2024-05-17_4a43e884c59c2bd6679880e9f75cfe40_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-17_4a43e884c59c2bd6679880e9f75cfe40_mafia
Size

2.4MB
MD5

4a43e884c59c2bd6679880e9f75cfe40
SHA1

0171aeb0d589fb48dc1b631bca027718a196421b
SHA256

9a87eb46b988743d63cec5402bd53e467386fdc136bb9acfa4e046006ec36636
SHA512

be29a0353c14eea633c92c5d75b6290bcfdba1c4a6e30995e55cd8f41800e5e8ddbe85758f7359ef8e0bf569e212df6842236fc34f0dcf3c9b86400dff6e54f5
SSDEEP

49152:5uIIKXofs2hPd2l17EBTK2VbDshr3YDj:5jSfs2hPIl1V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-17_4a43e884c59c2bd6679880e9f75cfe40_mafia

Files

2024-05-17_4a43e884c59c2bd6679880e9f75cfe40_mafia
.exe windows:5 windows x86 arch:x86

97f5c5cdc5e80758b7adff3a733244ad

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

p:\p\agents\hpam2.eem\recipes\201152726\base\branches\inputtools_win_release_branch\googleclient\ime\goopy\scons-out\opt\obj\components\win_frontend\ipc_console.pdb

Imports

advapi32

RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
ConvertSidToStringSidW
GetLengthSid
GetSecurityInfo
CopySid
GetUserNameW
GetTokenInformation
OpenProcessToken
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenCurrentUser
RegQueryValueExW
RegNotifyChangeKeyValue
GetSidSubAuthority
GetSidSubAuthorityCount
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
IsValidSid

kernel32

TerminateProcess
GetModuleFileNameA
IsDebuggerPresent
GetCurrentThreadId
OutputDebugStringA
ReleaseMutex
CloseHandle
DebugBreak
GetTempPathA
GlobalAlloc
LocalFree
ResetEvent
SetEvent
WaitForMultipleObjects
CreateThread
Sleep
GetVersionExW
InterlockedCompareExchange
GetSystemTimeAsFileTime
SystemTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
QueryPerformanceCounter
FindFirstFileW
FindNextFileW
GetFullPathNameW
DeleteFileW
RemoveDirectoryW
GetSystemTime
LockResource
FindResourceExW
FindClose
MulDiv
SetProcessWorkingSetSize
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateFileW
GetTickCount
WriteFile
ExitThread
LoadLibraryW
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
HeapAlloc
HeapFree
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeW
CancelIo
ReadFile
GetOverlappedResult
FlushInstructionCache
SetLastError
InterlockedExchange
EncodePointer
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WideCharToMultiByte
HeapSetInformation
GetStartupInfoW
ExitProcess
VirtualProtect
VirtualQuery
RtlUnwind
GetCPInfo
LCMapStringW
GetStdHandle
HeapCreate
GetLocaleInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetTimeZoneInformation
SetFilePointer
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
SetStdHandle
CreateFileA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
GetThreadLocale
CopyFileW
SetFileAttributesW
GetTempPathW
GetFileSizeEx
CreateDirectoryW
GetFileAttributesW
GetCurrentDirectoryW
CreateMutexW
WaitForSingleObject
GetCurrentProcess
CreateProcessW
GlobalFree
GlobalLock
GlobalUnlock
SetThreadPriority
ResumeThread
OpenThread
FormatMessageA
GetModuleHandleA
AllocConsole
LoadLibraryA
GetLongPathNameW
GetTempFileNameW
MoveFileW
GetFileAttributesExW
GetDiskFreeSpaceExW
GetDriveTypeW
GetUserDefaultUILanguage
VerSetConditionMask
VerifyVersionInfoW
FindFirstFileExW
GetFileInformationByHandle
PeekNamedPipe
GetDriveTypeA
FindFirstFileExA
GetFullPathNameA
GetCommandLineW
InitializeCriticalSection
CreateEventW
GetCurrentProcessId
ProcessIdToSessionId
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
FindResourceW
LoadResource
GetFileSize
SizeofResource
RaiseException
lstrcmpiW
lstrlenW
FreeLibrary
GetModuleFileNameW
GetProcAddress
GetModuleHandleW
GetLastError
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
MultiByteToWideChar

user32

SetWindowPos
LoadCursorW
DestroyMenu
CreatePopupMenu
TrackPopupMenu
TrackPopupMenuEx
GetShellWindow
GetDC
ReleaseDC
AppendMenuW
SetMenuItemBitmaps
SendMessageW
UnregisterClassA
MoveWindow
GetWindowRect
BeginPaint
EndPaint
InvalidateRect
InvalidateRgn
ShowWindow
IsWindowVisible
CharNextW
IsWindowEnabled
SetCapture
SetWindowRgn
GetClassInfoExW
SetRect
TrackMouseEvent
GetKeyState
ReleaseCapture
UpdateLayeredWindow
OffsetRect
SetCursor
IntersectRect
MessageBoxA
wvsprintfW
wsprintfW
MessageBoxW
IsWindow
DispatchMessageW
DefWindowProcW
CreateWindowExW
SetWindowLongW
PeekMessageW
GetWindowLongW
RegisterClassExW
TranslateMessage
KillTimer
PostMessageW
PostQuitMessage
GetMessageW
SetTimer
DestroyWindow
GetMonitorInfoW
SetWindowTextW
GetCursorPos
EndDialog
GetDlgItem
SetCursorPos
GetForegroundWindow
SetFocus
DialogBoxParamW
MonitorFromPoint
ScreenToClient
ClientToScreen

ole32

CoInitializeEx
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoInitialize
CoUninitialize
CoCreateGuid
CreateStreamOnHGlobal

oleaut32

SysFreeString
SysStringLen
SysAllocString
VarUI4FromStr

gdi32

EnumEnhMetaFile
CloseEnhMetaFile
CreateEnhMetaFileW
GetCurrentObject
GetFontUnicodeRanges
GetTextMetricsW
GetOutlineTextMetricsW
GetObjectA
AddFontMemResourceEx
DeleteEnhMetaFile
CreateFontIndirectW
CreateRectRgn
BitBlt
CreateCompatibleDC
DeleteDC
CombineRgn
ExtCreateRegion
GetDIBits
CreateDCW
GetObjectW
DeleteObject
RemoveFontMemResourceEx
SelectObject
GetDeviceCaps
CreateDIBSection

gdiplus

GdipCreateFromHDC
GdipGraphicsClear
GdiplusStartup
GdipCloneImage
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipGetImageEncodersSize
GdipAlloc
GdipCreateBitmapFromScan0
GdipFree
GdipRestoreGraphics
GdiplusShutdown
GdipBitmapGetPixel
GdipGetImagePixelFormat
GdipDrawImageRectRectI
GdipPrivateAddFontFile
GdipDrawImageI
GdipSetClipGraphics
GdipCloneFontFamily
GdipCreateRegion
GdipDeleteRegion
GdipSetEmpty
GdipCombineRegionRect
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipSetImageAttributesRemapTable
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipImageRotateFlip
GdipGetImageHeight
GdipGetImageWidth
GdipDeleteFont
GdipCreateBitmapFromStream
GdipGetFontCollectionFamilyCount
GdipGetFontCollectionFamilyList
GdipNewPrivateFontCollection
GdipDeletePrivateFontCollection
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawDriverString
GdipFillRectangleI
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipDeleteBrush
GdipCloneBrush
GdipCreateSolidFill
GdipCreateTextureIAI
GdipSetTextureWrapMode
GdipCreatePen1
GdipDeletePen
GdipGetPenWidth
GdipSetCompositingQuality
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipResetWorldTransform
GdipTranslateWorldTransform
GdipScaleWorldTransform
GdipRotateWorldTransform
GdipDrawLine
GdipFillRectangle
GdipDrawImageRectRect
GdipSetClipRect
GdipSetClipRegion
GdipResetClip
GdipSaveGraphics
GdipCreateTextureIA
GdipGetFamilyName
GdipSaveImageToStream

winmm

timeGetTime

crypt32

CryptFindOIDInfo

shell32

SHCreateDirectoryExW
ShellExecuteW
SHGetFolderPathW
SHFileOperationW
SHGetSpecialFolderPathW

shlwapi

PathCanonicalizeW
PathCombineW
PathFileExistsW
StrDupW
PathFindExtensionW
PathRemoveFileSpecW
PathRemoveBackslashW
PathIsDirectoryW
PathIsRelativeW

secur32

CompleteAuthToken
FreeCredentialsHandle
AcquireCredentialsHandleA
InitializeSecurityContextA
DeleteSecurityContext
QueryCredentialsAttributesW
FreeContextBuffer
QueryContextAttributesW
DecryptMessage
EncryptMessage
ApplyControlToken
AcquireCredentialsHandleW

usp10

ScriptItemize
ScriptBreak
ScriptShape
ScriptStringFree
ScriptStringOut
ScriptStringAnalyse
ScriptCPtoX
ScriptLayout
ScriptPlace
ScriptFreeCache

ws2_32

getsockopt
socket
getsockname
getpeername
bind
connect
setsockopt
send
sendto
recv
recvfrom
listen
WSACloseEvent
closesocket
ioctlsocket
WSAEnumNetworkEvents
WSAGetLastError
WSAWaitForMultipleEvents
WSAEventSelect
WSAStartup
WSACleanup
WSACreateEvent
getaddrinfo
freeaddrinfo
WSAResetEvent
WSASetEvent
accept
WSCEnumProtocols

wininet

InternetQueryOptionW

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 360KB - Virtual size: 360KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

97f5c5cdc5e80758b7adff3a733244ad

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

ole32

oleaut32

gdi32

gdiplus

winmm

crypt32

shell32

shlwapi

secur32

usp10

ws2_32

wininet

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 360KB - Virtual size: 360KB

.data Size: 108KB - Virtual size: 119KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 161KB - Virtual size: 161KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 360KB - Virtual size: 360KB

.data
Size: 108KB - Virtual size: 119KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 161KB - Virtual size: 161KB