2024-05-05_577e3d18c77d7c02ce8e880cebf3cc85_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-05_577e3d18c77d7c02ce8e880cebf3cc85_mafia
Size

3.1MB
MD5

577e3d18c77d7c02ce8e880cebf3cc85
SHA1

bd9eece4c894f094ecb404733ccdbb7f40785e32
SHA256

92221a2f449b11beeb75b6ccaa2b05464c4857221755ef2ff17c23209575d735
SHA512

f33e03ec82c91a47e2a4986a21844ce91fef749efe4236ba8f19ff4c3852c67398a2a0e7cb704a19c1de9a6af9237a61e73501bee8db7b8fde9f329b387b8231
SSDEEP

98304:6m59SFiN6sQ+YQ4T03GYx29ubkQQIkWjjlwBtKD8UM1NGZ44SZSx394b/4g:6m59Se3TQAj2jFg44SZSFCwg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-05_577e3d18c77d7c02ce8e880cebf3cc85_mafia

Files

2024-05-05_577e3d18c77d7c02ce8e880cebf3cc85_mafia
.exe windows:5 windows x86 arch:x86

ae4fbf8eda27a9540e0f2986585b16e8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

P:\frank\config2005\wr9\CONFIG.pdb

Imports

kernel32

EnumSystemLocalesA
IsValidLocale
WriteConsoleW
CompareStringW
SetCurrentDirectoryW
CreateFileW
GetStringTypeW
GetDriveTypeW
GetTimeZoneInformation
SetConsoleCtrlHandler
GetLocaleInfoW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleCP
HeapDestroy
HeapCreate
IsProcessorFeaturePresent
LCMapStringW
GetStdHandle
SetHandleCount
FatalAppExitA
IsValidCodePage
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetFileType
SetStdHandle
GetSystemTimeAsFileTime
HeapSize
HeapQueryInformation
CreateThread
ExitThread
ExitProcess
VirtualQuery
GetSystemInfo
HeapReAlloc
GetStartupInfoW
HeapSetInformation
GetCommandLineA
SetCurrentDirectoryA
SetEnvironmentVariableA
DecodePointer
EncodePointer
CreateDirectoryA
RaiseException
RtlUnwind
LocalLock
LocalUnlock
GetDiskFreeSpaceA
ReplaceFileA
GetUserDefaultLCID
SearchPathA
Sleep
GetProfileIntA
GetTickCount
InitializeCriticalSectionAndSpinCount
GetTempPathA
GetTempFileNameA
GetNumberFormatA
GetWindowsDirectoryA
GetCurrentDirectoryA
lstrcpyA
SetErrorMode
GetOEMCP
GetCPInfo
InterlockedIncrement
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetACP
GlobalFlags
GetAtomNameA
FindResourceExW
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
CreateEventA
SuspendThread
SetEvent
WaitForSingleObject
ResumeThread
SetThreadPriority
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoA
InterlockedExchange
lstrcmpA
GetModuleHandleW
FindNextFileA
InterlockedDecrement
GetModuleFileNameW
ReleaseActCtx
CreateActCtxW
GetShortPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
MoveFileA
DeleteFileA
lstrcmpiA
GetThreadLocale
GetStringTypeExA
GetFileTime
GetFileSizeEx
GetFileAttributesA
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
SetFileAttributesA
GetFileAttributesExA
CreateFileA
CopyFileA
GlobalSize
FormatMessageA
LocalFree
lstrlenW
MulDiv
GetCurrentProcessId
GetModuleFileNameA
lstrlenA
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GetVersionExA
FreeLibrary
CompareStringA
LoadLibraryW
MultiByteToWideChar
lstrcmpW
FreeResource
FindResourceA
GlobalAlloc
ActivateActCtx
DeactivateActCtx
SetLastError
GetProcAddress
GetModuleHandleA
LoadLibraryA
GlobalLock
GlobalUnlock
GlobalFree
VirtualProtect
GetFullPathNameA
VirtualAlloc
CopyFileExA
GetLastError
GetProcessHeap
HeapAlloc
GetCurrentThread
HeapFree
CloseHandle
WideCharToMultiByte
FindResourceW
LoadResource
LockResource
GetCurrentDirectoryW
SizeofResource
InterlockedCompareExchange

user32

GetIconInfo
OffsetRect
MessageBeep
EnableScrollBar
HideCaret
InvertRect
ReleaseCapture
SetCapture
MapVirtualKeyA
IsRectEmpty
CreatePopupMenu
GetMenuDefaultItem
RedrawWindow
DestroyIcon
IsIconic
KillTimer
SetTimer
DeleteMenu
LoadCursorW
SetLayeredWindowAttributes
EnumDisplayMonitors
SetRectEmpty
UnregisterClassA
IntersectRect
LoadCursorA
GetSysColorBrush
SystemParametersInfoA
DestroyMenu
GetMenuItemInfoA
InflateRect
RealChildWindowFromPoint
GetDialogBaseUnits
ShowOwnedPopups
SetCursor
GetMessageA
TranslateMessage
GetCursorPos
ValidateRect
PostQuitMessage
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
NotifyWinEvent
InvalidateRect
DrawFocusRect
FillRect
CharUpperA
GetSystemMetrics
GetMenuStringA
AppendMenuA
InsertMenuA
RemoveMenu
GetWindowThreadProcessId
ScrollWindowEx
MoveWindow
SetWindowTextA
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
LoadIconA
SendDlgItemMessageA
WinHelpA
IsChild
SetWindowsHookExA
CallNextHookEx
CharUpperBuffA
CopyImage
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
IsWindowVisible
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
CopyRect
PtInRect
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
CopyIcon
RegisterClipboardFormatA
GetUpdateRect
SetWindowLongA
GetWindow
GetParent
GetMenuBarInfo
EnableWindow
PostMessageA
SendMessageA
GetDesktopWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetNextDlgTabItem
EndDialog
SetPropA
GetCapture
GetActiveWindow
SetActiveWindow
MapDialogRect
SetWindowPos
ShowWindow
GetPropA
RemovePropA
GetAsyncKeyState
LoadImageA
GetNextDlgGroupItem
DrawIconEx
IsZoomed
SetWindowRgn
SetParent
DestroyAcceleratorTable
WindowFromPoint
SetClassLongA
GetTabbedTextExtentA
GetTabbedTextExtentW
GetDCEx
GetWindowRgn
GetFocus
SetFocus
GetWindowLongA
GetDlgItem
IsWindowEnabled
MessageBoxA
LoadIconW
UpdateWindow
GetClientRect
LoadBitmapW
GetWindowRect
WindowFromDC
DestroyCursor
DrawIcon
EnumChildWindows
SubtractRect
GetClassNameA
GetDoubleClickTime
FrameRect
SendNotifyMessageA
IsClipboardFormatAvailable
SetMenuDefaultItem
CreateMenu
InSendMessage
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcA
DefFrameProcA
WaitMessage
PostThreadMessageA
UnpackDDElParam
ReuseDDElParam
LoadMenuA
LoadMenuW
LoadAcceleratorsA
InsertMenuItemA
TranslateAcceleratorA
IsMenu
MonitorFromPoint
UpdateLayeredWindow
UnionRect
MapVirtualKeyExA
IsCharLowerA
LoadImageW
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
GetKeyNameTextA
LockWindowUpdate
BringWindowToTop
SetCursorPos
SetRect
CreateAcceleratorTableA
LoadAcceleratorsW
GetKeyboardState
GetKeyboardLayout
ToAsciiEx
CopyAcceleratorTableA
DrawFrameControl
DrawEdge
DrawStateA
GetClassLongA
GetSystemMenu

gdi32

IntersectClipRect
OffsetClipRgn
LineTo
MoveToEx
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
GetLayout
SetLayout
SetArcDirection
SetColorAdjustment
SelectClipRgn
GetClipRgn
CreateRectRgn
SelectClipPath
GetViewportExtEx
GetWindowExtEx
GetPixel
StartDocA
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ArcTo
PolyDraw
PolylineTo
PolyBezierTo
ExtSelectClipRgn
DeleteDC
CreateDIBPatternBrushPt
CreatePatternBrush
GetStockObject
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
CreatePen
ExtCreatePen
CreateSolidBrush
CreateHatchBrush
GetTextExtentPoint32A
CreateFontIndirectA
EnumFontFamiliesExA
CreateRectRgnIndirect
SetRectRgn
ExcludeClipRect
PatBlt
CreateDIBitmap
CreateCompatibleBitmap
EnumFontFamiliesA
GetTextCharsetInfo
GetBkColor
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
GetCharWidthA
CreateFontA
StretchDIBits
GetCurrentObject
CreateDIBSection
CreateRoundRectRgn
CreatePolygonRgn
GetTextColor
CreateEllipticRgn
Polyline
Ellipse
Polygon
SetDIBColorTable
GetDIBits
SetPixel
Rectangle
OffsetRgn
GetRgnBox
RoundRect
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
SetPixelV
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
GetNearestColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextAlign
GetTextFaceA
GetTextExtentPointA
GetTextExtentPoint32W
CreateMetaFileA
CloseMetaFile
DeleteMetaFile
SetMapMode
GetClipBox
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
SelectObject
DeleteObject
GetTextMetricsA
BitBlt
CreateDCA
CopyMetaFileA
GetDeviceCaps
CreateBitmap
SetBkColor
SetTextColor
StretchBlt
DPtoLP
GetMapMode
CreateCompatibleDC
UpdateColors
RealizePalette
CombineRgn
GetObjectA
CreateHalftonePalette

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
OpenPrinterA
GetJobA
DocumentPropertiesA

advapi32

RegEnumKeyExA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueA
RegOpenKeyExW
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyA
GetFileSecurityA
SetFileSecurityA
RegCloseKey
RegEnumValueA
RegQueryValueA

shell32

DragFinish
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetMalloc
SHGetFileInfoA
SHAddToRecentDocs
ShellExecuteExA
SHAppBarMessage
DragQueryFileA
ShellExecuteA
SHGetSpecialFolderLocation
SHGetDesktopFolder
ExtractIconA

comctl32

ord17
ImageList_GetIconSize
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_Create
ImageList_GetImageCount
ImageList_Destroy
ImageList_AddMasked
ImageList_Remove
ImageList_DrawEx

shlwapi

PathIsUNCA
PathRemoveFileSpecW
PathFindExtensionA
PathRemoveExtensionA
PathStripToRootA
PathFindFileNameA

ole32

OleCreateLinkFromData
OleCreateFromData
OleSaveToStream
WriteClassStm
OleSave
StgCreateDocfileOnILockBytes
PropVariantCopy
DoDragDrop
OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
OleSetMenuDescriptor
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
StgIsStorageFile
StgOpenStorage
CreateFileMoniker
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
OleCreateStaticFromData
CreateStreamOnHGlobal
CoInitialize
CLSIDFromString
StringFromGUID2
CoDisconnectObject
CoCreateGuid
CoInitializeEx
CoCreateInstance
CoUninitialize
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CreateBindCtx
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
CLSIDFromProgID
CoRegisterMessageFilter
CoRevokeClassObject
CoRegisterClassObject
CoGetClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateDataAdviseHolder
CreateOleAdviseHolder
CoGetMalloc
GetRunningObjectTable
OleIsRunning
OleQueryLinkFromData
OleQueryCreateFromData
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
OleRun
OleRegGetMiscStatus
OleRegEnumVerbs
CreateGenericComposite
OleGetIconOfClass
CreateItemMoniker
OleCreateLinkToFile
OleCreateFromFile
OleSetContainedObject
GetHGlobalFromILockBytes
OleLoad
StgCreateDocfile
OleCreate

oleaut32

RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SafeArrayRedim
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayGetElement
SysStringLen
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
SysReAllocStringLen
VarDateFromStr
VarBstrFromCy
VarBstrFromDec
VarDecFromStr
VarCyFromStr
VarBstrFromDate
SysAllocString
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
VariantInit
SafeArrayPtrOfIndex
VariantClear
VariantChangeType

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

gdiplus

GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipDrawImageI

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundA

oledlg

ord8

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 497KB - Virtual size: 497KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 369KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 423KB - Virtual size: 423KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 179KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ae4fbf8eda27a9540e0f2986585b16e8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oleacc

gdiplus

imm32

winmm

oledlg

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 497KB - Virtual size: 497KB

.data Size: 34KB - Virtual size: 369KB

.rsrc Size: 423KB - Virtual size: 423KB

.reloc Size: 179KB - Virtual size: 179KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 497KB - Virtual size: 497KB

.data
Size: 34KB - Virtual size: 369KB

.rsrc
Size: 423KB - Virtual size: 423KB

.reloc
Size: 179KB - Virtual size: 179KB