreenToClient
GetWindowRect
CreateDialogParamW
SetRect
DrawTextW
DeleteMenu
DrawIconEx
RedrawWindow
EndPaint
BeginPaint
GetUpdateRect
RegisterClassW
OffsetRect
MapWindowPoints
InflateRect
DialogBoxParamW
GetWindowTextLengthW
IsDlgButtonChecked
SetWindowTextW
SetFocus
SetWindowPos
DestroyIcon
GetDlgItem
EndDialog
LoadImageW
SendMessageW
LoadBitmapW
SendDlgItemMessageW
LoadStringW
GetDlgItemTextW
SetDlgItemTextW
GetParent
EnableMenuItem
MoveWindow
GetMenuItemInfoW
wsprintfW
GetSystemMetrics
SetWindowPlacement
LoadAcceleratorsW
GetMessageW
IsDialogMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
FindWindowW
RegisterClipboardFormatW
CopyIcon
WindowFromPoint
FindWindowExW
GetCapture
SetCapture
ReleaseCapture
UnregisterClassW
GetClassLongW
GetMenuBarInfo
IsWindowVisible
PrintWindow
IsIconic
RegisterClassExW
CreateWindowExW
KillTimer
SetTimer
ShowWindow
GetWindowPlacement
EnableWindow
GetCursorPos
DestroyWindow
ChangeClipboardChain
InsertMenuItemW
RegisterWindowMessageW
SetMenu
SetClipboardViewer
IsClipboardFormatAvailable
PostMessageW
UpdateWindow
IntersectRect
ClientToScreen
CreatePopupMenu
SetMenuInfo
GetMenuItemID
PostQuitMessage
SetWindowLongW
DefWindowProcW
LoadCursorW
SetCursor
TrackPopupMenu
LoadMenuW
DestroyMenu
SetForegroundWindow
GetKeyState
GetDC
ReleaseDC
PtInRect
CallWindowProcW
GetIconInfo
CheckMenuItem
GetWindowLongW
CheckMenuRadioItem
GetFocus
GetDlgItemInt
SetDlgItemInt
LoadIconW
SetClassLongW
GetClientRect
FillRect
InvalidateRect
CreateMenu
InsertMenuW
GetMenuItemCount
GetMessagePos
GetMenu
GetSubMenu
SetMenuItemInfoW
CheckDlgButton

gdi32

TextOutW
BitBlt
CreateCompatibleBitmap
SetBitmapDimensionEx
GetBitmapDimensionEx
CreateCompatibleDC
SelectObject
SetStretchBltMode
SetBrushOrgEx
StretchBlt
DeleteDC
GetTextExtentPoint32W
GetObjectW
CreateFontIndirectW
CreateFontW
SetTextColor
SetBkMode
GetStockObject
CreateSolidBrush
DeleteObject

advapi32

RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegOpenKeyA
RegQueryValueExA
InitializeSecurityDescriptor
InitializeAcl
SetSecurityDescriptorDacl
SetFileSecurityW
CryptGenRandom
CryptAcquireContextW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
GetTokenInformation
ConvertSidToStringSidW
LookupAccountSidW
GetSecurityInfo
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW

ole32

RegisterDragDrop
CoTaskMemFree
CLSIDFromString
OleSetClipboard
OleDuplicateData
StgCreateStorageEx
OleInitialize
OleUninitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
RevokeDragDrop
OleIsCurrentClipboard
OleFlushClipboard
CoUninitialize
CoInitializeEx
OleGetClipboard
CoCreateInstance
ReleaseStgMedium
DoDragDrop

oleaut32

VariantInit
VariantClear
SysAllocString
SysFreeString

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

iphlpapi

GetAdaptersAddresses

userenv

ExpandEnvironmentStringsForUserW

comctl32

ord410
ord412
ord413
ImageList_Draw

winspool.drv

OpenPrinterW
GetPrinterW
ClosePrinter

comdlg32

GetSaveFileNameW

Sections

.text
Size: 944KB - Virtual size: 943KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 65KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 448KB - Virtual size: 448KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e151fdce4dbefdb7ee12c2976598f2b5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

gdiplus

shlwapi

psapi

mpr

uxtheme

winmm

kernel32

user32

gdi32

advapi32

ole32

oleaut32

version

iphlpapi

userenv

comctl32

winspool.drv

comdlg32

Sections

.text Size: 944KB - Virtual size: 943KB

.rdata Size: 146KB - Virtual size: 146KB

.data Size: 65KB - Virtual size: 88KB

.rsrc Size: 448KB - Virtual size: 448KB

.reloc Size: 52KB - Virtual size: 51KB

.text
Size: 944KB - Virtual size: 943KB

.rdata
Size: 146KB - Virtual size: 146KB

.data
Size: 65KB - Virtual size: 88KB

.rsrc
Size: 448KB - Virtual size: 448KB

.reloc
Size: 52KB - Virtual size: 51KB