2024-05-07_bafba2de1651c88015b9f7131cfc1f67_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-07_bafba2de1651c88015b9f7131cfc1f67_mafia
Size

3.6MB
MD5

bafba2de1651c88015b9f7131cfc1f67
SHA1

cc0d8594faa36a9f943031b9c1ee4717594d90b3
SHA256

ca52af83db302e390cd9b39d0a16cd4295febdd073b8826ac8df473a8d4a12c6
SHA512

0679fad46e2777d12d72333248c75011545027f34a6668981950d4b371aad54062b1a0808349503726d8ae36ca3a20744fbd629fcb1b91874329917f82632452
SSDEEP

98304:w/NQ3j38ZS1t2vYEQZUL7X/vU+RQNG7vLQKbwXabjpoj9ghi1RebMIg9Cbk/V8:wFS38ZSuQOHPbwXablojDIg9Cbk/V8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-07_bafba2de1651c88015b9f7131cfc1f67_mafia

Files

2024-05-07_bafba2de1651c88015b9f7131cfc1f67_mafia
.exe windows:5 windows x86 arch:x86

18f49b7884ee46a16ba60a49e4620a45

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DuplicateHandle
GetCurrentProcess
FlushFileBuffers
FindFirstFileA
GetVolumeInformationA
GetShortPathNameA
LeaveCriticalSection
EnterCriticalSection
CreateActCtxW
ReleaseActCtx
GetModuleFileNameW
GlobalFlags
LocalAlloc
TlsGetValue
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
InitializeCriticalSectionAndSpinCount
GetFileAttributesExA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileSizeEx
GetACP
GetTempPathA
GetCPInfo
GetOEMCP
SetErrorMode
GetProfileIntA
Sleep
SearchPathA
VirtualProtect
GetWindowsDirectoryA
GetNumberFormatA
FindResourceExW
EncodePointer
DecodePointer
HeapFree
HeapAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RtlUnwind
ExitProcess
RaiseException
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
ExitThread
CreateThread
GetSystemTimeAsFileTime
HeapQueryInformation
HeapSize
SetStdHandle
GetFileType
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetConsoleCP
GetConsoleMode
GetStdHandle
IsValidCodePage
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileSize
GetStringTypeW
LCMapStringW
CompareStringW
GetTimeZoneInformation
WriteConsoleW
GetProcessHeap
CreateFileW
SetEnvironmentVariableA
SleepEx
VerifyVersionInfoA
VerSetConditionMask
GetSystemDirectoryA
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
MoveFileA
lstrcmpiA
GetThreadLocale
GetStringTypeExA
GetDiskFreeSpaceA
GetFullPathNameA
GetTempFileNameA
GetFileTime
ReplaceFileA
GlobalGetAtomNameA
GlobalFindAtomA
GetVersionExA
LoadLibraryW
lstrcmpW
WaitForSingleObject
ResumeThread
SetThreadPriority
CopyFileA
GlobalSize
FormatMessageA
LocalFree
lstrlenW
MulDiv
GlobalUnlock
GlobalAddAtomA
FindResourceA
FreeResource
GlobalFree
GetCurrentProcessId
GetTickCount
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
GetModuleHandleA
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
MultiByteToWideChar
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetModuleFileNameA
GetLocaleInfoA
CompareStringA
ActivateActCtx
LoadLibraryA
GetLastError
DeactivateActCtx
SetLastError
InterlockedExchange
GlobalLock
lstrcmpA
GlobalAlloc
GetModuleHandleW
GetProcAddress
FreeLibrary
SetEndOfFile
UnlockFile
QueryPerformanceCounter
LockFile
GetFileInformationByHandle
GetDriveTypeA
FindFirstFileExA
GetCurrentDirectoryW
SetFileTime
WriteFile
CreateDirectoryA
GetFileAttributesA
LocalFileTimeToFileTime
lstrcatA
lstrlenA
lstrcpyA
GetCurrentDirectoryA
SystemTimeToFileTime
ReadFile
CloseHandle
SetFilePointer
CreateFileA
InterlockedDecrement
InterlockedIncrement
GetLocalTime
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
FindClose
DeleteFileA
GetDriveTypeW

user32

GetSystemMenu
LoadCursorA
GetAsyncKeyState
SetCursorPos
DestroyCursor
DrawFrameControl
GetMenuItemInfoA
IsMenu
UnionRect
EnableScrollBar
UpdateLayeredWindow
LockWindowUpdate
SetParent
CharUpperBuffA
DrawEdge
DrawFocusRect
DrawIconEx
SetRect
RealChildWindowFromPoint
EnumDisplayMonitors
SetLayeredWindowAttributes
CopyAcceleratorTableA
ToAsciiEx
MapVirtualKeyA
GetKeyboardLayout
GetKeyboardState
LoadAcceleratorsW
CreateAcceleratorTableA
SetClassLongA
EnumChildWindows
OpenClipboard
SetClipboardData
CloseClipboard
EmptyClipboard
LoadImageW
CharNextA
InvalidateRgn
GetNextDlgGroupItem
SetMenuDefaultItem
GetMenuDefaultItem
GetKeyNameTextA
IsClipboardFormatAvailable
FrameRect
CopyIcon
DefFrameProcA
DefMDIChildProcA
DrawMenuBar
TranslateMDISysAccel
UnregisterClassA
GetUpdateRect
SubtractRect
GetDoubleClickTime
IsCharLowerA
MapVirtualKeyExA
InvertRect
HideCaret
CreateMenu
GetWindowRgn
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuA
EnableMenuItem
CheckMenuItem
DestroyMenu
TranslateMessage
PostThreadMessageA
LoadMenuW
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
PtInRect
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
GrayStringA
DrawTextExA
LoadImageA
TabbedTextOutA
GetMenuState
GetMenuStringA
AppendMenuA
GetMenuItemID
InsertMenuA
GetMenuItemCount
GetSubMenu
RemoveMenu
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetNextDlgTabItem
EndDialog
GetClassNameA
LoadBitmapW
DrawStateA
GetWindowTextLengthA
GetWindowTextA
SetFocus
ShowWindow
DeleteMenu
SetWindowLongA
GetDlgCtrlID
SetWindowTextA
IsDialogMessageA
SendDlgItemMessageA
GetDlgItem
CheckDlgButton
GetSysColorBrush
MonitorFromPoint
GetMonitorInfoA
GetSystemMetrics
GetSysColor
GetCursorPos
ScreenToClient
GetWindowRect
SetWindowRgn
FillRect
CopyRect
InflateRect
RegisterWindowMessageA
IsWindow
KillTimer
WaitMessage
PeekMessageA
DispatchMessageA
GetWindow
SetWindowContextHelpId
MapDialogRect
SetWindowPos
GetWindowThreadProcessId
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
MessageBoxA
RegisterClipboardFormatA
SystemParametersInfoA
OffsetRect
MessageBeep
IsZoomed
PostMessageA
PostQuitMessage
UpdateWindow
EnableWindow
LoadAcceleratorsA
InsertMenuItemA
CreatePopupMenu
IntersectRect
SendMessageA
ClientToScreen
SetTimer
IsRectEmpty
GetFocus
InvalidateRect
BringWindowToTop
TranslateAcceleratorA
IsIconic
CopyImage
GetIconInfo
DestroyIcon
ReleaseCapture
LoadCursorW
SetCapture
DrawIcon
ValidateRect
WindowFromPoint
CharUpperA
SetRectEmpty
LoadIconA
WinHelpA
IsChild
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
GetMessagePos
MonitorFromWindow
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
DestroyAcceleratorTable
NotifyWinEvent
UnpackDDElParam
ReuseDDElParam
LoadMenuA
MoveWindow
DefWindowProcA
CallWindowProcA
GetMenu
ShowOwnedPopups
SetCursor
wsprintfA
GetClientRect
RedrawWindow
LoadIconW
GetMessageA
IsWindowVisible
DrawTextA
GetKeyState

gdi32

CreateFontIndirectA
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetTextColor
SetROP2
SetPolyFillMode
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateDCA
CopyMetaFileA
GetDeviceCaps
GetStockObject
GetObjectA
CreateSolidBrush
DeleteObject
CreateRoundRectRgn
SetPixelV
GetTextFaceA
EnumFontFamiliesExA
GetViewportOrgEx
GetBoundsRect
FrameRgn
FillRgn
PtInRegion
GetWindowOrgEx
GetSystemPaletteEntries
GetNearestPaletteIndex
SetPaletteEntries
GetPaletteEntries
CreatePalette
ExtFloodFill
GetMapMode
SetRectRgn
SetPixel
StretchBlt
RealizePalette
GetDIBits
SetDIBColorTable
GetRgnBox
OffsetRgn
GetTextCharsetInfo
GetLayout
SetLayout
EnumFontFamiliesA
CreateDIBitmap
SelectClipRgn
CreateRectRgn
GetViewportExtEx
GetWindowExtEx
BitBlt
GetPixel
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
CreateBitmap
CreateCompatibleDC
SelectPalette
GetObjectType
CreatePen
CreateHatchBrush
CreateCompatibleBitmap
CreateEllipticRgn
DPtoLP
LPtoDP
Ellipse
CreateDIBSection
PatBlt
GetTextMetricsA
CreateRectRgnIndirect
CreatePolygonRgn
CombineRgn
GetBkColor
GetTextColor
Polyline
Polygon
Rectangle
RoundRect
GetTextExtentPoint32A

shell32

ExtractIconA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHAddToRecentDocs
ShellExecuteA
SHGetFileInfoA
DragFinish
SHAppBarMessage
DragQueryFileA

msimg32

AlphaBlend
TransparentBlt

comctl32

ImageList_ReplaceIcon
InitCommonControlsEx
ImageList_GetIcon
ImageList_Create
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_Destroy
ImageList_DrawEx

shlwapi

PathFindExtensionA
PathFindFileNameA
PathRemoveFileSpecW
PathStripToRootA
PathIsUNCA

oledlg

ord8

gdiplus

GdipFree
GdipAlloc
GdipDeleteGraphics
GdipDisposeImage
GdipGetImageWidth
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipCloneImage
GdipDrawImageI
GdipGetImageGraphicsContext
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdiplusShutdown

ws2_32

ntohl
gethostname
ioctlsocket
listen
closesocket
freeaddrinfo
getsockopt
setsockopt
WSAIoctl
__WSAFDIsSet
accept
socket
select
gethostbyname
htonl
htons
inet_addr
bind
WSAGetLastError
getsockname
getpeername
WSASetLastError
connect
sendto
recvfrom
WSAAsyncSelect
send
recv
WSACleanup
ntohs
getaddrinfo
WSAStartup

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

comdlg32

GetFileTitleA

advapi32

CryptGetHashParam
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegSetValueA
SetFileSecurityA
GetFileSecurityA
RegOpenKeyExW
RegEnumValueA
RegEnumKeyExA
CryptReleaseContext
CryptHashData
CryptDestroyKey
CryptDestroyHash
CryptEncrypt
CryptImportKey
CryptCreateHash
CryptAcquireContextA
CryptGenRandom

ole32

OleDestroyMenuDescriptor
OleCreateMenuDescriptor
IsAccelerator
OleTranslateAccelerator
OleGetClipboard
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
DoDragDrop
OleLockRunning
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CoGetClassObject
CreateStreamOnHGlobal
CoInitialize
CoInitializeEx
CoCreateInstance
CoUninitialize
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
StringFromCLSID
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CoCreateGuid

oleaut32

VarBstrFromDate
SysFreeString
SysAllocStringLen
SysAllocStringByteLen
VariantClear
VariantChangeType
VariantInit
SysStringLen
OleCreateFontIndirect
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy
SysAllocString
VariantCopy

wldap32

ord22
ord211
ord143
ord60
ord50
ord26
ord30
ord200
ord32
ord35
ord79
ord33
ord301
ord27
ord41
ord46

crypt32

CertFreeCertificateContext

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 372KB - Virtual size: 372KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 187KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

18f49b7884ee46a16ba60a49e4620a45

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

msimg32

comctl32

shlwapi

oledlg

gdiplus

ws2_32

oleacc

imm32

winmm

winspool.drv

comdlg32

advapi32

ole32

oleaut32

wldap32

crypt32

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 372KB - Virtual size: 372KB

.data Size: 27KB - Virtual size: 59KB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.reloc Size: 187KB - Virtual size: 186KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 372KB - Virtual size: 372KB

.data
Size: 27KB - Virtual size: 59KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

.reloc
Size: 187KB - Virtual size: 186KB