2024-05-15_5131a43acc3e99f36ca53a7ea0582edc_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-15_5131a43acc3e99f36ca53a7ea0582edc_mafia
Size

5.2MB
MD5

5131a43acc3e99f36ca53a7ea0582edc
SHA1

5ccdb139f3398f76b6c6b0ce1ce3f43dbece092b
SHA256

1e2a2d992a3891a73fcc9bdb15d515f1fd6f4dbc8cd127a795b7a4167574e928
SHA512

6e41d4399c9ff26459a8c1bdb82124da9e87cbf82716322aa7d05b127c73bb45af13addb987fd90c9e544f47b8d7faa6f45b627ac825980d2bf83abf626c0b7e
SSDEEP

98304:FkYInOLFB3OZ/OHu3mxSa6ewRaHpvvcwvhphz6skYsUI8YY5ACW0484U75yye2Ua:FkYInNZ2RbwRx857ZVyy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-15_5131a43acc3e99f36ca53a7ea0582edc_mafia

Files

2024-05-15_5131a43acc3e99f36ca53a7ea0582edc_mafia
.exe windows:5 windows x86 arch:x86

dcd8b1090aff49a47be3d92d81c088ac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
Sleep
GetProcAddress
FreeLibrary
WaitForSingleObject
GetExitCodeThread
CloseHandle
CreateThread
ExitThread
TlsFree
DeleteCriticalSection
TlsGetValue
TlsSetValue
LeaveCriticalSection
EnterCriticalSection
GetCurrentThread
SetThreadPriority
InitializeCriticalSection
TlsAlloc
IsBadWritePtr
WideCharToMultiByte
GetVersionExA
GetProcessHeap
SetEndOfFile
SetStdHandle
WriteConsoleW
SetEnvironmentVariableA
CompareStringW
IsValidLocale
EnumSystemLocalesA
SleepEx
QueryPerformanceCounter
SwitchToThread
FormatMessageA
GetLastError
LocalFree
GetCurrentProcess
GetLongPathNameW
InterlockedIncrement
InterlockedDecrement
FindFirstFileW
FindNextFileW
FindClose
CreateDirectoryA
CreateDirectoryW
GetLocalTime
GetSystemTimeAsFileTime
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
HeapFree
HeapReAlloc
HeapAlloc
GetCommandLineW
HeapSetInformation
GetStartupInfoW
GetModuleHandleW
ExitProcess
MoveFileA
DeleteFileW
MoveFileW
RaiseException
RtlUnwind
GetCPInfo
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
SetLastError
GetCurrentThreadId
HeapSize
WriteFile
GetStdHandle
GetModuleFileNameW
GetLocaleInfoW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
GetCurrentProcessId
LoadLibraryW
GetTimeZoneInformation
CreateFileA
CreateFileW
ReadFile
SetFilePointer
GetUserDefaultLCID
GetLocaleInfoA
DeleteFileA

user32

GetForegroundWindow
DrawTextW
DrawTextA
GetCursor
ReleaseDC
GetClientRect
GetDC
GetWindowInfo
AdjustWindowRect
GetKeyboardLayout
GetCursorPos
MessageBoxA
PostQuitMessage
DefWindowProcW
ScreenToClient
IsIconic
SendMessageW
SetForegroundWindow
FindWindowW
DestroyWindow
UnregisterClassW
PeekMessageW
TranslateMessage
DispatchMessageW
LoadIconW
LoadCursorW
RegisterClassExW
CreateWindowExW
SetCursor
DestroyIcon
GetWindowLongW
SystemParametersInfoW
ShowWindow
UpdateWindow
SetActiveWindow
SetWindowLongW
SetWindowPos

shell32

SHGetSpecialFolderPathA
SHGetFolderPathW
CommandLineToArgvW

jngload

?freeData@@YAXAAPAK@Z
?readMNG@@YAXPBXAAK1AAPAKK@Z

winmm

timeGetTime
timeEndPeriod
timeBeginPeriod

shlwapi

PathFindFileNameW

psapi

GetModuleFileNameExW
EnumProcessModules

d3d8

Direct3DCreate8

dinput8

DirectInput8Create

ws2_32

recv
select
__WSAFDIsSet
send
connect
closesocket
WSAGetLastError
socket
setsockopt
htons
ioctlsocket
getsockopt
inet_addr

gdi32

GetDIBits
GetObjectA
CreateFontIndirectA
BitBlt
SetTextColor
SetBkColor
SetBkMode
CreateDIBSection
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontW
CreateSolidBrush
DeleteObject
DeleteDC

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExA
RegCloseKey
RegOpenKeyExA

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 387KB - Virtual size: 387KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 267KB - Virtual size: 266KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dcd8b1090aff49a47be3d92d81c088ac

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

jngload

winmm

shlwapi

psapi

d3d8

dinput8

ws2_32

gdi32

advapi32

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 30KB - Virtual size: 68KB

.rsrc Size: 387KB - Virtual size: 387KB

.reloc Size: 267KB - Virtual size: 266KB

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 30KB - Virtual size: 68KB

.rsrc
Size: 387KB - Virtual size: 387KB

.reloc
Size: 267KB - Virtual size: 266KB